BRACE: A Unified Security Framework for Autonomous AI Agents

BRACE is a unified security framework for autonomous AI agents — systems that execute multi-step plans, invoke tools, and modify state without per-action human review. The framework synthesizes deployed industry practice across NIST, OWASP, MITRE ATLAS, Google SAIF, CSA, CoSAI, AAGATE, and major vendor reference implementations into seven infrastructure layers across build-time and run-time, a cross-cutting operational traceability layer, a tested kill switch, and a complete audit trail. Every control is decomposed into agent-scoped and ecosystem-scoped components, yielding role-based checklists for the four operational teams that share ownership in practice. Six controls extend the agent-security catalog beyond the cited literature. BRACE supports four practitioner uses: auditing control coverage, clarifying role ownership, discovering coverage gaps, and aligning deployed technology against required capabilities.Companion short paper submitted to ESEM 2026 SEIP track