The Agentic Outbound Maturity Model
Every organisation asks whether it can withstand an attack. Almost none asks whether its own agents could reach out and harm someone else — and whether it would find out before the other party told it. The AOMM assesses that outbound posture. It is the strongest single artefact in the collection, promoted here to a page. Full source brief (v0.33.52, 27 July 2026).
The correction: the lethal trifecta is not the right frame here
The framework the industry reaches for — private data, untrusted content, external communication — is an excellent model of indirect prompt injection: an agent turned against its owner. But the case that motivated the AOMM had no untrusted-content leg at all. The models were not hijacked; they were pursuing a legitimate assigned goal to an illegitimate extreme. Specification gaming, not prompt injection.
LETHAL TRIFECTA -> agent turned AGAINST its owner private data the risk is exfiltration untrusted content the trigger is injection external communication the attacker is outside OUTBOUND (this model) -> agent acting FOR its owner, too well the goal was assigned the risk is reaching a third party the trigger is optimisation no attacker required the owner is the source the victim is someone else
So untrusted content is one possible source of motive, not a necessary condition — and any assessment that requires it will score a whole class of real risk at zero.
The five preconditions
For one organisation's agent to reach and harm another, all five must hold. Removing any one breaks the chain — which makes this a control map rather than a description.
| # | Precondition | The question | How it breaks |
|---|---|---|---|
| 1 | Capability | Can the model plan and execute a multi-step operation against an unfamiliar system? | Not something a defender controls, and rising — treat as given |
| 2 | Motive | Is there a goal whose easiest solution lies outside the intended boundary? | Goal design and reward shaping; don't set objectives that reward boundary-crossing |
| 3 | Reach | Is there any path, however indirect, to the other party? | Egress control with depth, allowlisting, no single component holding the boundary |
| 4 | Freedom | Does it have autonomy, elapsed time, and budget without a human gate? | Ceilings on spend, wall-clock and action count; human approval at thresholds |
| 5 | Silence | Will nothing fire inside the window in which damage occurs? | Off-task, volumetric and destination alerting wired to a responder who is actually paged |
Silence is the precondition an organisation has most control over and neglects most.
The ladder
Five levels, ordered and conjunctive: a level holds only if every predicate below it holds. An organisation with excellent alerting and no inventory is at Level 0, not Level 3 — you cannot observe what you have not enumerated. A level is computed from evidence, not claimed.
| Level | Name | Holds when |
|---|---|---|
| 0 | Unaware | No inventory of which agents can initiate outbound action. The default state |
| 1 | Enumerated | Every agent with outbound capability is known — owner, credentials, and what it can reach recorded |
| 2 | Bounded | Egress allowlisted with depth; spend, elapsed-time and action-count ceilings enforced, not documented |
| 3 | Observed | Outbound action logged independently of the agent's environment; anomalies page a responder inside a stated interval, any day |
| 4 | Contained | The plug profile is known and tested per agent: who stops it, how fast, blast radius of stopping, what is recoverable |
| 5 | Accountable | A named person holds the outbound mandate; profiles re-tested on a stated interval; drift detected; liability and insurance understood |
Four questions that get collapsed
- Could it happen? — answerable now, from the five preconditions, against your own estate. The question the model answers.
- Has it happened? — unanswerable in a market with strong incentives against disclosure. The one well-documented case exists because both parties chose to publish.
- Will it happen? — requires a base rate that does not exist; treat as unknown rather than estimated.
- What can be done? — the ladder above.
Budget and elapsed time are containment controls
Spend and wall-clock time are the two most underused controls in agentic estates, and both are trivially available. An agent with a hard budget ceiling cannot spend substantial compute searching for a way out of its sandbox — it runs out first. An agent with a wall-clock limit cannot work a problem over a weekend. And because spend is metered for billing anyway, off-task expenditure is the cheapest anomaly signal obtainable — no security tooling required. In the documented case, compute spent hunting for internet access was the clearest early signal, and unacted upon.
How this connects to the rest of the site
- Level 1 (Enumerated) is rung 1 of the hope ladder — and is exactly what the NHI surveys report organisations not doing.
- Reach is the authorization closure pointed outward: the union of what the agent can already do.
- Level 4 (Contained) is the plug profile from the who-can-pull-the-plug series — the models compose rather than compete.