Canada agentic AI control mapping for federal deployments
Map bounded permissions, human checkpoints, external stop integration, action records, and customer-owned recovery before an AI agent changes a government system.
The Government of Canada guide is official guidance for federal departments and agencies. It is not legislation. This page is a bounded technical mapping, not legal advice, certification, endorsement, or a finding that a deployment satisfies the guide or any related policy instrument.
Practical federal guidance, not a universal Canadian compliance rule.
The official guidance for federal departments and agencies introduces bounded autonomy and recoverability, including narrow permissions, human checkpoints, external pause and disable mechanisms, safe failure, and action records outside the agent's control.
The guide tells departments to assess whether the Directive on Automated Decision-Making and other legal, privacy, security, human-rights, language-rights, and information-management obligations apply. HaltState does not make that assessment.
Two agent-focused principles
Bound autonomy before action, then design for recoverability.
The guide combines preventive technical constraints with accountable human oversight and an operational ability to intervene when an agent behaves unexpectedly.
Bounded autonomyLimit data, tools, permissions, and scope; label activity levels; designate accountable owners; and keep higher-impact authority narrow.
RecoverabilityMake agents easy to guide, pause, and stop; return affected systems to a safe state; preserve external action records; and plan for compromised tools or credentials.
Human checkpointsReview state-changing actions unless their impact is demonstrably low and trivially reversible, with reviewer capacity and escalation designed in advance.
External operational controlMaintain a pause and disable mechanism outside the agent, alongside a tested recovery plan for unintended actions.
Guidance-to-control crosswalk
Where reviewed HaltState controls support the design, and where the product stops.
Each row preserves the customer responsibility and limitation behind the mapped control. The recoverability row is explicitly a product gap rather than a claimed native capability.
Supports integration
Bounded permissions and agent attribution
Declare a proposed action and caller-supplied agent label before a customer-integrated worker performs a selected side effect.
The department owns the authoritative agent inventory, accountable roles, underlying data and tool permissions, read-only defaults, rate and data limits, plain-language permission labels, and removal of unguarded execution paths.
Verified limitation
The agent label is caller-supplied attribution, not cryptographic workload identity. Declaring an action to HaltState does not constrain the underlying tool credentials, data access, or permissions available to the agent.
Supports integration
Human checkpoints for state-changing actions
Return an active-policy decision, hold selected operations for human approval, and look up approval retries by a stable idempotency key.
The department owns checkpoint placement, reviewer authority and capacity, pending-work persistence, stable keys, attempt serialization, business-ledger idempotency, and enforcement of the returned decision before execution.
Verified limitation
On the Standard contract, expired-trial and policy-load paths can default to ALLOW and approval retry lookup is not the replay-safe contract. The replay-safe contract is implemented and canary verified but is not the default route; mixed compatibility/replay routing is not yet implemented.
Supports integration
External pause and disable
Provide a credentialed external signal that an integrated customer agent can poll outside its own reasoning loop.
The customer agent must poll and obey the external signal, renew it when needed, and operate a tested pause, disable, escalation, and recovery procedure.
Verified limitation
The stop signal expires after 3,600 seconds, heartbeat backend failure returns OK, and HaltState does not force termination, revoke tool credentials, or return the customer system to a safe state.
Verified product gap
Recoverability, safe-state return, and external action records
Demonstrate selected no-execution error handling, receive Standard contract execution reports, and create generation-labelled Proof Pack evidence that can support a customer-owned recovery and recordkeeping design.
The department owns customer-side rollback, safe-state recovery, corrective workflows, immutable external logging, privacy and records controls, lifecycle testing, reconciliation, retention, and incident recovery exercises.
Verified limitation
The demonstrated refund failure path is not a complete safe-state or rollback mechanism. Standard contract reporting is compatibility reporting. Signed Proof Pack evidence is database append-only but not externally anchored or absolutely immutable; the public local digest demo is not the authenticated verifier.
Verified product gap
HaltState is not a complete safe-state or rollback mechanism.
The live Standard contract supports selected pre-execution decisions, approval holds, an external stop signal, and compatibility reports. The replay-safe contract is implemented and canary verified, and signed Proof Pack evidence is available, but replay is not the default route for existing integrations. HaltState does not reverse completed side effects, revoke customer tool credentials, reconstruct application state, or force an agent process to terminate.
Customer-owned recovery must define rollback, correction, reconciliation, safe-state restoration, immutable external records, incident roles, and tested recovery timing for each protected system.
Reviewed control detail
Inspect the exact capability boundary behind each mapping.
These catalogue records are reused without broadening their enforcement point, evidence, capability status, customer responsibility, or limitation.
Treat the returned decision as authority, execute only an allowed or later-approved action, and monitor trial state and policy availability.
Control limitation
Expired trials bypass governance and return allowed with governance inactive. A policy-load failure returns an empty policy set, and no matching policy defaults to ALLOW. Customers must not treat this control as fail-closed.
Choose a collision-resistant stable key, serialize attempts per operation, persist a customer ledger, verify action and agent binding, and make target execution idempotent.
Control limitation
This Standard contract control is an approval retry lookup, not the replay-safe action contract. The replay-safe contract is implemented and canary verified but is not the default route, and mixed compatibility/replay routing is not yet implemented. Standard contract customers must still serialize attempts and prevent duplicate side effects.
Poll with tenant credentials, obey kill or pause status, and operate a tested pause, rollback, or recovery procedure appropriate to the protected system.
Control limitation
Kill-switch activation uses a 3,600-second (one-hour) TTL. The heartbeat protocol returns OK, PAUSE, or KILL, returns OK on backend-check failure, and gives unauthenticated compatibility polling only a status-only OK. The customer agent must poll and obey it; HaltState does not force termination, roll back completed actions, or return customer systems to a safe state.
Demonstrate no-execution handling for selected refund-worker failures
In the retail refund worker, avoid simulated execution after a guard transport or exception failure, an unrecognised guard status, or a Proof Pack exception before execution.
Implement and test explicit failure handling, policy availability checks, recovery, and execution idempotency in every customer-owned high-risk worker.
Control limitation
This is limited to the demonstrated retail refund worker transport, exception, unrecognised-status, and pre-execution evidence paths; it is not a universal fail-closed guarantee. It does not cover expired-trial governance bypass or policy-load empty/default-ALLOW paths. Guard-call exceptions mark ERROR; a Proof Pack exception stops before execution but can leave the row ALLOWED and requires operator recovery.
Accept an authenticated Standard contract guard report, attempt to update a matching approval context, write an action-log entry, and emit a runtime event.
Report the final execution result accurately, retain the operation-to-report binding in the customer ledger, and verify durable receipt when that matters.
Control limitation
The Standard contract report remains compatibility reporting rather than a replay-safe durable receipt. Replay-safe outcome receipts are implemented and canary verified on the replay contract, which is not the default route for existing integrations.
The current signed Proof Pack integrity path uses a full-content digest, Ed25519 signature, tenant-scoped verification, hash-chain validation, and database append-only controls.
Enforcement point
After the governed workflow has a final decision and before the demonstrated refund execution is recorded.
Supply accurate redacted evidence, use authenticated tenant-scoped verification, inspect the assurance reported for each stored record, and retain records according to policy.
Control limitation
Signed verification applies only when the stored record reports the current integrity metadata. Current assurance does not claim HSM/KMS custody, external anchoring, immunity from database superusers, absolute immutability, or legal certification.
Public evidence and implementation detail
Inspect a governed business action and the integration contract.
Turn the guide into an owned deployment control plan.
Inventory agents and authority.Name each agent, owner, purpose, data source, tool, permission level, delegated action, and prohibited action.
Start read-only.Keep view and draft permissions separate from send, publish, approve, spend, and record-update authority.
Place human checkpoints.Define which state changes require review, who can decide, how queues are resourced, and what happens on timeout or absence.
Engineer stop and recovery.Test polling, pause, disable, credential revocation, rollback, correction, reconciliation, and safe-state restoration.
Keep external records.Record tools, actions, approvals, outcomes, interventions, and required context in a protected system outside the agent's control.
Reassess throughout the lifecycle.Review drift, errors, access changes, scope changes, incidents, owner transitions, and retirement controls.
Responsibility boundary
HaltState can support selected checkpoints; the department owns the complete operating model.
Agent identity is caller-supplied attribution under tenant authentication, not cryptographic workload identity or proof of an accountable human owner.
The guard does not constrain the underlying tool credentials, data access, rate limits, or permissions available to the agent.
On the Standard contract, expired trials, policy-load failure, and no-match behavior include paths that can default to ALLOW.
The Standard contract approval retry lookup is distinct from the canary-verified replay-safe action contract, which is not the default route.
The customer agent must poll and obey the external signal; HaltState does not force termination or revoke customer credentials.
Standard contract outcome reporting is compatibility reporting. Signed Proof Pack evidence is database append-only but not an immutable external log or complete recordkeeping system.
Deployment review
Canada Agentic AI Control Mapping
Map one federal-agent workflow across authority, pre-execution decisions, human checkpoints, stop integration, external records, recovery ownership, and verified product gaps.
Official Government of Canada guide and policy directory
Last verified 27 July 2026. The current source record links the live official French guide text and the English Government of Canada directory that lists the guide. Reconfirm official pages before legal, policy, or deployment decisions.