What is Google DeepMind's Frontier Safety Framework and what does it mean for teams deploying agents?

Google DeepMind's Frontier Safety Framework (FSF) is a governance and technical program for models approaching Critical Capability Levels (CCLs), which are thresholds where a model's skills could enable severe harm if misused or misaligned. For teams deploying agents, FSF translates into capability-aware threat modeling, requiring an inventory of agent capabilities, estimation of proximity to CCL-like harm scenarios, and scaling oversight accordingly.

Teams deploying agents should implement the following controls:

• Inventory agent tools and define internal CCL-style thresholds that trigger additional controls, rating each action's maximum credible harm. This aligns with NIST AI RMF — Govern by defining capability tiers and escalation paths.
• Run dangerous-capability-style evaluations on every frontier model upgrade before shifting production traffic. These evaluations should simulate external attackers and malicious insiders (misuse tests) and examine whether benign objectives produce harmful side effects (misalignment tests). This aligns with NIST AI RMF — Measure by tracking DCE-style test outcomes and misalignment indicators.
• Sandbox agents with no default internet egress, allowing only required endpoints per workflow. This helps contain potential misuse or misalignment and addresses OWASP ASI05 Unexpected Code Execution by segregating execution environments.
• Require step-up authentication and human approval before agents execute tools above a defined amber-tier capability threshold. This is a deployment mitigation that limits agency and aligns with OWASP LLM06 Excessive Agency.
• Monitor both misuse signals (e.g., jailbreaks, hazardous requests) and misalignment signals (e.g., goal drift, metric-gaming actions). This extends detection and response to AI-specific incidents, a core element of Google's Secure AI Framework (SAIF).
• Cap autonomous chain length, session duration, and cumulative tool calls, and reset context when crossing sensitivity boundaries. This helps manage agentic risks over long horizons and aligns with OWASP LLM06 Excessive Agency.