{"resourceId":"oklahoma-omes-ai-agents-agentic-systems-standard-autonomy-registry-20260730","versions":[{"version":"external-01aba9bc67307aef39eae00ab2ce0bd3ae0f0819e5d80046e0aab0fa2c9e842f","resource":{"id":"oklahoma-omes-ai-agents-agentic-systems-standard-autonomy-registry-20260730","title":"Oklahoma's statewide standard for AI agents sets six autonomy levels, a CIO-run registry for agents that act, named owners, quarterly reviews and mandatory suspension when monitoring lapses","organization":"Oklahoma Office of Management and Enterprise Services, Information Services (state CIO Dan Cronin)","sector":"State enterprise IT governance and procurement for agentic AI","geography":"Oklahoma","publishedAt":"2026-07-30","publicationDate":"2026-07-30","eventDate":"2026-07-30","sourceName":"Oklahoma OMES","sourceLabel":"Oklahoma OMES, 'Use of AI Agents and Agentic Systems Standard', effective and last revised July 30, 2026, approved by CIO Dan Cronin","sourceUrl":"https://oklahoma.gov/content/dam/ok/en/omes/documents/ai-agent-agentic-systems-std-UA.pdf","evidenceClass":"standards-guidance","outcomeClass":"emerging","topics":["developers-agents","governance-procurement","data-security"],"finding":"Oklahoma's standard supplements its general AI standard because, it says, agents need continuous oversight of decisions and actions rather than point-in-time approval. The CIO classifies every agent before deployment on a 0-5 scale (observe, recommend, prepare, execute, orchestrate, delegate) based on configured capabilities, not supplier descriptions. Levels 0-2 need agency business-owner sign-off (plus the technical owner at level 2); levels 3-5 also need agency executive leadership and the CIO, documented threat modeling against the OWASP Top 10 for Agentic Applications and MITRE ATLAS, a statewide registry entry, continuous monitoring with automated anomaly detection, and automatic suspension on defined triggers. Approval covers only the documented purpose, autonomy, data, tools and action space; material changes need re-approval. Business, technical and executive owners are mandatory for every agent. Agents may not finalize benefits, permits, payments, hiring or procurement decisions, represent themselves as human, or create other agents without approval. Logs must be tamper-evident, and for benefits, payments or official records detailed enough for an independent third party to replay each consequential action. Agents are reviewed quarterly.","sledRelevance":"Why now: Virginia's JLARC report (Oct 13, archived) found VITA's AI standards 'do not refer to agents' or safeguards for autonomous tools, Utah's EO 2026-08 (Oct 6, archived) orders safeguards against rogue AI agents without yet defining them, and 64% of state CIOs in NASCIO's 2026 survey (archived) expect agentic AI to be most impactful. Oklahoma's July standard, not previously archived, is a working example of the controls those states have not written: autonomy tiers, registry, named owners and procurement terms.","evidence":"Opened the 12-page PDF on oklahoma.gov over HTTPS and read it in full, including definitions, the autonomy table, accountability roles, registry, delegation, prompt-injection, data, logging, monitoring, prohibited uses, incident, quarterly review and procurement sections. The revision block states effective date, last revised and last reviewed as 07/30/2026, annual review cycle, approved by CIO Dan Cronin. For the why-now context, reopened Virginia JLARC Report 621 and confirmed its statement that VITA standards do not address agents.","architectureImplications":"Agent platforms must expose telemetry to the state, enforce deterministic action boundaries and policy on external calls, support escalation-to-human paths and automatic suspension, provide standards-based agent identity, partition and integrity-protect agent memory, and export logs and configurations. Logs must be append-only and stored where the agent cannot modify them, with hash chaining where feasible.","governanceImplications":"The standard keeps accountability with the sponsoring agency: CIO review and vendor certification do not transfer responsibility. Seven roles are defined (business, technical, executive, data, monitoring, approver, intervention), with the first three mandatory. Undocumented agent-to-agent delegation is prohibited. Violations can lead to employee discipline.","securityPrivacyImplications":"Requires treating untrusted content as data, not instructions, documenting prompt-injection safeguards, monitoring for hijacking, exfiltration and goal drift, fail-safe stops on undefined conditions, and data minimization for PII, PHI, FTI, CJI and similar data. Level 3+ agents need threat models citing OWASP and MITRE ATLAS; the CIO or CISO may require red-team testing.","caveats":"This is a written standard, not evidence of outcomes; no registry entries, agent counts, incidents or compliance results are published. It dates from July 30, 2026, before recent runs; it is included because current events made it newly relevant (stated above). The document contains duplicated sections (two accountability passages) and some rough drafting, suggesting it may be revised. Whether agencies have the monitoring tooling to meet the continuous-monitoring requirement is not stated.","streamIds":["state-government"],"roles":{"sales":"Interpretation: the opening is agent readiness, not agent sales. States like Virginia and Utah now have documented gaps in agent controls, and Oklahoma shows what a finished standard demands of buyers and vendors. A credible conversation starts with classifying planned agents by autonomy and checking whether platforms can meet registry, logging and suspension terms. Offer a bounded gap assessment against a published standard. Do not claim compliance guarantees or productivity gains; the standard reports no outcomes and no agent inventory.","engineering":"Interpretation: fit is any state agent that writes records, routes cases or sends messages, which Oklahoma classes as level 3 or higher. Integration means agent identity in the state directory, scoped tool permissions that match the approved action space, tamper-evident logs stored outside the agent's reach, telemetry to state monitoring, and automatic suspension hooks. Proof of value should test prompt-injection resistance, replay of a consequential action from logs alone, and suspension on a defined trigger. Many commercial agent platforms may not yet expose all required controls.","delivery":"Interpretation: delivery work is the lifecycle the standard defines: autonomy classification, threat models for level 3+, registry entries, owner assignments, monitoring runbooks and quarterly reviews. Ownership stays with the sponsoring agency, not the CIO or vendor. Acceptance criteria should be proposed and measurable, such as every level 3+ agent registered before go-live and a tested suspension path. Risks include monitoring gaps forcing suspension, staffing for seven oversight roles, and a standard likely to be revised."},"roleDetails":{"sales":{"customerProblem":"Agencies want to deploy agents that take actions in state systems but lack a defined way to classify autonomy, assign owners, and prove monitoring and suspension controls.","stakeholders":["State CIO and CISO","Agency business owner","Agency technical owner","Agency executive leadership","Data owner","State procurement office"],"discoveryQuestions":["Which planned agents would write records, route cases or send messages without per-action approval?","Who would serve as business, technical and executive owner for each agent?","Can your agent platforms export tamper-evident logs and support automatic suspension?","How will monitoring be staffed so agents are not suspended for monitoring lapses?"],"valueHypothesis":"Classifying agents and aligning platforms to a published standard before deployment may reduce rework and audit findings; benefits are not measured in the source.","potentialEngagement":"Four-to-six-week agent-readiness assessment: inventory and classify planned agents on a 0-5 autonomy scale, map platform capabilities to registry, logging and suspension requirements, and draft contract clauses for counsel review.","unsupportedClaims":["That Oklahoma agencies have deployed or registered any agents","Productivity or cost savings from agents","That any vendor platform meets the standard","That the standard prevents incidents"]},"engineering":{"fit":"Agents at autonomy level 3 or higher that update records, route cases, schedule, or orchestrate across systems in state environments.","architectureIntegration":"Agent identity bound to the state directory; per-agent scoped credentials matching the approved action space; policy enforcement on external calls; append-only logs with hash chaining in a store the agent cannot write; telemetry to state monitoring with anomaly detection; automatic suspension triggers; partitioned agent memory with integrity checks.","prerequisites":["Statewide agent registry and intake process","Identity and access management that supports non-human identities","Central log store and SIEM integration","Documented action spaces and data classifications per agent"],"constraints":["Applies to Oklahoma executive agencies under OMES authority","Level 3+ deployment blocked without registry entry and continuous monitoring","Material changes require re-approval","Legally significant decisions cannot be finalized by agents"],"security":"Treat external content as untrusted data, document prompt-injection safeguards, monitor for hijacking, exfiltration and goal drift, fail safe on undefined conditions, and threat-model level 3+ agents against OWASP agentic risks and MITRE ATLAS.","proofOfValue":["Replay one consequential action end to end from logs alone","Inject a malicious instruction in a document and confirm the agent does not act on it","Trigger a defined anomaly and confirm automatic suspension","Confirm the agent cannot modify its own logs"]},"delivery":{"work":"Stand up the agent lifecycle: classification intake, threat modeling for level 3+, registry entries, owner assignments, monitoring and intervention runbooks, and quarterly review templates.","dependencies":["CIO classification capacity","Monitoring tooling with real-time alerting","Vendor contract terms for telemetry and log export","Agency staff named to oversight roles"],"ownership":"The sponsoring agency's business owner, with technical and executive owners; the CIO approves but does not assume responsibility.","skillsAdoption":"Train agent sponsors and monitoring owners on autonomy levels, prohibited uses, incident reporting and how to pause or revoke an agent; training should precede deployment because violations can lead to discipline.","governanceCheckpoints":["CIO autonomy classification before deployment","Registry entry before any level 3+ go-live","Re-approval on material change","Quarterly review of need, scope, access, accuracy and drift"],"acceptanceCriteria":["Proposed: 100% of level 3+ agents registered before go-live","Proposed: registry updates within five business days of change","Proposed: suspension path tested before go-live and each quarter","Proposed: each consequential action reconstructable from logs by an independent reviewer"],"risks":["Monitoring outages forcing agent suspension","Oversight staffing cost not budgeted","Vendor platforms lacking required controls","Standard revisions changing requirements mid-project"]}},"retrievedAt":"2026-10-17T22:22:22-05:00","enrichedAt":"2026-10-17T22:27:28-05:00","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Each agent needs named people for monitoring and intervention, and quarterly reviews; agencies must budget staff time for this oversight. Employees can face discipline for violations, which raises the need for training before agents are deployed.","procurementImplications":"Contracts must disclose autonomy level, model providers, third-party agent components, tool and API integrations, data residency, memory and logging, identity controls, human approval mechanisms, audit features, pause and revoke ability, and supplier incident and audit duties. Hosting platforms must provide telemetry, suspension and log export as a condition of purchase.","operatingModelImplications":"Oversight shifts from a one-time approval to a lifecycle: classify, register, monitor continuously, review quarterly, and re-approve on material change, with a five-business-day duty to update the registry.","sourceVerification":{"openedUrl":"https://oklahoma.gov/content/dam/ok/en/omes/documents/ai-agent-agentic-systems-std-UA.pdf","referenceExcerpt":"Without continuous monitoring in place the state agency shall suspend the AI Agent's operation until monitoring is implemented or reestablished.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}