The AIUC-1 control mapping
for AI Usage Control

Morphisec AI Usage Control is an endpoint-native module inside the Morphisec Protector that discovers and governs the AI tools, agents, and Model Context Protocol (MCP) connectors running across your endpoints, on Windows, Linux, and macOS. It follows a four-part model: Discover (inventory every AI tool, including shadow AI), Govern (identity-aware policy over which AI may run, by role or department), Guardrails (block risky AI actions before they execute), and React (per-tool behavioral baselines that flag abnormal activity). Discovery, governance (including terminating agents that fall outside sanctioned policy), and audit-ready compliance evidence are available today; more granular runtime guardrails and local anomaly detection arrive in the second half of 2026.

No. And the similar names are a coincidence worth clarifying. AIUC-1 is an industry certification standard for AI agents, issued by The Artificial Intelligence Underwriting Company. Morphisec AI Usage Control is a Morphisec security product. Morphisec is not affiliated with, endorsed by, or certified under AIUC-1. They are complementary: the standard certifies the AI agents vendors sell; Morphisec governs the AI actually running inside your environment.

AIUC-1 certification applies to AI agent products that vendors sell, customer-facing chatbots, voice agents, automation agents, and similar systems. Morphisec plays a different position: it is the enterprise-side control that governs all AI agents and tools on your endpoints, certified or not. What we can show you is the mapping: Morphisec capabilities map directly to AIUC-1 controls across all six pillars, with the strongest, most direct fit in agent data access (A003), unauthorized-action prevention (B006), access-privilege enforcement (B007), deployment-environment protection (B008), unsafe tool-call restriction (D003), third-party access monitoring (E009), acceptable-use enforcement (E010), activity logging (E015), and AI-misuse prevention (F001), generating the execution-layer evidence the standard calls for.

Certification is a genuinely good signal. It means the agent you bought was independently tested, within the scope of its audit. But it covers only that vendor’s agent. It says nothing about the dozens of other AI tools on your endpoints: the copilots and assistants employees adopt on their own, local LLMs like Ollama, coding agents in IDEs, browser AI, and MCP connectors nobody certified. And a certified agent can still be hijacked at runtime through prompt injection or a poisoned supply chain. Certification tells you the agent was tested; it does not govern what AI actually does on your devices day to day. That runtime governance is what Morphisec AI Usage Control provides.

Most AI security tools work at the prompt layer, inspecting what goes into a model and what comes out, using filters, guardrails, and classifiers. That work is necessary, but prompt injection remains an unsolved problem: a malicious instruction arrives through the same channel as legitimate ones, so a compromised agent can pass every prompt-layer check. The execution layer is different. It sits where an agent’s decision becomes a real action on the device. A file access, a process launch, a data transfer. Morphisec enforces policy at that point, evaluating the actual system call rather than the model’s reasoning. The execution layer cannot be prompt-injected: even when prompt injection succeeds, Morphisec catches the execution.

AIUC-1 is notable for explicitly requiring execution-level safeguards: for example, pre-execution authorization checks on runtime tool calls, restrictions on unsafe tool calls, data-loss controls on what agents transmit, and logs of what AI systems actually did. Morphisec capabilities map directly to AIUC-1 controls spanning all six pillars, with nine controls, data access, unauthorized-action prevention, access-privilege enforcement, deployment-environment protection, unsafe tool-call restriction, third-party access monitoring, acceptable-use enforcement, activity logging, and misuse prevention. The strongest, most direct fit. In practice that means: discovering every agent before you restrict it, verifying tool calls at the point of execution, blocking unauthorized data egress through agent actions, hardening the environment agents run on, and producing execution-layer audit logs. A record of what actually executed, not just what the agent reported.

Yes. Morphisec AI Usage Control generates audit-ready evidence. A complete AI inventory, policy enforcement records, and usage events, mapped to the EU AI Act, NIST AI RMF, ISO 42001, and SOC 2. These are the same frameworks AIUC-1 itself operationalizes, so the evidence supports your compliance program whether or not your vendors pursue certification.

No. It completes them. Prompt-layer guardrails and filters remain valuable, and your EDR remains essential; Morphisec runs alongside tools like Microsoft Defender, CrowdStrike, and SentinelOne and amplifies them. The difference is the layer: prompt-layer tools validate what a model says, and EDR watches processes generically. Morphisec adds AI-aware enforcement at the execution point, defense in depth for the one layer that can’t be talked out of its policy.