CGB-1 · 6 controls
Sensitivity & Redaction
Credentials, personal data and regulated identifiers must never cross the trust boundary. Detection, redaction and the guarantees around them.
Open standard · v1.0-draft
What does a governed context pipeline actually look like?
CIS Benchmarks define what a hardened server is. The Context Governance Benchmark defines what a governed context pipeline is: 32 measurable, tool-neutral controls across 6 domains, scored into four maturity grades. Citable by security teams, procurement and press — free under CC-BY 4.0.
Status: v1.0-draft, pre-review. The catalog is published and open for feedback; v1.0-final requires ≥ 3 named external reviewers. Until then, do not cite it as a released standard — cite the draft.32 controls, 6 domains.
Each control states a requirement, why it matters, a concrete measurement method, and a level. Three levels build on each other: Basic (the 12-control floor), Hardened (15 controls for customer or regulated data) and Audited (5 controls with third-party-verifiable assurance).
CGB-2 · 5 controls
Provenance & Integrity
For any model interaction: what entered the context, where did it come from, has it been altered? Source attribution, transformation disclosure, tamper evidence.
CGB-3 · 5 controls
Budget & Resource Control
One prompt fans out into many tool calls and sub-agents. Limits, attribution and stopping runaway consumption before the invoice.
CGB-4 · 6 controls
Audit & Evidence
Governance claims are only as strong as the records behind them. What gets logged, how it is protected, and whether a third party can verify it.
CGB-5 · 5 controls
Access Scoping
What may an agent reach, on whose authority? Filesystem, command execution, network and tool-surface boundaries — assistant, not unaudited root shell.
CGB-6 · 5 controls
Lifecycle & Retention
Caches, session stores, long-term memory, shared knowledge: how accumulated state is bounded, expired, deleted and kept honest over time.
Four grades, no C0 to hide behind.
Controls score Met (1.0), Partial (0.5, gap described) or Not met (0). A level's score is points over applicable controls. The grade is the highest threshold the pipeline clears — below C1 it is simply ungraded.
Foundational
Basic ≥ 75%
Managed
Basic ≥ 90% and Hardened ≥ 50%
Hardened
Basic = 100%, Hardened ≥ 80%, Audited ≥ 40%, every Met control links evidence
Audited
Basic = 100%, Hardened = 100%, Audited ≥ 80%, independently verified
From C3 upward, every Met claim links evidence a reviewer can open. From C4, the assessment itself is independently verified — self-assessments stop at C3 by design.
The benchmark for responsible AI context management.
We grade ourselves C2 — and show the gaps.
The spec is tool-neutral; this part is not. LeanCTX self-assesses against v1.0-draft at C2 — Managed: Basic 96% · Hardened 80% · Audited 50%. Where a claim could not be hard-verified, the control is graded down, not up.
Published gaps include CGB-1.4 (fail-closed redaction coverage is conventional, not structurally proven by a CI gate) and several Audited-level controls that await third-party verification. The full per-control findings — including every Partial and Not met — are in the public self-assessment.
Assess your own setup: lean-ctx policy coverage --benchmark cgb statically checks your resolved policy pack against the testable controls — synthetic fixtures, not pattern-name trust.
Versioned like a spec.
Control IDs are permanent and never reused. Substantive changes go through an RFC-light process with a 14-day comment window and recorded dissent. The catalog is revised annually; drafts are always labelled. License: CC-BY 4.0.
Review board — open call. v1.0-final ships once ≥ 3 named external reviewers (security, compliance or platform-engineering practitioners, no single-vendor commercial stake) have worked through every domain. Reviewers are named on the released spec. Volunteer via an issue →
The benchmark,, answered.
The standard, its scoring, and how to assess a context pipeline.
A versioned, tool-neutral catalog of 32 measurable controls across 6 domains (sensitivity & redaction, provenance, budget control, audit & evidence, access scoping, lifecycle & retention) that defines what a governed context pipeline is — the way CIS Benchmarks define what a hardened server is. It is published under CC-BY 4.0 and scored into four maturity grades, C1 to C4.
LeanCTX maintainers edit the spec, but the controls are deliberately tool-neutral: no LeanCTX concepts appear in any control, a neutrality linter enforces that in CI, and any vendor or in-house pipeline can self-assess. LeanCTX publishes its own self-assessment as a separate document — including the gaps.
Against v1.0-draft, LeanCTX self-assesses at C2 — Managed (Basic 96%, Hardened 80%, Audited 50%), with the gaps published: among them, fail-closed redaction coverage is conventional rather than structurally proven, and several Audited-level controls need third-party verification. A perfect self-score would say more about the assessment than about the product.
No — v1.0-draft is published and open for review. The release becomes v1.0-final once at least three named external reviewers (security, compliance or platform-engineering practitioners) have worked through every domain. Until then, assessments must cite the draft status. Want to be a reviewer? Open an issue in the spec repository.
Clone the spec, work through the 32 controls with the assessment template, and grade each control Met, Partial, Not met or N/A using its stated measurement method. LeanCTX users can automate part of it: lean-ctx policy coverage --benchmark cgb statically checks the resolved policy pack against the testable controls and prints per-control results.
Govern the layerthat feeds your models.
Read the spec, assess your pipeline, file issues — or see how LeanCTX implements the controls locally, free forever. CGB defines the controls; the Open Context Protocol defines the wire format; the compliance mappings connect both to EU AI Act, ISO 42001 and SOC 2.