# AIUC-1: AI Usage Control Mapping _Last updated: 2026-08-05_ Morphisec AI Usage Control maps to AIUC-1 controls across all six pillars. AIUC-1 is an independent certification standard for AI agents issued by The Artificial Intelligence Underwriting Company; Morphisec is an endpoint-native security product that governs AI tools running on your devices. Morphisec is not affiliated with, endorsed by, or certified under AIUC-1. This page documents which AIUC-1 controls Morphisec enforces directly at the execution layer, which it supports with evidence, and which belong to other layers or organizations. ## About AIUC-1 AIUC-1 is an independent certification standard for AI agents, launched in 2025 and issued by The Artificial Intelligence Underwriting Company (San Francisco). The standard defines 51 requirements and approximately 130 controls across six pillars: Data & Privacy, Security, Safety, Reliability, Accountability, and Society. Vendors earn AIUC-1 certification through third-party audits and adversarial testing. Certificates are valid for 12 months; technical controls are re-tested at least quarterly; and the standard itself is refreshed every quarter. The standard was developed with input from more than 100 Fortune 500 CISOs. Consortium and technical contributors include Microsoft, Google Cloud, Cisco, OWASP, MITRE, Anthropic, Stanford, Salesforce, Fidelity, and MIT. AIUC-1 maps to the EU AI Act, NIST AI RMF, ISO 42001, MITRE ATLAS, and the OWASP agentic security lists, and is integrated into the Cloud Security Alliance's STAR registry. ## Why an Endpoint Runtime Layer Maps to AIUC-1 AIUC-1 explicitly requires execution-level safeguards: pre-execution authorization checks on runtime tool calls, restrictions on unsafe tool calls, data-loss controls on what agents transmit, and logs of what AI systems actually did. The execution layer—where an agent's decision becomes a real action on a device (a file access, process launch, or data transfer)—is where Morphisec operates. | **Layer** | **Prompt Layer** | **Execution Layer** | |---|---|---| | **What it inspects** | What goes into a model and what comes out | The system call an agent's decision becomes: a file access, process launch, data transfer | | **Prompt injection vulnerability** | Can be defeated; a malicious instruction arrives through the same channel as a legitimate one | Cannot be prompt-injected; even when injection succeeds, the execution is still caught | | **Evidence provided** | What the agent said or was asked | What actually executed on the device | | **Coverage** | Agents routed through the guardrail | Every AI on the endpoint, certified, uncertified, sanctioned, or shadow | Prompt-layer guardrails and EDR tools remain essential. Morphisec adds AI-aware enforcement at the one layer that cannot be talked out of its policy. ## Direct AIUC-1 Controls: Nine Execution-Layer Enforcements Across AIUC-1's approximately 130 controls, these nine are the ones an endpoint runtime layer can actually enforce, not merely document. | **Control** | **AIUC-1 Requirement** | **Morphisec AI Usage Control Enforcement** | |---|---|---| | **A003** | Limit AI agent data access | Binds AI activity to user, process, agent, and endpoint context; flags agents reaching into source code, credentials, and sensitive folders. | | **B006** | Prevent unauthorized AI agent actions | Terminates non-sanctioned AI agents at runtime and blocks agent activity that falls outside approved scope. | | **B007** | Enforce user access privileges to AI systems | Identity-aware policy: enforces which AI tools may run, by user, role, or department, with Entra ID context. | | **B008** | Protect the AI deployment environment | Hardens the endpoint where agents execute with AI process inventory, runtime enforcement, and AMTD memory protection. | | **D003** | Restrict unsafe tool calls | Governs what agents may invoke locally: child processes, file writes, network destinations, and Model Context Protocol (MCP) tool usage. | | **E009** | Monitor third-party access | Discovers AI tools, plugins, MCP servers, and their network destinations, exposing unmanaged third-party AI paths. | | **E010** | Establish AI acceptable-use policy | Turns written policy into enforcement; detects unmanaged AI and acts against unsanctioned agents automatically. | | **E015** | Log AI system activity | Complete, exportable AI activity log: tool name, sanctioned status, owner, user, device, process lineage, enforcement action, timestamp. | | **F001** | Prevent AI cyber misuse | Controls the endpoint paths AI misuse runs through: coding agents, process execution, MCP and tool usage, network behavior. | ## Full AIUC-1 Pillar Mapping ### Data & Privacy (A Controls) AIUC-1's A controls govern what data an AI agent may reach and how leakage of intellectual property, trade secrets, and personally identifiable information (PII) is prevented. **Direct Control** **A003: Limit AI agent data access.** Morphisec binds every AI action to a user, process, agent, endpoint, and context, enabling agent data access to be limited by task, user, and role rather than left to the agent's discretion. Discovery and policy enforcement establish which agents may run at all; identity interception establishes what each one is touching. **Supporting Evidence** **A004: Protect IP & trade secrets.** Behavioral profiling detects AI agents reaching into unusual source-code, document, or sensitive folders. Positioned as runtime exposure evidence, not comprehensive data-loss prevention (DLP). **A006: Prevent PII leakage.** Behavioral detection identifies AI access to abnormal sensitive locations. Positioned as runtime exposure reduction, not content-level PII inspection. **Not claimed by Morphisec:** A001, A002, A005, A007, A008 ### Security (B Controls) AIUC-1's B controls cover adversarial robustness, unauthorized AI agent actions, access privileges, and protection of the environment agents are deployed into. This is the primary fit for an endpoint runtime layer. **Direct Controls** **B006: Prevent unauthorized AI agent actions.** Morphisec terminates non-sanctioned AI agents and blocks agent activity that falls outside approved scope at the moment of execution. This is enforcement, not an acceptable-use document. **B007: Enforce user access privileges to AI systems.** AI identity interception plus managed/unmanaged classification provide the runtime context to enforce who may run which AI tools, under which policy, by role or department with Entra ID context. **B008: Protect AI system deployment environment.** Endpoint runtime protection, AI process inventory, enforcement, and AMTD memory protection harden the environment where AI agents execute. **Supporting Evidence** **B002: Detect adversarial input.** Where prompt injection or adversarial usage produces observable process, network, or tool-execution behavior, Morphisec surfaces it as supporting evidence. This is behavioral, not prompt-content inspection. **Not claimed by Morphisec:** B001, B003, B004, B005, B009 ### Safety (C Controls) AIUC-1's C controls are largely output-safety and risk-management controls: harmful outputs, out-of-scope outputs, human review, and third-party safety testing. **Supporting Evidence** **C006: Prevent output vulnerabilities.** For coding agents, abnormal child-process execution, unusual file writes, and suspicious build or script behavior are the runtime consequence of risky generated code. Morphisec sees and can stop that consequence. **C008: Monitor AI risk categories.** Behavior profiling monitors AI-runtime risk categories: unusual file access, process execution, network activity, and MCP/tool usage. **C009: Enable real-time feedback and intervention.** Granular remediation and runtime blocking provide the endpoint intervention mechanism for risky AI activity. **Not claimed by Morphisec:** C001, C002, C003, C004, C005, C007, C010, C011, C012 ### Reliability (D Controls) AIUC-1's D controls cover hallucination and unsafe tool calls. Tool calls are where an agent's reasoning becomes a real action on a real machine, exactly where Morphisec operates. **Direct Control** **D003: Restrict unsafe tool calls.** A primary fit. Morphisec restricts or terminates unmanaged AI agents, identifies agent identity, and detects abnormal child processes, folder access, network activity, and risky tool usage, evaluating the actual system call rather than the model's stated intent. **Supporting Evidence** **D004: Third-party testing of tool calls.** Morphisec supplies runtime telemetry, logs, and enforcement evidence to support external tool-call evaluations. The testing obligation itself remains third-party. **Not claimed by Morphisec:** D001, D002 ### Accountability (E Controls) AIUC-1's E controls cover acceptable use, third-party access, activity logging, incident response, and audit. These are the controls a security team must actually evidence at audit time. **Direct Controls** **E009: Monitor third-party access.** Discovery of AI tools, plugins, MCP servers, network destinations, and agent identity exposes third-party AI access paths and unmanaged integrations. **E010: Establish AI acceptable-use policy.** Morphisec operationalizes acceptable use: detecting unmanaged AI and enforcing against unsanctioned agents. A policy nobody can enforce is a document, not a control. **E015: Log AI system activity.** A direct fit. Morphisec discovers AI processes and runtime behavior, logs enforcement actions, and supports investigation, auditing, and explanation of agent behavior. **Supporting Evidence** **E001: AI failure plan for security breaches.** Morphisec telemetry and remediation support incident response for AI runtime misuse. The failure plan itself is organizational. **E004: Assign accountability.** Identity interception assigns runtime accountability to user, process, endpoint, and agent context. **E005: Document data storage security.** Morphisec documents where AI processes run, which local resources they access, and which runtime environments exist on endpoints. **E006: Conduct vendor due diligence.** AI tool inventory, extensions, plugins, MCP servers, and network destinations support vendor and tool due diligence. **E011: Record processing locations.** Endpoint and network telemetry helps document where AI processes execute and communicate. **E012: Document regulatory compliance.** The mapping supports evidence packages. Compliance ownership remains the customer's. **Not claimed by Morphisec:** E002, E003, E013, E016, E017 ### Society (F Controls) AIUC-1's F controls cover the misuse of AI as a cyber weapon and at catastrophic scale. **Direct Control** **F001: Prevent AI cyber misuse.** Endpoint controls over coding agents, process execution, MCP and tool usage, and outbound network behavior are directly relevant to preventing AI-enabled cyber misuse and exploitation. These are the paths AI misuse runs through. **Not claimed by Morphisec:** F002 ## Where Morphisec Stops Short AIUC-1 covers controls Morphisec does not own. Morphisec will not claim them. - **Output safety and moderation** (C003, C005, C007, B009): Preventing harmful, out-of-scope, or high-risk outputs is the AI vendor's control, at the model layer. - **Hallucination prevention and testing** (D001, D002): Not an endpoint-runtime capability. - **Third-party adversarial and safety testing** (B001, C002, C010, C012, D004): An audit obligation. Morphisec can contribute logs and test scenarios; it cannot be the auditor. - **Policy, disclosure, and governance process** (A001, A002, B003, E013, E016, E017): Input/output data policy, public disclosure, quality management, and transparency policy belong to your governance program. - **Catastrophic misuse guardrails** (F002): CBRN-class safeguards are out of scope for an endpoint AI Usage Control. ## Morphisec AI Usage Control: Capability Status Every control claim rests on a capability. Here is the current status of each. | **Capability** | **Status** | |---|---| | **AI endpoint discovery** — Detects coding-agent processes, AI applications, installations, browser and IDE extensions, plugins, MCP servers, and related network activity | Available today | | **Managed vs. Shadow AI classification** — Reports sanctioned AI, unsanctioned AI, and sanctioned-but-unmanaged AI | Available today | | **Runtime enforcement** — Terminates non-sanctioned AI agents and enforces policy at the endpoint runtime layer | Available today | | **AI identity interception** — Attributes AI activity to process, user, agent, endpoint, and context | Linux & macOS today; broader OS coverage coming next | | **Behavioral profiling & anomaly detection** — Per-tool behavioral baselines detecting abnormal folder access, process execution, network behavior, and unusual tool usage | Second half of 2026 | | **Granular remediation** — Least-privilege action-level blocking to stop a specific risky AI action without stopping the agent's approved work | Second half of 2026 | ## Compliance Evidence Export Morphisec AI Usage Control produces an exportable, execution-layer record of every AI action on every endpoint. A log of what actually ran, not what an agent reported. This evidence maps to the EU AI Act, NIST AI RMF, ISO 42001, and SOC 2. **Fields included:** AI tool name, sanctioned status, owner, user, device, process lineage, extension/plugin/MCP, network destination, enforcement action, anomaly status, timestamp. ## Frequently Asked Questions ### What is AIUC-1? AIUC-1 is an independent certification standard for AI agents, often described as "SOC 2 for AI agents." Launched in 2025, it defines 51 requirements and roughly 130 controls across six pillars: Data & Privacy, Security, Safety, Reliability, Accountability, and Society. AI vendors earn certification through third-party audits and adversarial testing, with certificates valid for 12 months and technical controls re-tested at least quarterly. The standard is refreshed every quarter and maps to frameworks security teams already track, including the EU AI Act, NIST AI RMF, ISO 42001, MITRE ATLAS, and the OWASP agentic security lists. ### Who is behind AIUC-1? AIUC-1 is issued by The Artificial Intelligence Underwriting Company (San Francisco), which develops the standard, accredits auditors, and offers insurance for certified AI agents. The standard was developed with input from more than 100 Fortune 500 CISOs. Consortium and technical contributors include Microsoft, Google Cloud, Cisco, OWASP, MITRE, Anthropic, Stanford, Salesforce, Fidelity, and MIT. It has also been integrated into the Cloud Security Alliance's STAR registry. ### What is Morphisec AI Usage Control? Morphisec AI Usage Control is an endpoint-native module inside the Morphisec Protector that discovers and governs the AI tools, agents, and Model Context Protocol (MCP) connectors running across your endpoints on Windows, Linux, and macOS. It follows a four-part model: Discover (inventory every AI tool, including shadow AI), Govern (identity-aware policy over which AI may run, by role or department), Guardrails (block risky AI actions before they execute), and React (per-tool behavioral baselines that flag abnormal activity). Discovery, governance (including terminating agents that fall outside sanctioned policy), and audit-ready compliance evidence are available today; more granular runtime guardrails and local anomaly detection arrive in the second half of 2026. ### Is Morphisec AI Usage Control the same thing as AIUC-1? No. The similar names are a coincidence. AIUC-1 is an industry certification standard for AI agents, issued by The Artificial Intelligence Underwriting Company. Morphisec AI Usage Control is a Morphisec security product. They are complementary: the standard certifies the AI agents vendors sell; Morphisec governs the AI actually running inside your environment. ### Is Morphisec AIUC-1 certified? AIUC-1 certification applies to AI agent products that vendors sell: customer-facing chatbots, voice agents, automation agents, and similar systems. Morphisec plays a different position: it is the enterprise-side control that governs all AI agents and tools on your endpoints, certified or not. Morphisec capabilities map directly to AIUC-1 controls across all six pillars, with the strongest, most direct fit in agent data access (A003), unauthorized-action prevention (B006), access-privilege enforcement (B007), deployment-environment protection (B008), unsafe tool-call restriction (D003), third-party access monitoring (E009), acceptable-use enforcement (E010), activity logging (E015), and AI-misuse prevention (F001), generating the execution-layer evidence the standard calls for. ### Our AI vendors are AIUC-1 certified. Doesn't that cover us? Certification is a good signal. It means the agent you bought was independently tested, within the scope of its audit. But it covers only that vendor's agent. It says nothing about the dozens of other AI tools on your endpoints: the copilots and assistants employees adopt on their own, local LLMs like Ollama, coding agents in IDEs, browser AI, and MCP connectors nobody certified. And a certified agent can still be hijacked at runtime through prompt injection or a poisoned supply chain. Certification tells you the agent was tested; it does not govern what AI actually does on your devices day to day. Runtime governance is what Morphisec AI Usage Control provides. ### What is the "execution layer," and why does it matter for AI agent security? Most AI security tools work at the prompt layer, inspecting what goes into a model and what comes out, using filters, guardrails, and classifiers. That work is necessary, but prompt injection remains an unsolved problem: a malicious instruction arrives through the same channel as legitimate ones, so a compromised agent can pass every prompt-layer check. The execution layer is different. It sits where an agent's decision becomes a real action on the device: a file access, process launch, or data transfer. Morphisec enforces policy at that point, evaluating the actual system call rather than the model's reasoning. The execution layer cannot be prompt-injected: even when prompt injection succeeds, Morphisec catches the execution. ### How does Morphisec support AIUC-1's requirements? AIUC-1 explicitly requires execution-level safeguards: pre-execution authorization checks on runtime tool calls, restrictions on unsafe tool calls, data-loss controls on what agents transmit, and logs of what AI systems actually did. Morphisec capabilities map directly to AIUC-1 controls spanning all six pillars, with nine controls: data access, unauthorized-action prevention, access-privilege enforcement, deployment-environment protection, unsafe tool-call restriction, third-party access monitoring, acceptable-use enforcement, activity logging, and misuse prevention. In practice that means: discovering every agent before you restrict it, verifying tool calls at the point of execution, blocking unauthorized data egress through agent actions, hardening the environment agents run on, and producing execution-layer audit logs—a record of what actually executed, not just what the agent reported. ### Does Morphisec help with the EU AI Act, NIST AI RMF, ISO 42001, or SOC 2? Yes. Morphisec AI Usage Control generates audit-ready evidence: a complete AI inventory, policy enforcement records, and usage events, mapped to the EU AI Act, NIST AI RMF, ISO 42001, and SOC 2. These are the same frameworks AIUC-1 itself operationalizes, so the evidence supports your compliance program whether or not your vendors pursue certification. ### Does Morphisec replace our AI guardrails, prompt filters, or EDR? No. It completes them. Prompt-layer guardrails and filters remain valuable, and your EDR remains essential; Morphisec runs alongside tools like Microsoft Defender, CrowdStrike, and SentinelOne and amplifies them. Prompt-layer tools validate what a model says, and EDR watches processes generically. Morphisec adds AI-aware enforcement at the execution point, defense in depth for the one layer that cannot be talked out of its policy. ### Do we need to deploy another agent? No. AI Usage Control is a module inside the Morphisec Protector. The same lightweight agent used for anti-ransomware protection, with under 1% CPU impact. There is no new agent, no proxy, and no cloud relay, and protection works offline. If you already run the Protector, you can turn on discovery and have a full AI inventory within a day. ### Which AI tools and agents can Morphisec see and govern? Coverage spans general assistants (Microsoft Copilot, ChatGPT, Claude, Gemini), coding AI (GitHub Copilot, Cursor, Codex, Windsurf and others), local LLM platforms (Ollama, LM Studio, GPT4All and more), browser extensions, MCP connectors, enterprise AI in everyday apps, and malicious AI tooling of the WormGPT and FraudGPT class. Because discovery is endpoint-native, it sees the CLI agents, IDE plugins, and local models that network- and browser-based tools structurally miss. ### What's available today, and what's coming? Available now: AI discovery and inventory, managed-vs-shadow AI classification, identity-aware governance, runtime enforcement (terminating AI agents and tools that fall outside sanctioned policy), and audit-ready compliance evidence, plus the Morphisec platform's execution-layer prevention (AMTD) and Data Exfiltration protection. AI identity interception is available today on Linux and macOS, with broader OS coverage coming next. Arriving in the second half of 2026: more granular runtime guardrails (least-privilege policies that block specific risky AI actions, such as reaching for credentials or writing to backups, without stopping the rest of the agent's approved work) and local anomaly detection with per-tool behavioral baselines. ### How do we get started? If you already run the Morphisec Protector, AI Usage Control can be enabled on your existing deployment. Most customers see their full AI inventory within a day. If you are new to Morphisec, book a demo at morphisec.com/demo. Morphisec will also demonstrate AI Usage Control live at Black Hat USA 2026, August 1 to 6 in Las Vegas.