Canada agentic AI control mapping for federal deployments
Map bounded permissions, human checkpoints, external stop integration, action records, and customer-owned recovery before an AI agent changes a government system.
The Government of Canada guide is official guidance for federal departments and agencies. It is not legislation. This page is a bounded technical mapping, not legal advice, certification, endorsement, or a finding that a deployment satisfies the guide or any related policy instrument.
Practical federal guidance, not a universal Canadian compliance rule.
The official guidance for federal departments and agencies introduces bounded autonomy and recoverability, including narrow permissions, human checkpoints, external pause and disable mechanisms, safe failure, and action records outside the agent's control.
The guide tells departments to assess whether the Directive on Automated Decision-Making and other legal, privacy, security, human-rights, language-rights, and information-management obligations apply. HaltState does not make that assessment.
Two agent-focused principles
Bound autonomy before action, then design for recoverability.
The guide combines preventive technical constraints with accountable human oversight and an operational ability to intervene when an agent behaves unexpectedly.
Bounded autonomyLimit data, tools, permissions, and scope; label activity levels; designate accountable owners; and keep higher-impact authority narrow.
RecoverabilityMake agents easy to guide, pause, and stop; return affected systems to a safe state; preserve external action records; and plan for compromised tools or credentials.
Human checkpointsReview state-changing actions unless their impact is demonstrably low and trivially reversible, with reviewer capacity and escalation designed in advance.
External operational controlMaintain a pause and disable mechanism outside the agent, alongside a tested recovery plan for unintended actions.
Guidance-to-control crosswalk
Where reviewed HaltState controls support the design, and where the product stops.
Each row preserves the customer responsibility and limitation behind the mapped control. The recoverability row is explicitly a product gap rather than a claimed native capability.
Supports integration
Bounded permissions and agent attribution
Declare a proposed action and caller-supplied agent label before a customer-integrated worker performs a selected side effect.
The department owns the authoritative agent inventory, accountable roles, underlying data and tool permissions, read-only defaults, rate and data limits, plain-language permission labels, and removal of unguarded execution paths.
Verified limitation
The agent label is caller-supplied attribution, not cryptographic workload identity. Declaring an action to HaltState does not constrain the underlying tool credentials, data access, or permissions available to the agent.
Supports integration
Human checkpoints for state-changing actions
Return an active-policy decision, hold selected operations for human approval, and look up approval retries by a stable idempotency key.
The department owns checkpoint placement, reviewer authority and capacity, pending-work persistence, stable keys, attempt serialization, business-ledger idempotency, and enforcement of the returned decision before execution.
Verified limitation
Expired-trial and policy-load paths can default to ALLOW. The retry lookup is an approval retry lookup, not guaranteed replay protection; it is non-atomic and is not bound to action or agent.
Supports integration
External pause and disable
Provide a credentialed external signal that an integrated customer agent can poll outside its own reasoning loop.
The customer agent must poll and obey the external signal, renew it when needed, and operate a tested pause, disable, escalation, and recovery procedure.
Verified limitation
The stop signal expires after 3,600 seconds, heartbeat backend failure returns OK, and HaltState does not force termination, revoke tool credentials, or return the customer system to a safe state.
Verified product gap
Recoverability, safe-state return, and external action records
Demonstrate selected no-execution error handling, receive best-effort execution reports, and create hash-referenced refund evidence that can support a customer-owned recovery and recordkeeping design.
The department owns customer-side rollback, safe-state recovery, corrective workflows, immutable external logging, privacy and records controls, lifecycle testing, reconciliation, retention, and incident recovery exercises.
Verified limitation
The demonstrated refund failure path is not a complete safe-state or rollback mechanism. Reporting is best-effort, the evidence verifier does not recompute the embedded action-evidence hash, and the current evidence is not an immutable external log.
Verified product gap
HaltState is not a complete safe-state or rollback mechanism.
The current product can support selected pre-execution decisions, approval holds, an external stop signal, best-effort reports, and demonstrated refund evidence. It does not reverse completed side effects, revoke customer tool credentials, reconstruct application state, or force an agent process to terminate.
Customer-owned recovery must define rollback, correction, reconciliation, safe-state restoration, immutable external records, incident roles, and tested recovery timing for each protected system.
Reviewed control detail
Inspect the exact capability boundary behind each mapping.
These catalogue records are reused without broadening their enforcement point, evidence, capability status, customer responsibility, or limitation.
Treat the returned decision as authority, execute only an allowed or later-approved action, and monitor trial state and policy availability.
Control limitation
Expired trials bypass governance and return allowed with governance inactive. A policy-load failure returns an empty policy set, and no matching policy defaults to ALLOW. Customers must not treat this control as fail-closed.
Choose a collision-resistant stable key, serialize attempts per operation, persist a customer ledger, verify action and agent binding, and make target execution idempotent.
Control limitation
This is an approval retry lookup, not guaranteed replay protection. The database index is non-unique, lookup and insert are not atomic, and lookup is not bound to action or agent. Immediate ALLOW and DENY results are reevaluated; customers must serialize attempts and prevent duplicate side effects.
Poll with tenant credentials, obey kill or pause status, and operate a tested pause, rollback, or recovery procedure appropriate to the protected system.
Control limitation
Kill-switch activation uses a 3,600-second (one-hour) TTL. The heartbeat protocol returns OK, PAUSE, or KILL, returns OK on backend-check failure, and gives unauthenticated legacy polling only a status-only OK. The customer agent must poll and obey it; HaltState does not force termination, roll back completed actions, or return customer systems to a safe state.
Demonstrate no-execution handling for selected refund-worker failures
In the retail refund worker, avoid simulated execution after a guard transport or exception failure, an unrecognised guard status, or a Proof Pack exception before execution.
Implement and test explicit failure handling, policy availability checks, recovery, and execution idempotency in every customer-owned high-risk worker.
Control limitation
This is limited to the demonstrated retail refund worker transport, exception, unrecognised-status, and pre-execution evidence paths; it is not a universal fail-closed guarantee. It does not cover expired-trial governance bypass or policy-load empty/default-ALLOW paths. Guard-call exceptions mark ERROR; a Proof Pack exception stops before execution but can leave the row ALLOWED and requires operator recovery.
Report the final execution result accurately, retain the operation-to-report binding in the customer ledger, and verify durable receipt when that matters.
Control limitation
This is report receipt and best-effort recording, not proof that a guarded action was durably linked. Immediate ALLOW can have no approval row; the endpoint does not check whether its UPDATE matched a row; the idempotency key is not written to the action log; and event emission failures are ignored.
Hash a redacted refund evidence document before proof storage
The refund worker computes SHA-256 over the canonicalized redacted in-memory evidence document and stores that digest beside a logical haltstate:// artifact URI in a Proof Pack.
Enforcement point
After the governed workflow has a final decision and before the demonstrated refund execution is recorded.
Supply accurate redacted evidence, independently verify exported evidence when integrity assurance is required, and retain records according to policy.
Control limitation
The artifact URI is logical and the verifier does not recompute the embedded action-evidence hash. The live page demonstrates Proof Pack integration only, not evidence integrity. This is not a digital signature, external timestamp, immutable store, or legal certification.
Public evidence and implementation detail
Inspect a governed business action and the integration contract.
Turn the guide into an owned deployment control plan.
Inventory agents and authority.Name each agent, owner, purpose, data source, tool, permission level, delegated action, and prohibited action.
Start read-only.Keep view and draft permissions separate from send, publish, approve, spend, and record-update authority.
Place human checkpoints.Define which state changes require review, who can decide, how queues are resourced, and what happens on timeout or absence.
Engineer stop and recovery.Test polling, pause, disable, credential revocation, rollback, correction, reconciliation, and safe-state restoration.
Keep external records.Record tools, actions, approvals, outcomes, interventions, and required context in a protected system outside the agent's control.
Reassess throughout the lifecycle.Review drift, errors, access changes, scope changes, incidents, owner transitions, and retirement controls.
Responsibility boundary
HaltState can support selected checkpoints; the department owns the complete operating model.
Agent identity is caller-supplied attribution under tenant authentication, not cryptographic workload identity or proof of an accountable human owner.
The guard does not constrain the underlying tool credentials, data access, rate limits, or permissions available to the agent.
Expired trials, policy-load failure, and no-match behavior include paths that can default to ALLOW.
The approval retry lookup is an approval retry lookup, not guaranteed replay protection.
The customer agent must poll and obey the external signal; HaltState does not force termination or revoke customer credentials.
Outcome reporting is best-effort, and current refund evidence is not an immutable external log or a complete recordkeeping system.
Deployment review
Canada Agentic AI Control Mapping
Map one federal-agent workflow across authority, pre-execution decisions, human checkpoints, stop integration, external records, recovery ownership, and verified product gaps.
Official Government of Canada guide and policy directory
Last verified 27 July 2026. The current source record links the live official French guide text and the English Government of Canada directory that lists the guide. Reconfirm official pages before legal, policy, or deployment decisions.