AG-801
Capability-Threshold Gating and Responsible Scaling
EU AI Act
NIST AI RMF
ISO 42001
AGS Frontier Safety | Meta-Governance & Assurance | Version 2.2
Capability-Threshold Gating governs a pre-committed policy that ties an agent's permitted deployment, autonomy, and access to *evaluated capability thresholds*: as an agent demonstrates more dangerous capability, progressively stronger safeguards become mandatory, and deployment is blocked until they are in place.
This is the meta-governance control that consumes the outputs of the frontier-safety evaluations (AG-797 scheming, AG-798 sabotage, AG-799 corrigibility, AG-802 dangerous-capability) and converts them into binding deployment decisions through a documented, tiered scaling policy — the standard's analogue of frontier-lab "responsible scaling" / "preparedness" frameworks and the EU AI Act systemic-risk tiering.
In scope: the capability-tier classification scheme; the mapping from evaluated capability to required safeguards; the pre-commitment to block deployment when thresholds are crossed without the corresponding controls; re-evaluation triggers.
Out of scope: the individual evaluations that measure capability (AG-797/798/799/802/806-elicitation), and runtime enforcement of granted limits. This dimension governs *the gating policy and its application*.
Capability grows with model upgrades, fine-tuning, tool access, and scaffolding — often between formal reviews. Without a pre-committed mapping from capability to safeguards, organisations make ad-hoc, deadline-pressured deployment decisions and discover too late that an agent crossed a dangerous threshold. A capability-threshold policy makes the safety bar rise automatically with capability and removes discretion to ship past it, which is exactly the structure regulators expect for systemic-risk models.
Test 6.1: Threshold-Gated Deployment
Test 6.2: Re-Evaluation Trigger
Test 6.3: Conservative Default
| Score | Criteria |
|---|---|
| 0 | No capability-tier scheme; deployment decisions are ad hoc |
| 1 | A capability-tier scheme is documented but does not bindingly gate deployment |
| 2 | Thresholds gate deployment with pre-specified safeguards, enforced re-evaluation triggers, and conservative defaults |
| 3 | As level 2 plus sandbag-resistant inputs, automated change detection, non-discretionary threshold responses, and authority disclosure |
Scenario A — Silent Capability Jump: A base-model upgrade materially increases offensive-cyber capability, but no re-evaluation trigger fired, so the agent kept its prior autonomy tier without the safeguards that tier now requires.
Scenario B — Deadline Waiver: An evaluation places an agent above the autonomy threshold, but a manager grants a one-off waiver to meet a launch date. Because threshold crossings were discretionary, the safeguard gap shipped.
Scenario C — Optimistic Default: An agent with incomplete evaluation is deployed as "probably fine". It later exhibits a gated capability. A conservative default would have held it at the higher tier pending evaluation.
| Requirement | EU AI Act | NIST AI RMF | ISO 42001 |
|---|---|---|---|
| R1: Capability-tier scheme with thresholds | Art. 51 — Systemic-risk classification | GOVERN 1.3 — Risk-based activity levels | Clause 6.1 — Actions to address risk |
| R2: Tier-mapped required safeguards | Art. 55 — Risk mitigation | GOVERN 1.3 — Risk-based activity levels | Clause 6.1 — Actions to address risk |
| R3: Deployment blocked without safeguards | Art. 55 — Risk mitigation | MANAGE 1.3 — High-priority response | Clause 8.1 — Operational control |
| R4: Re-evaluation triggers | Art. 55 — Ongoing evaluation | MANAGE 4.1 — Post-deployment monitoring | Clause 9.1 — Monitoring and measurement |
| R5: Sandbag-resistant capability inputs | Art. 55 — Model evaluation | MEASURE 2.13 — TEVV effectiveness | Clause 8.3 — Verification |
| R6: Recorded, independently-reviewed decision | Art. 51 — Determination/notification | GOVERN 2.1 — Accountability | Clause 9.3 — Management review |
| R8: Non-discretionary threshold response | Art. 55 — Risk mitigation | MANAGE 1.3 — High-priority response | Clause 8.1 — Operational control |
| R9: Disclosure for systemic-risk models | Art. 51/52 — Notification | GOVERN 4.3 — Information sharing | — |
Articles 51–52 classify GPAI models with systemic risk (including by capability/compute thresholds) and require notification; Article 55 imposes heightened obligations once classified. AG-801 is the internal control that implements capability tiering and binds it to safeguards and deployment decisions.
GOVERN 1.3 sets risk-management activity levels by risk tolerance — a capability-tiered scaling policy is the concrete expression. MANAGE 1.3 requires planned responses to high-priority risk, which threshold crossings invoke.
Clause 6.1 (actions to address risks and opportunities) and Clause 8.1 (operational control) require risk-proportionate, controlled deployment — exactly what capability-threshold gating provides.