Intended Use Policy

Standard: ISO/IEC 42001:2023 Annex A.8.1 Document owner: Product Lead Review cadence: Annually; before entering a new domain or market Classification: Public (reference in API documentation)

---

1. Purpose

This document defines the intended use, supported configurations, and prohibited uses of the AgentTrust Edge Gateway AI governance system. Operators deploying AgentTrust accept responsibility for using it within the boundaries described here.

---

2. What AgentTrust Is

AgentTrust Edge Gateway is a runtime AI governance and quality assurance system. It evaluates the outputs of AI agents before those outputs are returned to users or downstream systems. It applies:

• 6 deterministic validation checks (schema, tool trust, policy, consistency, golden test, grounding)
• 7-signal explainable confidence scoring
• 4-factor risk scoring
• Policy-as-code rules (operator-configurable)
• Optional LLM judge evaluation (asynchronous, slow-path)
• Multi-agent trust chain enforcement

AgentTrust produces one of five governance decisions: approve, retry, request_evidence, escalate, or block.

---

3. Supported Use Cases

---

4. Supported Agent Frameworks

LangGraph · CrewAI · OpenAI Agents · Claude Agents · MCP (Model Context Protocol) · Custom HTTP agents · REST API calls

---

5. Deployment Environments

---

6. Performance Expectations

---

7. Operator Responsibilities

Operators deploying AgentTrust accept the following responsibilities:

1. Configuration accuracy: policy pack rules, risk thresholds, and confidence weights must reflect the operator's specific use case and risk appetite.
2. Human oversight: decisions with outcome escalate or request_evidence must route to qualified human reviewers. AgentTrust does not replace human judgement.
3. Data minimisation: operators must redact PII from agent inputs and outputs before submission where possible.
4. Incident reporting: operators must report adverse impacts via POST /v1/feedback/adverse-impact.
5. Secret management: AGENTRUST_JWT_SECRET and database credentials must be rotated regularly and stored securely.
6. Domain-specific policy: operators in regulated domains (healthcare, finance, legal) must supplement default policy packs with domain-specific rules and complete an AIIA (see docs/AIIA_TEMPLATE.md).
7. Acceptance testing: operators must validate AgentTrust with their specific agent types before production deployment.

---

8. Prohibited Uses

AgentTrust Edge Gateway must NOT be used as:

1. The sole decision-maker for high-stakes irreversible actions in healthcare, criminal justice, financial credit, or insurance — human oversight is mandatory in these domains.
2. A surveillance system to monitor individuals without legal basis and explicit consent.
3. A profiling system to make or influence decisions about individual employment, education, or legal rights without appropriate human review and legal authorisation.
4. A content moderation system for regulated speech without additional legal review (freedom of expression implications).
5. A system processing special-category GDPR data (health, biometric, racial origin, etc.) without explicit legal basis, a completed Data Protection Impact Assessment (DPIA), and DPO sign-off.

---

9. High-Risk Domain Addendum

Operators deploying in the following domains must complete an additional domain-specific AIIA and obtain written approval from the AI Governance Lead before production deployment:

• Medical diagnosis support or clinical decision support
• Financial trading, payment authorisation, or credit decisions
• Legal document generation with binding effect
• Child safety, safeguarding, or child welfare systems
• Criminal justice or law enforcement
• Critical infrastructure (energy, water, transport)

---

10. Disclaimer

AgentTrust Edge Gateway improves the reliability and safety of AI agent outputs but does not guarantee the absence of errors, bias, or harmful outputs. Operators remain responsible for the conduct of the AI agents they deploy and for compliance with applicable laws and regulations.

---

11. Document History

---