Asgard AI & ISO 42001
ISO/IEC 42001 is the management-system standard for artificial intelligence. It asks organisations to govern how AI is used — with oversight, access control, logging and security built into operations. Asgard AI provides those controls at run time, enforced on every agent action and captured as evidence.
Why run-time controls matter
A policy document says what should happen. ISO 42001 expects you to show it actually happens. When AI agents can call real tools and data, the controls have to live where the action occurs — at the moment an agent makes a request. That's exactly where Asgard AI sits.
How Asgard AI maps to what the standard expects
| Control theme | How Asgard AI enforces it |
|---|---|
| Access control & least privilege | Each agent acts via a scoped Passport; grants limit it to named operations and parameters. "No new access" — an agent can only reach what its identity already can. |
| Human oversight | Human-in-the-loop approvals on sensitive actions; risky operations (send, delete, invite) can be blocked so a person stays in the loop. |
| Logging & traceability | Every agent action is written to an immutable audit trail — agent, operation, resource, time and outcome — exportable for review. |
| Security of AI systems | Credentials stay vaulted and never reach the agent; DLP redaction and prompt-injection scanning protect data in and out. |
| Incident response | One-click kill-switch revokes an agent or the whole tenant; misbehaving agents auto-quarantine on a denial burst. |
| Monitoring & review | A live view of what every agent is doing, with alerts on out-of-policy behaviour, supports regular management review. |
Asgard AI is a control that helps you operate AI responsibly; it supports your ISO 42001 programme but does not by itself certify your organisation. Certification is assessed by an accredited body against your full management system.
Evidence you can hand an auditor
- A per-agent record of what it was permitted to do and what it actually did.
- Audit logs showing access was scoped, filtered and attributable.
- Demonstrable kill-switch and quarantine behaviour from controlled tests.