From the State Government edition of October 17, 2026
Oklahoma's statewide standard for AI agents sets six autonomy levels, a CIO-run registry for agents that act, named owners, quarterly reviews and mandatory suspension when monitoring lapses
Oklahoma Office of Management and Enterprise Services, Information Services (state CIO Dan Cronin) · State enterprise IT governance and procurement for agentic AI · Oklahoma
- Publisher
- Oklahoma OMES
- Original publication
- 2026-07-30
- Source retrieved
- 2026-10-18
- Event date
- 2026-07-30
What happened
Oklahoma's standard supplements its general AI standard because, it says, agents need continuous oversight of decisions and actions rather than point-in-time approval. The CIO classifies every agent before deployment on a 0-5 scale (observe, recommend, prepare, execute, orchestrate, delegate) based on configured capabilities, not supplier descriptions. Levels 0-2 need agency business-owner sign-off (plus the technical owner at level 2); levels 3-5 also need agency executive leadership and the CIO, documented threat modeling against the OWASP Top 10 for Agentic Applications and MITRE ATLAS, a statewide registry entry, continuous monitoring with automated anomaly detection, and automatic suspension on defined triggers. Approval covers only the documented purpose, autonomy, data, tools and action space; material changes need re-approval. Business, technical and executive owners are mandatory for every agent. Agents may not finalize benefits, permits, payments, hiring or procurement decisions, represent themselves as human, or create other agents without approval. Logs must be tamper-evident, and for benefits, payments or official records detailed enough for an independent third party to replay each consequential action. Agents are reviewed quarterly.
Why it matters
Why now: Virginia's JLARC report (Oct 13, archived) found VITA's AI standards 'do not refer to agents' or safeguards for autonomous tools, Utah's EO 2026-08 (Oct 6, archived) orders safeguards against rogue AI agents without yet defining them, and 64% of state CIOs in NASCIO's 2026 survey (archived) expect agentic AI to be most impactful. Oklahoma's July standard, not previously archived, is a working example of the controls those states have not written: autonomy tiers, registry, named owners and procurement terms.
Evidence and measured results
Opened the 12-page PDF on oklahoma.gov over HTTPS and read it in full, including definitions, the autonomy table, accountability roles, registry, delegation, prompt-injection, data, logging, monitoring, prohibited uses, incident, quarterly review and procurement sections. The revision block states effective date, last revised and last reviewed as 07/30/2026, annual review cycle, approved by CIO Dan Cronin. For the why-now context, reopened Virginia JLARC Report 621 and confirmed its statement that VITA standards do not address agents.
Limitations and uncertainty
This is a written standard, not evidence of outcomes; no registry entries, agent counts, incidents or compliance results are published. It dates from July 30, 2026, before recent runs; it is included because current events made it newly relevant (stated above). The document contains duplicated sections (two accountability passages) and some rough drafting, suggesting it may be revised. Whether agencies have the monitoring tooling to meet the continuous-monitoring requirement is not stated.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-10-17; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- Agencies want to deploy agents that take actions in state systems but lack a defined way to classify autonomy, assign owners, and prove monitoring and suspension controls.
- Stakeholders
- State CIO and CISO
- Agency business owner
- Agency technical owner
- Agency executive leadership
- Data owner
- State procurement office
- Discovery questions
- Which planned agents would write records, route cases or send messages without per-action approval?
- Who would serve as business, technical and executive owner for each agent?
- Can your agent platforms export tamper-evident logs and support automatic suspension?
- How will monitoring be staffed so agents are not suspended for monitoring lapses?
- Value hypothesis
- Classifying agents and aligning platforms to a published standard before deployment may reduce rework and audit findings; benefits are not measured in the source.
- Potential engagement
- Four-to-six-week agent-readiness assessment: inventory and classify planned agents on a 0-5 autonomy scale, map platform capabilities to registry, logging and suspension requirements, and draft contract clauses for counsel review.
- Unsupported claims
- That Oklahoma agencies have deployed or registered any agents
- Productivity or cost savings from agents
- That any vendor platform meets the standard
- That the standard prevents incidents
Pre-sales engineering
Role takeaway
- Fit
- Agents at autonomy level 3 or higher that update records, route cases, schedule, or orchestrate across systems in state environments.
- Architecture and integration
- Agent identity bound to the state directory; per-agent scoped credentials matching the approved action space; policy enforcement on external calls; append-only logs with hash chaining in a store the agent cannot write; telemetry to state monitoring with anomaly detection; automatic suspension triggers; partitioned agent memory with integrity checks.
- Prerequisites
- Statewide agent registry and intake process
- Identity and access management that supports non-human identities
- Central log store and SIEM integration
- Documented action spaces and data classifications per agent
- Constraints
- Applies to Oklahoma executive agencies under OMES authority
- Level 3+ deployment blocked without registry entry and continuous monitoring
- Material changes require re-approval
- Legally significant decisions cannot be finalized by agents
- Security
- Treat external content as untrusted data, document prompt-injection safeguards, monitor for hijacking, exfiltration and goal drift, fail safe on undefined conditions, and threat-model level 3+ agents against OWASP agentic risks and MITRE ATLAS.
- Proof of value
- Replay one consequential action end to end from logs alone
- Inject a malicious instruction in a document and confirm the agent does not act on it
- Trigger a defined anomaly and confirm automatic suspension
- Confirm the agent cannot modify its own logs
Delivery
Role takeaway
- Work
- Stand up the agent lifecycle: classification intake, threat modeling for level 3+, registry entries, owner assignments, monitoring and intervention runbooks, and quarterly review templates.
- Dependencies
- CIO classification capacity
- Monitoring tooling with real-time alerting
- Vendor contract terms for telemetry and log export
- Agency staff named to oversight roles
- Ownership
- The sponsoring agency's business owner, with technical and executive owners; the CIO approves but does not assume responsibility.
- Skills and adoption
- Train agent sponsors and monitoring owners on autonomy levels, prohibited uses, incident reporting and how to pause or revoke an agent; training should precede deployment because violations can lead to discipline.
- Governance checkpoints
- CIO autonomy classification before deployment
- Registry entry before any level 3+ go-live
- Re-approval on material change
- Quarterly review of need, scope, access, accuracy and drift
- Acceptance criteria
- Proposed: 100% of level 3+ agents registered before go-live
- Proposed: registry updates within five business days of change
- Proposed: suspension path tested before go-live and each quarter
- Proposed: each consequential action reconstructable from logs by an independent reviewer
- Risks
- Monitoring outages forcing agent suspension
- Oversight staffing cost not budgeted
- Vendor platforms lacking required controls
- Standard revisions changing requirements mid-project
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Agent platforms must expose telemetry to the state, enforce deterministic action boundaries and policy on external calls, support escalation-to-human paths and automatic suspension, provide standards-based agent identity, partition and integrity-protect agent memory, and export logs and configurations. Logs must be append-only and stored where the agent cannot modify them, with hash chaining where feasible.
Governance
Who approves, reviews and stays accountable for outcomes?
The standard keeps accountability with the sponsoring agency: CIO review and vendor certification do not transfer responsibility. Seven roles are defined (business, technical, executive, data, monitoring, approver, intervention), with the first three mandatory. Undocumented agent-to-agent delegation is prohibited. Violations can lead to employee discipline.
Security and privacy
What data, permissions and controls need testing?
Requires treating untrusted content as data, not instructions, documenting prompt-injection safeguards, monitoring for hijacking, exfiltration and goal drift, fail-safe stops on undefined conditions, and data minimization for PII, PHI, FTI, CJI and similar data. Level 3+ agents need threat models citing OWASP and MITRE ATLAS; the CIO or CISO may require red-team testing.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Each agent needs named people for monitoring and intervention, and quarterly reviews; agencies must budget staff time for this oversight. Employees can face discipline for violations, which raises the need for training before agents are deployed.
Procurement
What should contracts, pricing and exit terms secure?
Contracts must disclose autonomy level, model providers, third-party agent components, tool and API integrations, data residency, memory and logging, identity controls, human approval mechanisms, audit features, pause and revoke ability, and supplier incident and audit duties. Hosting platforms must provide telemetry, suspension and log export as a condition of purchase.
Operating model
Which teams own the service once it runs?
Oversight shifts from a one-time approval to a lifecycle: classify, register, monitor continuously, review quarterly, and re-approve on material change, with a five-business-day duty to update the registry.
Publication history
- 2026-10-17State Government · Issue 403 resources
Stable resource ID: oklahoma-omes-ai-agents-agentic-systems-standard-autonomy-registry-20260730