Skip to content

docs(profile): accuracy pass, every claim checked against the repos #21

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
imran-siddique merged 1 commit into from
Jul 28, 2026
Merged

docs(profile): accuracy pass, every claim checked against the repos #21

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 22 additions & 14 deletions profile/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,15 +24,16 @@ The specifications, SDKs, and conformance tests are free and open. Begin in soft

| Project | Description | License | Status |
|---------|-------------|---------|--------|
| [agent-manifest](https://github.com/agentrust-io/agent-manifest) | Agent Manifest SDK: cryptographically bind all 10 artifacts defining an agent at deployment. Python. | Apache 2.0 | Public, v0.3.0 |
| [agent-manifest](https://github.com/agentrust-io/agent-manifest) | Agent Manifest SDK: cryptographically bind all 10 artifacts defining an agent at deployment. Python. | Apache 2.0 | Public, v0.7.0 |
| [cmcp](https://github.com/agentrust-io/cmcp) | cMCP: Confidential MCP Runtime. Hardware-attested policy enforcement for MCP tool calls inside a TEE. | MIT | Public, v0.3.0 |
| [ca2a](https://github.com/agentrust-io/ca2a) | cA2A: Confidential Agent-to-Agent. Attested, attenuated delegation profile on top of A2A, with a sealed peer channel and offline-verifiable provenance. | MIT | Public, alpha (pre-release) |
| [trace-spec](https://github.com/agentrust-io/trace-spec) | TRACE: Trust Runtime Attestation and Compliance Evidence. Open EAT/JWT attestation standard. | CC BY 4.0 | Public, targeting AAIF submission |
| [trace-registry](https://github.com/agentrust-io/trace-registry) | Append-only public Merkle registry mirror for TRACE claim anchors. | CC BY 4.0 | Private |
| [trace-tests](https://github.com/agentrust-io/trace-tests) | TRACE conformance test suite for certification. | Apache 2.0 | Public, v0.2.0 |
| [ca2a](https://github.com/agentrust-io/ca2a) | cA2A: Confidential Agent-to-Agent. Attested, attenuated delegation profile on top of A2A, with a sealed peer channel and offline-verifiable provenance. | MIT | Public, alpha (v0.1.0a1) |
| [trace-spec](https://github.com/agentrust-io/trace-spec) | TRACE: Trust Runtime Attestation and Compliance Evidence. Open attestation standard: an EAT (RFC 9711) profile carried in a JWT or CWT/COSE envelope, plus the `agentrust-trace` reference SDK. | Dual: CC BY 4.0 (spec text), Apache 2.0 (code) | Public, spec v0.2, SDK v0.5.1 |
| [trace-tests](https://github.com/agentrust-io/trace-tests) | TRACE conformance test suite for certification. | Apache 2.0 | Public, v0.4.0 |
| [examples](https://github.com/agentrust-io/examples) | End-to-end integration examples: financial services, healthcare, multi-tenant SaaS, industrial embodied AI, and agent-to-agent delegation. | MIT | Public |
| [integrations](https://github.com/agentrust-io/integrations) | Ecosystem adapters: third-party governance runtimes to TRACE claims. | Apache 2.0 | Public |
| [integrations](https://github.com/agentrust-io/integrations) | Ecosystem adapters: third-party governance runtimes to TRACE claims, plus coding-agent plugins. | Apache 2.0 | Public |
| [demos](https://github.com/agentrust-io/demos) | Runnable demos and the web console used for walkthroughs. | MIT | Public |
| [awesome-ai-governance](https://github.com/agentrust-io/awesome-ai-governance) | Community-curated list of tools, frameworks, standards, and resources for governing autonomous AI agents. | CC0 1.0 | Public, launched CC Summit Jun 23 |
| [trace-registry](https://github.com/agentrust-io/trace-registry) | Merkle registry of TRACE claim anchors, with a normative anchor and inclusion-proof format. | CC BY 4.0 | **Private.** Publishing the anchor format is tracked in [trace-spec#111](https://github.com/agentrust-io/trace-spec/issues/111) |

## Principles

Expand Down Expand Up @@ -88,7 +89,11 @@ The PDF frames agent identity as an authentication problem. The sharper framing:
| 9 | Supply chain provenance | Compromised dependency runs as approved binary |
| 10 | HITL approvals | EU AI Act Art. 14 violation |

The signing key is hardware-sealed in a TEE. Hardware provider auto-selects: `SEV-SNP -> TDX -> TPM -> software`. `OPAQUEProvider` is explicit opt-in via `OPAQUE_ATTESTATION_URL` and is never auto-detected. `GPUCCProvider` (NVIDIA H100/H200/Blackwell, CC mode) is planned for v0.2.
The signing key is hardware-sealed in a TEE. Hardware provider auto-selects: `Azure CVM -> SEV-SNP -> TDX -> TPM -> software`. `OPAQUEProvider` is explicit opt-in via `OPAQUE_ATTESTATION_URL` and is never auto-detected. `GPUCCProvider` (NVIDIA H100/H200/Blackwell, CC mode) is not shipped; it is blocked on H100 quota rather than on design.

Azure is checked before the bare-metal SNP probe and is its own provider for a reason worth stating plainly: Azure runs SEV-SNP behind a Hyper-V paravisor, so the report is read through the vTPM and the root of trust is a vTPM AK chained to the SNP report, not a guest-controlled `REPORT_DATA`. A consumer keying on the platform value can tell the two apart. **Azure TDX cannot be attested offline at all**: the guest receives a vTPM-MAC'd `TDREPORT` rather than a signed DCAP quote, so rooting it needs a networked service (Azure MAA). Offline TDX works on non-paravisor guests such as GCP C3.

**What is verified against real silicon, as opposed to parsed:** SEV-SNP report signatures verify to the AMD root (VCEK then ASK then ARK), hardware-validated on GCP N2D and live Azure SEV-SNP. Intel TDX verifies a full DCAP v4 quote to the pinned Intel SGX Root CA, offline and hardware-validated on GCP C3. TPM 2.0 quotes verify an AK chain to a pinned root, validated against a real Azure vTPM quote. Nothing in that list is a format check standing in for a signature check.

A verifier holding the manifest and attestation report can prove, without trusting the operator, that a specific agent ran specific code under specific policy. Agent identity and user identity are cryptographically separate credentials: SPIFFE SVIDs for workload identity, Ed25519 (or post-quantum ML-DSA-65 at Level 3) for the manifest signature.

Expand All @@ -105,7 +110,7 @@ Four conformance levels address the full deployment range:

Agent Manifest artifact #9 binds container digest, SLSA provenance level, and SBOMs into the signed manifest. A supply chain attack that swaps the container invalidates the TEE measurement, which invalidates the manifest signature. Hardware attestation makes this structurally detectable, not just policy-prohibited.

**TRACE** includes `build_provenance` as a first-class field (SLSA Provenance v1.0) and an `AIBOM` field (SPDX 3.0 / CycloneDX 1.7) capturing the model weights digest. The model component inventory is bound into a hardware-attested record and cannot be swapped after signing.
**TRACE** includes `build_provenance` as a first-class field (SLSA Provenance v1.0). The model is identified by `model.weights_digest`, and an AIBOM is referenced by digest through `model.aibom_uri` (SPDX 3.0 AI Profile / CycloneDX 1.7 ML-BOM) rather than embedded. Both are inside the signed payload, so the model component inventory cannot be swapped after signing.

Every agentrust-io repository carries OpenSSF Scorecard badges, CodeQL SAST, Dependabot, pip-audit on every PR, and bandit security linting. The tooling in this org practices what it recommends.

Expand All @@ -131,6 +136,8 @@ The eBook calls for policy at four layers (model, agent, tool, request) with fle

**[TRACE](https://github.com/agentrust-io/trace-spec)** defines the governance record format: what a compliance artifact should contain, how it is cryptographically bound, and how it anchors in a transparency log. TRACE composes existing standards rather than replacing them:

**TRACE v0.2 is current, and moving to it is not optional if you pinned the v0.1 profile URI.** The EAT profile is now `tag:agentrust-io.com,2026:trace-v0.2`. The v0.1 identifier named a domain this project never controlled, which RFC 4151 does not permit for a tag URI, so it was invalid rather than merely renamed. Verifiers cut over rather than accepting both, because a verifier honouring the old identifier would keep certifying records minted under a name we do not own. Records already issued under v0.1 stay verifiable against the v0.1 spec and the `agentrust-trace` 0.4.x and `agentrust-trace-tests` 0.3.x releases, which remain published. v0.2 also makes `transparency` optional below Level 2, since an unanchored Level 0 or Level 1 record has no receipt to name.

| Primitive | Role in TRACE |
|---|---|
| RATS / EAT (RFC 9711) | Wire envelope and claim model |
Expand All @@ -139,12 +146,13 @@ The eBook calls for policy at four layers (model, agent, tool, request) with fle
| SCITT | Append-only transparency anchoring |
| EAR (draft-ietf-rats-ar4si) | Verifier appraisal output |
| MCP / A2A | Agent tool-call transcript surface |
| AIBOM (SPDX 3.0 / CycloneDX 1.7) | Model component inventory |
| CBOM (CycloneDX) | Cryptographic bill of materials — crypto libraries/algorithms in use (post-quantum readiness) |
| AIBOM (SPDX 3.0 AI Profile / CycloneDX 1.7 ML-BOM) | Model component inventory, referenced by digest from `model.aibom_uri` |

**[TRACE Registry](https://github.com/agentrust-io/trace-registry)** is an append-only Merkle registry of TRACE claim anchors, built on RFC 6962 (Certificate Transparency) trees so a third party can verify inclusion without trusting the registry operator. Git's immutable commit history is the tamper-evident proof.

**[TRACE Registry](https://github.com/agentrust-io/trace-registry)** is the public append-only Merkle registry of TRACE claim anchors. The GitHub mirror exists so any party can verify anchors independently. Git's immutable commit history is the tamper-evident proof.
**The repository is currently private, and that is a gap rather than a design choice.** Independent verification needs the anchor and inclusion-proof format, which is specified normatively but not yet published. Publishing it is tracked in [trace-spec#111](https://github.com/agentrust-io/trace-spec/issues/111). Until then, treat independent anchor verification as documented-but-not-yet-exercisable by outside parties.

**AGT (Agent Governance Toolkit)** ([microsoft/agent-governance-toolkit](https://github.com/microsoft/agent-governance-toolkit), created by Imran Siddique (Chief Platform Officer, OPAQUE) while at Microsoft and released under the MIT license — 4,800+ stars, 10/10 OWASP Agentic Top 10) provides the runtime governance layer: trust score decay (a score at deployment is meaningless six months later), scope-chain delegation (monotonic narrowing: agent-to-agent delegation with verifiable credentials), and a fleet daemon for multi-agent orchestration.
**AGT (Agent Governance Toolkit)** ([microsoft/agent-governance-toolkit](https://github.com/microsoft/agent-governance-toolkit), created by Imran Siddique (Chief Platform Officer, OPAQUE) while at Microsoft and released under the MIT license — 5,100+ stars, 10/10 OWASP Agentic Top 10) provides the runtime governance layer: trust score decay (a score at deployment is meaningless six months later), scope-chain delegation (monotonic narrowing: agent-to-agent delegation with verifiable credentials), and a fleet daemon for multi-agent orchestration.

### Multi-Agent Coordination Governance

Expand All @@ -163,10 +171,10 @@ Multi-agent architecture compounds it: an orchestrator delegates to sub-agents,
This is the layer the **Anthropic *Zero-Trust for AI Agents*** framework calls for: authentication of agent-to-agent communication, RBAC for agent hierarchies, consensus for high-stakes decisions; and where the stack enforces it:

- **Agent Manifest artifact #8 (A2A delegation)** binds the full agent-to-agent trust chain into the signed manifest. A delegated scope can never exceed the orchestrator's own attested permissions; orchestrator spoofing and scope laundering are structurally prevented. AGT supplies the mechanism: scope-chain delegation (monotonic narrowing) with verifiable credentials.
- **[cA2A](https://github.com/agentrust-io/ca2a) (Confidential A2A)** is the profile that carries this at the agent-to-agent boundary: each hop presents a signed delegation credential whose scope is a provable subset of its parent, verified offline today; attested peers and a payload sealed to the peer's measurement are on the roadmap.
- **[cA2A](https://github.com/agentrust-io/ca2a) (Confidential A2A)** is the profile that carries this at the agent-to-agent boundary: each hop presents a signed delegation credential whose scope is a provable subset of its parent, verified offline. Peer attestation and sealing to a peer's measurement are no longer roadmap: the handshake has run off a live SEV-SNP quote returning `assurance="hardware"`, with the payload sealed to a channel key a hardware-verified measurement vouches for, followed by a cross-operator run from an Azure SEV-SNP peer to a GCP Intel TDX peer. Two limits remain and cA2A's own docs state them: that appraisal was **one-directional** (the caller appraised the callee, not the reverse, so mutual simultaneous attestation is outstanding), and the reference server and client still default to software mode, so the hardware path is a validated capability rather than the default configuration.
- **TRACE** records each agent's actions as a hashed, counted `tool_transcript`, so the full interaction graph of a multi-agent run can be reconstructed and proven after the fact.

Once every agent carries attested proof of *what it is* and emits verifiable evidence of *what it did*.
The goal is that every agent carries attested proof of *what it is* and emits verifiable evidence of *what it did*, so a multi-agent run can be reconstructed by someone who trusts none of its operators.

### Detection and Response

Expand Down
2 changes: 1 addition & 1 deletion profile/technical-one-pager.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ Anthropic's [*Zero-Trust for AI Agents*](https://claude.com/blog/zero-trust-for-

agentrust-io stands on two things that already exist and work.

**1 · Policy — the Agent Governance Toolkit (AGT).** Created by Imran Siddique (now OPAQUE's Chief Platform Officer) at Microsoft and open-sourced under MIT: 4,250+ stars, 590+ forks since its April 2026 public launch; 10/10 OWASP Agentic Top 10 coverage; ships trust-score decay, scope-chain delegation (monotonic narrowing), and a multi-agent fleet daemon; now being considered by AAIF for standardization.
**1 · Policy — the Agent Governance Toolkit (AGT).** Created by Imran Siddique (now OPAQUE's Chief Platform Officer) at Microsoft and open-sourced under MIT: 5,100+ stars, 830+ forks since its April 2026 public launch; 10/10 OWASP Agentic Top 10 coverage; ships trust-score decay, scope-chain delegation (monotonic narrowing), and a multi-agent fleet daemon; now being considered by AAIF for standardization.

**2 · Enforcement — a confidential runtime, pluggable by design.** The policy bundle is sealed and measured inside a TEE on the confidential-computing silicon you already operate — Intel TDX, AMD SEV-SNP, NVIDIA CC, or TPM. The OPAQUE Confidential AI is the hardware-rooted, managed reference implementation; an operator can bring its own.

Expand Down