CMMC AI Security: Securing and Governing AI Agents

Why AI agents change the CMMC enforcement surface

CMMC Level 2 security requirements align to the 110 requirements in NIST SP 800-171 Revision 2 for protecting Controlled Unclassified Information. The CMMC Program final rule establishes assessment and certification expectations for defense contractors handling Federal Contract Information and CUI. Neither the rule nor NIST SP 800-171 currently defines AI-agent-specific controls. Enterprises must therefore interpret agent runtime behavior through existing practice families.

AI agents act as processes that can invoke tools, APIs, models, and data sources. That expands the enforcement surface beyond traditional user sessions. Non-human identities appear. Tool-calling and retrieval workflows create dynamic data paths. Multi-step plans can chain privileged actions quickly if tokens or connectors are over-scoped. Static pre-deployment review alone cannot constrain every post-deployment action path. Runtime policy enforcement, bounded identity, and evidence-producing audit trails become operational necessities for CMMC-aligned environments.

CMMC practices most affected by agent deployment

Several NIST SP 800-171 families are stressed immediately when agents reach enterprise systems and CUI-related workflows.

Access Control requires limiting system access to authorized users, processes acting on behalf of authorized users, and devices, and employing least privilege. Agents are processes acting on behalf of organizational intent. Shared service accounts, broad API keys, or unscoped tool catalogs conflict with those objectives.

Identification and Authentication requires authenticating users, processes, or devices before access is allowed. Agent identities should be unique, non-shared, and distinct from human accounts and from underlying model endpoints. Weak binding between an agent session and the credentials used for tools undermines IA objectives such as IA.L2-3.5.1.

Audit and Accountability requires creating, protecting, retaining, and reviewing audit records sufficient to monitor, analyze, and investigate unauthorized activity. Agent operations need correlated records of identity, policy decision, tool invocation, resource accessed, and outcome. Partial prompt logs without tool-call and access context leave assessment gaps against objectives such as AU.L2-3.3.1.

System and Communications Protection and related boundary controls are affected when agents can reach export paths, external model endpoints, email, code execution, or uncontrolled connectors. Retrieval-augmented workflows can move CUI-adjacent content across trust boundaries if data segmentation and egress policy are not enforced at the agent control plane.

CMMC assessment objectives evaluate whether practices are implemented as stated. Evidence typically includes configuration settings, access authorizations, audit logs, and policy or procedure artifacts that demonstrate sustained control operation. Agent platforms must produce the same class of proof, not only architectural diagrams.

Runtime architecture for CMMC-aligned agent control

A practical architecture separates agent reasoning from privileged action and places enforceable checkpoints where CUI risk concentrates. Reasoning may plan multi-step work, but execution of tools, connectors, and data access should pass through a policy mediation layer that evaluates identity, authorization, data boundaries, and egress rules before any privileged call runs.

• Bind each agent to a unique, non-human identity with credentials distinct from operator accounts and model endpoints.
• Maintain a denial-by-default catalog of tools, APIs, datasets, and model routes the agent may invoke.
• Mediate every tool call at runtime, including intermediate steps in multi-step plans, so unauthorized actions can be blocked before execution.
• Enforce CUI data boundaries on retrieval, connectors, and external model endpoints.
• Emit immutable, correlated audit records for policy decisions, access attempts, tool invocations, and outcomes.

Implementation steps for controlled enterprise AI operations

Implementation should start from scoped system boundaries and known agent capabilities, then attach concrete control operation and evidence collection.

1. Inventory agents, tools, connectors, data sources, and model endpoints that can touch FCI or CUI pathways.
2. Define system boundaries and data flows in the system security plan, including inheritance from shared platforms.
3. Issue unique agent identities and map least-privilege permissions per tool, API, and dataset.
4. Enable runtime policy mediation with deny-by-default catalogs and documented approval for high-risk tools.
5. Configure retention, protection, and review of audit records covering identity, decision, invocation, resource, and outcome.
6. Exercise continuous monitoring and incident response for autonomous or semi-autonomous actions, including POA&M handling where allowed.

Governance and accountability for agent fleets

Treat AI agents as systems and processes subject to the same CUI protection obligations as other in-scope applications. Ownership should cover agent inventory, permission review cadence, model and tool change control, and incident response for autonomous or semi-autonomous actions.

Human accountability remains required for policy exceptions and high-risk tool enablement. Approvals should be documented and reviewable. NIST AI RMF functions for govern and manage provide voluntary structure for AI risk oversight across the lifecycle, including privacy, information security, and human-AI configuration concerns highlighted in generative AI profile guidance. Align that AI risk governance with the CMMC system security plan, continuous monitoring, and POA&M handling where allowed.

Vendor statements about CMMC alignment are not substitutes for organization-scoped implementation and assessment evidence. Assessors evaluate whether controls operate and whether retained artifacts support investigation and monitoring. Design governance so evidence can be sampled without reconstructing sessions from incomplete telemetry.

Practical operating practices

Sustainable CMMC AI security depends on repeatable operations, not one-time design reviews.

• Review agent permissions on a fixed cadence and after any tool, model, or connector change.
• Require dual control or documented approval before enabling high-risk actions (export, code execution, broad retrieval, external messaging).
• Correlate identity, policy decision, and tool outcome in logs suitable for assessment sampling.
• Test deny paths and boundary enforcement, not only happy-path workflows.
• Record residual risk, control inheritance, and interpretive mappings in the system security plan.

Limitations and assessment reality

Public official guidance on exact evidence artifacts for autonomous agent tool calls in CMMC assessments remains limited. Mapping from agent runtime behavior to existing practices is interpretive. Organizations should document assumptions, control inheritance, and residual risk clearly in the system security plan.

The goal is controlled enterprise AI operations: agents that can deliver workflow value without opening uncontrolled model, tool, data, identity, or access pathways that undermine FCI or CUI protection. Runtime governance, least-privilege authorization, and auditability are the practical levers available under current CMMC Level 2 expectations.