Agentic framework 2.3.1: add controls for planning, reasoning, tools, protocols and multi-agent interaction; prefer structural, rule-based controls enforced at system level (for example access controls at the tool layer, workflows built into orchestration) over prompt-layer safeguards, keeping model-based safeguards for hard-to-define risks such as harmful content; add runtime controls such as rate limits and input validation; sample controls include plan reflection and logging, strict tool input formats, least-privilege tools, no write access to sensitive tables unless needed, user takeover for secrets, standardised protocols (including agentic commerce), whitelisted and sandboxed MCP servers, typed messages between agents and limited shared memory, and using MCP as a governance layer.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.