Trust & Governance
The posture behind every Citadel engagement, where agents run, how they authenticate and are authorized, how autonomy is bounded, and what happens to your data at exit. Written to be forwarded to your security team.
Citadel Cloud Management secures agent-led delivery with six controls applied to every agent and every engagement. Agents run in or adjacent to the client tenancy, grounded in client corpora that are tenancy-isolated per engagement and, where a corpus is privileged, isolated per legal domain. Every agent is a first-class principal with its own attested workload identity through SPIFFE and SPIRE rather than a shared service account, and credentials are broker-issued, ephemeral, and purpose-bound through OAuth token exchange under RFC 8693. A policy decision point running OPA or Cedar evaluates every call against policy, not only the login. Autonomy is set per agent and per action across three tiers, so anything touching money, people, or legal is draft-only behind named approvers with four-eyes enforcement. Every action is logged and attributable, and writes are designed to be reversible. Citadel designs and delivers against SOC 2, ISO 27001, HIPAA, FedRAMP, and CMMC control frameworks and does not represent itself as holding those certifications.
Six controls that apply to every agent and every engagement. The same governance model the SIAS catalog is built on.
Agents run in or adjacent to your tenancy, grounded in your corpora: runbooks, ADRs, policies, catalogs. Corpora are tenancy-isolated per engagement, and privileged corpora are isolated per legal domain so one workstream cannot read another.
Every agent is a first-class principal with its own identity, not a shared service account. Workload identity is attested (SPIFFE/SPIRE), credentials are broker-issued and ephemeral, and there are no static long-lived keys sitting in a config file.
Access is purpose-bound and checked on every call. Tokens are minted through OAuth token-exchange (RFC 8693) for the specific task, and a policy decision point (OPA / Cedar) evaluates each action against policy before it runs, not just at login.
Autonomy is set per agent, per action across three tiers. Read-and-report work runs unattended (T1); writes to systems of record happen within scoped credentials and change windows (T2); anything touching money, people, or legal is draft-only behind named approvers with four-eyes enforcement (T3).
Every action is logged and attributable to a specific agent identity. Writes are designed to be reversible, so a review can answer who did what, under which authorization, and how to undo it. The evidence trail a security team needs after the fact.
Your corpora and systems of record stay yours. When an engagement ends, grounding data and issued credentials are decommissioned and access is revoked. Specific retention windows and deletion timelines are confirmed in the engagement agreement; the services Citadel itself routes data through are listed below.
Citadel designs and delivers against SOC 2, ISO 27001, HIPAA, FedRAMP, and CMMC control frameworks, and advises teams pursuing them. We do not present ourselves as holding those certifications. Where an engagement requires a certified posture, we deliver against the controls and support your own audit. No framework wordmark on this site is a claim that Citadel is certified in it.
The mapping we use when a client asks where agent governance sits in their own programme. It describes how Citadel designs and delivers. It is not a certification, an audit result, or an independent assessment, and Citadel holds neither framework.
NIST AI RMF: Govern. Accountability and roles are assigned before a system operates.
ISO/IEC 42001: Internal organisation, roles and responsibilities, and the AI system life cycle.
NIST AI RMF: Map. The impact of each action is characterised before the action is permitted.
ISO/IEC 42001: AI system impact assessment, and the documented conditions for use of an AI system.
NIST AI RMF: Manage. Risk is treated at the point of action, not accepted once at onboarding.
ISO/IEC 42001: Operational controls across the AI system life cycle, and controls on data used by AI systems.
NIST AI RMF: Measure. The system is instrumented so behaviour can be examined after the fact.
ISO/IEC 42001: Performance evaluation, event logging, and the evidence needed for AI system verification.
NIST AI RMF: Govern. Third-party and data-handling risk is managed across the life of the engagement.
ISO/IEC 42001: Third-party and customer relationships, and data management for AI systems.
Every third party this website and Citadel’s own pipeline route data through, with the purpose and the data category for each. Engagement-specific subprocessors. Anything your own stack introduces. Are named in the engagement agreement rather than here.
Purpose: Hosting and compute for citadelcloudmanagement.com.
Data: Everything the site serves, plus ordinary web request metadata (IP address, user agent).
Purpose: Delivers the contact, newsletter, and lead-magnet form submissions, and stores newsletter subscribers as an audience.
Data: Name, email address, company, and the message text you type into a form.
Purpose: Schedules discovery calls. The schedule is embedded as a lazy iframe on /book-a-call, with a plain outbound link kept as a fallback.
Data: Name, email address, and whatever you enter in the booking form.
Purpose: Traffic and content analytics. Consent-gated, analytics and ad storage are denied until you accept, with IP anonymisation on.
Data: Pseudonymous page and event data, anonymised IP address.
Purpose: Serves the web fonts the site is typeset in.
Data: IP address and user agent at the moment the font is fetched.
Purpose: Model access for Citadel’s own internal content and outbound-marketing pipeline. It is not in the path of website form submissions, and not in the path of client engagement corpora.
Data: Citadel’s marketing and content data. Engagement corpora are governed separately, by the controls above.
The governance model above is written up in full in The Enterprise AI Agent Blueprint: agent identity, autonomy tiers, scoped credentials, the audit trail, and a phased rollout sequence. Download it and circulate it. If your process runs on a questionnaire. SIG, CAIQ, or your own spreadsheet. Send it over and we will complete it against the controls on this page.
The questions a security team asks before a signature. Send anything not covered here and we will answer it directly.
Agents run in or adjacent to your tenancy and are grounded in your corpora. Your data stays under your control; Citadel operates against it within the scope and credentials you grant, and corpora are tenancy-isolated per engagement.
Yes. Corpora and agent identities are isolated per engagement, and privileged corpora are isolated per legal domain. One workstream or client context cannot read another.
Each agent is its own principal with attested workload identity (SPIFFE/SPIRE). Credentials are broker-issued, ephemeral, and purpose-bound through OAuth token-exchange (RFC 8693). There are no static, long-lived keys.
Two things. Authorization is checked on every action by a policy decision point (OPA / Cedar), not just at login. And autonomy is tiered: anything touching money, people, or legal is draft-only behind named human approvers (T3), with full four-eyes enforcement.
Writes happen only at T2/T3 within scoped credentials, every action is logged and attributable, and writes are designed to be reversible. A mistake is traceable to a specific identity and authorization, and can be rolled back.
Citadel builds and delivers against SOC 2, ISO 27001, HIPAA, FedRAMP, and CMMC control frameworks, and advises clients pursuing them. Citadel does not represent itself as holding those certifications. Where your engagement requires a certified posture, we deliver against the framework and support your own audit.
Grounding data and issued credentials are decommissioned and access is revoked at exit. The exact retention, deletion, and destruction terms are set in the engagement agreement so your legal and security teams can review them up front.
Book a call to walk through the controls with a senior architect, or email info@citadelcloudmanagement.com for RFPs and security questionnaires.