AI Runtime Governance
Menu
Evidence · provenance

The research lineage behind 5D

5D began as a deterministic safety boundary for a sovereign agentic system, then developed into five inspectable action-risk dimensions informed by security research and governance frameworks.

Evidence strength Author analysis Evidence form Framework mapping Version 1.0.0 Author Loren Angoni · 5D developer and product owner Dates Created 2026-10-05 · Updated 2026-10-05 · Verified 2026-10-05

Scope

A first-person project-origin account and a source map showing how recurring security and governance concerns support each DTREA dimension.

01 · Useful autonomy

An agent proposes consequential actions

Greater tool access made the execution boundary—not just the model response—the critical control point.

02 · Deterministic boundary

Policy moves before the side effect

A small evaluator made the same declared action and policy produce the same inspectable result.

03 · Five action questions

DTREA makes the reason visible

Data, tool power, reversibility, external impact, and autonomy context became five separately inspectable dimensions.

04 · Research map

External sources anchor the limits

Security and governance sources inform the questions without certifying or defining the 5D composition.

It started as an autonomy-versus-security problem

5D started while I was building my own sovereign agentic system: an agent that could research online, interact with other agents and internet sources, and independently take useful actions for me. The more authority I considered giving it, the more concrete the threat model became. Retrieved content could carry prompt injection. A compromised or misled model could invoke privileged commands, move sensitive information, or trigger an irreversible external effect.

The question was not simply whether the agent was capable of completing a task. It was how much the agent should be allowed to do on its own, and when the proposed action became too risky to execute without policy or human review. I needed an enforcement boundary that remained outside the model and under the operator's control.

From a lightweight evaluator to a policy gate

The first version was a small deterministic evaluator placed before execution. For the same normalized action, policy, configuration, code version, and relevant state, it produced the same action-risk result. That made the decision inspectable and testable in a way that another probabilistic prompt could not.

At the time, I could not find an open-source per-action gate that matched the boundary and sovereignty requirements I needed, so I kept developing the approach. The useful pattern was not determinism instead of probabilistic AI. It was a composition: the agent could interpret and propose, while deterministic policy retained execution authority and unresolved cases could remain held for review.

Research lineage

The five dimensions emerged from a practical question: what makes an AI agent action dangerous at the instant before execution? Work on sensitive-data exposure, excessive tool authority, irreversible change, external consequence, and unattended autonomy repeatedly returned the same five pressures.

OWASP's agentic-security work supplies concrete failure and attack patterns. NIST AI RMF supplies lifecycle and impact discipline. The EU AI Act supplies oversight, traceability, and foreseeable-risk context. MITRE ATLAS supplies adversarial scenarios for testing. DTREA turns that wider research landscape into five inspectable action-level questions. The composition is 5D's synthesis, not a score defined or endorsed by any external framework.

Claim register

What this page says, and how far it goes.

Author analysis

Data Sensitivity

Inspects how the proposed action can read, expose, move, transform, or retain information whose sensitivity changes the consequence of execution.

Framework mapping · Evidence: owasp-sensitive-disclosure, nist-ai-rmf, eu-ai-act

Limit: The sources support examining data exposure and impact; they do not define 5D's scale or score.

Author analysis

Tool Privilege

Inspects the effective functionality, permissions, credentials, and reach of the tool selected for the action.

Framework mapping · Evidence: owasp-agentic, owasp-excessive-agency

Limit: This supports least-privilege evaluation before execution; it is not an OWASP certification or implementation guarantee.

Author analysis

Reversibility

Distinguishes recoverable local operations from transfers, deletions, messages, and other effects that are costly or impossible to undo.

Framework mapping · Evidence: fivedrisk-origin, nist-ai-rmf, eu-ai-act

Limit: Reversibility is a 5D design synthesis. The cited frameworks support intervention and consequence management but do not publish it as a DTREA dimension.

Author analysis

External Impact

Inspects potential effects on people, rights, money, infrastructure, or systems beyond the agent's immediate process boundary.

Framework mapping · Evidence: nist-ai-rmf, eu-ai-act, mitre-atlas

Limit: These sources provide impact and adversarial anchors; one action score does not establish compliance or system safety.

Author analysis

Autonomy Context

Inspects how far the proposed action is from current human direction, review, and control at the moment of execution.

Framework mapping · Evidence: owasp-excessive-agency, nist-ai-rmf, eu-ai-act

Limit: This supports policy sensitivity to operating context; it is not a universal autonomy scale or calibrated probability.

Limits

What this record does not establish.

Sources

Versioned references.

Markdown mirrorEvidence manifest ↗
What this page represents

The evidence and demonstrations shown here do not run a live engine, reviewer service, executor, or backend, and do not establish a supported integration contract.