Artificial Intelligence & Machine Learning,
Governance & Risk Management,
Next-Generation Technologies & Secure Development
Framework 3.0 Adds Controls for Identity, Tools, Memory and Agent Autonomy
In a notable development within the realm of artificial intelligence governance, China recently introduced a highly detailed AI Safety Governance Framework 3.0, an advancement that experts argue surpasses the frameworks currently employed by organizations in the United States. This new framework, released in mid-September, was crafted under the auspices of the Cyberspace Administration of China by a dedicated technical committee. It marks a significant shift from the earlier edition that focused on controlling AI models and applications, pivoting instead toward the critical task of mitigating risks associated with autonomous AI systems operating in real-world environments.
The framework introduces a comprehensive appendix dedicated to managing the risks associated with AI agents, a concept that has garnered increasing attention as autonomous systems become more integrated into daily operations. Lou Eichenbaum, who serves as the federal CTO at ColorTokens, a microsegmentation provider, stated, “There is significant convergence between this framework and U.S. guidance, such as the NIST AI Risk Management Framework.” He elaborated that both frameworks underscore essential elements such as risk-based governance, testing, transparency, monitoring, human oversight, and lifecycle management.
What’s particularly striking about China’s framework, according to Eichenbaum, is its level of specificity concerning agent-specific controls: “The difference is that China’s new document provides a surprisingly detailed framework, while much of the publicly available U.S. guidance remains broader.” This emphasis on precise controls mirrors the increasing concerns that experts have regarding the rapid development of AI technologies and the accompanying risks.
The announcement of China’s new framework comes at a time when leaders from frontier labs are expressing divergent views from the federal government regarding the pace of AI development. This divergence may set the stage for anticipated AI safety discussions between Chinese leader Xi Jinping and U.S. President Donald Trump in the near future.
While the governance framework is not legally binding, it serves as a prospective indicator of forthcoming national standards, given its formulation by the National Technical Committee 260, which is China’s official authority on cybersecurity and AI standards. This committee collaborated closely with various government agencies, academic institutions, and research labs, affording the document a degree of authority and relevance within the field.
The framework begins with a familiar concern—the potential for agents to act outside their intended purpose. However, it remains ambiguous whether this urgency is influenced by recent incidents involving U.S. AI models engaging with real-world systems or if it is an outcome of China’s own monitoring practices. The framework delineates four high-level categories of agentic AI risks, including misuse of identity and permissions, deviation from intended goals, malicious exploitation of otherwise legitimate tools, and manipulation of memory storage. Such risks have the potential to result in security breaches manifesting as credential hijacking, identity spoofing, goal hijacking, tool poisoning, and data leaks, among others.
Detailed granularity continues in an appendix devoted to agentic AI risk management, which catalogues potential failures at each stage of an agent’s lifecycle—from development to deactivation. Prior to deployment, developers are urged to clearly define the application scenarios, business processes, accessible resources, and prohibited actions associated with the agent’s functions. Depending on the deployment context, agents should be positioned within isolated environments or segmented networks, with access privileges being incrementally granted under dynamic security controls and emergency response protocols.
In addressing identity and access management, the framework emphasizes that each agent must possess a unique identity, precluding identity-sharing among different application instances. Moreover, it delineates the necessary boundaries and permissions for various decision-making scenarios, which encompass user-reserved decisions, those requiring user authorization, and those that can be executed autonomously by the agent.
Human authorization emerges as a necessity during critical decision points, such as file deletion and system configuration changes. The framework stipulates that if a user fails to respond or an approval system does not function properly, the agent’s operations should be suspended.
Imran Chowdhury, head of governance and risk compliance at Al Jazeera Media Network, remarked that the Chinese framework stands out as notably more specific than instruments released by U.S. counterparts and the European Union. “It reads less like a policy paper than like an internal security standard,” he indicated, underscoring the practical implications of stringent governance measures.
As a comparative backdrop, Chowdhury noted that the European Union represents the only region among the three that has established a comprehensive AI statute applicable across all sectors. However, its compliance deadline for high-risk AI systems under the AI Act has been postponed from August 2026 to December 2027, due to delays in finalizing the necessary technical specifications. Notably, this act was formulated before the widespread adoption of AI agents.
In the United States, AI policy has been shaped by recent executive orders, including one from December 2025 aimed at challenging state AI regulations that conflict with federal guidelines. However, these policies lack the binding authority of China’s expansive framework.
Chowdhury concludes by reminding audiences that, despite the nuanced landscape, it would be misleading to declare China as unequivocally ‘ahead’ in the realm of AI safety. “China’s framework is guidance; its binding regime is heavily oriented toward content control,” he explained. Additionally, independent analysts have pointed to limited safety transparency from numerous Chinese developers. This complexity means that the narratives traditionally framing Europe as cautious, America as permissive, and China as unbothered no longer adequately encapsulate the current dynamics in AI governance. Each of these regions now acknowledges the inherent risks associated with frontier technologies.