---
title: AIUC-1, AI Agent Compliance Coverage
description: How ZioSec evidence satisfies AIUC-1. Control-by-control mapping with coverage type, supporting evidence, and out-of-scope items.
url: https://ziosec.com/ai-compliance/aiuc-1
about: AIUC-1
authority: AI Underwriting Company
reference: AIUC-1 (Q1 2026)
---

# AIUC- 1

Standard 04 of 05. Certifiable, Agent-Native.

The first agent-specific certifiable standard. Updated quarterly. Audited by Schellman. Built around the threat model ZioSec was designed to address.

## At a glance

- **Released:** Mid-2025; quarterly updates
- **Auditor:** Schellman
- **Pillars:** Security, Safety, Reliability, Accountability, Data
- **Edge:** Insurance-aligned, agent-specific

## Control-level coverage

Where ZioSec evidence satisfies AIUC-1:

- **B.1 Third-party Adversarial Robustness Testing** (Full)
  - Obligation: Independent technical testing of adversarial resistance.
  - ZioSec capability: Independent Pentest
  - Coverage: ZioSec is structured as an independent third-party tester.
  - Evidence: Independent test report; Adversarial robustness score

- **B.2 Detect Adversarial Input** (Full)
  - Obligation: Real-time detection of inputs that attempt to manipulate agent behavior.
  - ZioSec capability: Detection Validation
  - Coverage: Pentest validates that deployed input filters actually catch what they claim.
  - Evidence: Filter bypass tests; Detection rate metrics

- **B.6 Prevent Unauthorized Agent Actions** (Full)
  - Obligation: Technical controls prevent agents from executing actions outside scope.
  - ZioSec capability: Action Boundary Testing
  - Coverage: Tests every authorized tool call boundary; produces enforceable policies.
  - Evidence: Authorization tests; Composed runtime policies

- **B.7 Enforce User Authentication for Agent Actions** (Full)
  - Obligation: User identity must be cryptographically bound to agent actions.
  - ZioSec capability: Identity Probing (Q1'26)
  - Coverage: Tests confused-deputy and identity propagation flaws.
  - Evidence: Identity flow tests; Confused-deputy reports

- **B.MCP MCP Security (Q2 2026 Emphasis)** (Full)
  - Obligation: Specific controls for MCP servers, tool integrations, and supply chain.
  - ZioSec capability: MCP-Aware Testing
  - Coverage: Native understanding of MCP architecture; probes tool descriptions and hijacking.
  - Evidence: MCP server pentest; Tool-poisoning tests

- **C.x Safety: Output Boundaries and Groundedness** (Partial)
  - Obligation: Controls for hallucinations, harmful outputs, and safety envelope.
  - ZioSec capability: Output Boundary Probing
  - Coverage: Adversarial generation of inputs designed to produce out-of-policy outputs.
  - Evidence: Output policy violations; Groundedness tests

- **D.x Reliability: Predictability Under Pressure** (Full)
  - Obligation: Agent behaves predictably even when targeted.
  - ZioSec capability: Stress Testing
  - Coverage: Continuous probing produces baseline behavior data; deviations become reliability metrics.
  - Evidence: Behavior baselines; Adversarial drift logs

- **E.x Accountability: Traceability of Agent Actions** (Full)
  - Obligation: Every consequential action is traceable.
  - ZioSec capability: Containerized Audit Trail
  - Coverage: Container-level event capture with correlation IDs across the decision chain.
  - Evidence: End-to-end action traces; Decision provenance

## Customer-owned (out of scope)

These obligations are part of AIUC-1 but pentest cannot satisfy them. They live with your governance, legal, and product teams.

- **A.x Organizational Governance & Management** (Out of Scope (customer-owned))
  - Obligation: Documented leadership accountability and policy framework.
  - ZioSec capability: Customer Governance Fills
  - Coverage: Pillar A is foundational organizational work, not testable via pentest.
  - Evidence: Owner: Leadership / GRC

- **F.legal Data Privacy: Legal Basis & Data Subject Rights** (Out of Scope (customer-owned))
  - Obligation: Lawful basis for processing, data subject rights, DPIAs.
  - ZioSec capability: Customer Governance Fills
  - Coverage: Legal basis and consent management owned by Privacy and Legal teams.
  - Evidence: Owner: Privacy / Legal

## Crosswalk available

Get the AIUC-1 crosswalk for certification.

We will map your agents to the five pillars, prepare the independent test report, and produce the evidence package.

What you receive:

- Five-pillar coverage map
- Independent test report
- Quarterly update tracker
- MCP security audit
- Identity flow assessment
- Insurance briefing pack

Email info@ziosec.com (subject: AIUC-1 Crosswalk) or open the cross-framework matrix at https://ziosec.com/ai-compliance/matrix.