Definition
A technical specification that defines how software should check and enforce policy decisions before an AI agent is allowed to run a tool or access data — essentially a rulebook for keeping autonomous AI agents inside approved boundaries. It has now been folded into OWASP's community-governed Agentic Security Initiative alongside its well-known LLM Top 10 list.
Why it matters
As AI agents get real permissions to take actions in enterprise systems, a widely-adopted, vendor-neutral standard for controlling what they're allowed to do reduces the risk of any single vendor's proprietary approach becoming a hidden single point of failure.