Runtime evidence
When an AI agent runs, the people who rely on it often want proof of what it ran: which model, which policy, which tools it called. TRACE proposes one portable, signed record of those facts that anyone can check against their own rules. The report measures how quickly such records are signed and checked and how large they are, and states plainly that a signature alone does not prove the record came from trusted hardware or that its claims are true.
Rishabh Poddar, Aaron Fulkerson, Imran Siddique
Version 3 / October 1, 2026 / Technical report
Read the report →Tool-call enforcement
AI agents act through tools, and MCP (the Model Context Protocol) is a common way they call them. cMCP puts a checkpoint in front of those tool calls: it checks each call against a written policy before it runs and keeps a signed record of the decision. The report tests this in software with made-up healthcare traces; it did not test real confidential hardware or show that every call was captured.
Rishabh Poddar, Aaron Fulkerson, Imran Siddique
Version 2 / October 1, 2026 / Technical report
Read the report →Agent identity
An AI agent is defined by many parts: its instructions, model, policy, tools, memory and the people who approved it. Agent Manifest proposes a signed list of those parts, so that a later change to any of them can be spotted by someone holding the parts and the right keys. The report measures signing speed and tampering tests, notes that the tested version accepted forged human approvals (later versions check them), and states that a signed list alone does not prove the agent actually ran with those parts.
Imran Siddique
Version 2 / October 1, 2026 / Technical report
Read the report →Model weight custody
When a company runs its private AI model on computers someone else controls, it needs a way to keep control of the model. WCM is an open protocol that releases the model's key only to approved, checked software, requires that permission to be renewed, and records evidence of deletion and of any models derived from it. The tested code passed all 91 shared conformance tests; the report also describes two flaws in that version (fixed later) and a missing hardware setting on the tested cloud machine without which the strongest protection does not hold.
Imran Siddique
Version 2 / October 1, 2026 / Technical report
Read the report →Delegation evidence
When one AI agent hands a task to another, the standard A2A protocol does not limit the authority passed along, check what software the other agent runs, or leave a record of who asked whom. cA2A adds those protections on top of A2A: permissions that can only shrink at each handoff, a check of the other agent's hardware evidence before sending, an encrypted task and a signed record of each step. Software tests confirm these behaviors, but trust between hardware run by two independent organizations has not yet been shown.
Rishabh Poddar, Aaron Fulkerson, Imran Siddique
Version 3 / October 1, 2026 / Technical report
Read the report →Governance telemetry
Monitoring tools for AI agents record what happened, but they drop data and can capture sensitive content, so they make poor audit evidence. This report proposes a shared format for six kinds of governance events, such as policy decisions and human approvals, that keeps prompts, outputs and secrets out and keeps everyday monitoring separate from audit evidence. The tested release passed its tests, but whether the evidence is complete is something the producer states rather than something the system measures, and a defect found later let an edited snapshot be signed.
Imran Siddique
Version 2 / October 1, 2026 / Technical report
Read the report →Confidential handoffs
Keeping data private inside one protected AI system is not enough if an agent then passes it to a tool or to another agent. This paper sets out the conditions each handoff must meet for the data to stay private, and says the sender must hold the data back when a recipient cannot meet them. Its software experiments show leaks earlier in a workflow even when the final answer arrives correctly, and it states that today's AgenTrust components do not yet deliver the full guarantee.
Imran Siddique
Version 3 / October 1, 2026 / Technical report
Read the report →Governance telemetry
Monitoring systems can lose events, so their records cannot prove that every governance event was kept. This report proposes recording each event as evidence at the source first, before it is sent to any monitoring system, so a failed export never means lost evidence. Tests confirm that separation and also show its limits: nothing guarantees an event is stored exactly once, and an empty record can still be declared complete.
Imran Siddique
Version 3 / October 1, 2026 / Technical report
Read the report →Model weight custody
Before a model's decryption key is released, the key service checks what software is running but not how its memory behaves. This report adds an extra check: the machine writes and reads back a pattern over a stated memory range, based on a fresh challenge, signs the result, and gets the key only if that result is fresh, clean and signed by the expected key. It passed its software tests, but it covers only the stated range at that moment and does not stop an attacker with physical access to the machine.
Imran Siddique
Version 1 / October 1, 2026 / Technical report
Read the report →Human oversight
A person often approves an AI agent after its signed description, its manifest, has already been issued. This report shows how to sign the rule that a human must approve so nobody can weaken it, while still letting each approver add their own signed approval later. Tests confirm the design and found a gap in the tested version that a later change closed, and the report lists the further checks on identity and action a system still needs before acting on an approval.
Imran Siddique
Version 1 / October 1, 2026 / Technical report
Read the report →Disclosure control
An answer an AI agent writes from confidential data still carries that data's restrictions. This report describes a release step in which the data's owner approves the exact answer for a named recipient and purpose, and the system delivers it at most once, reporting the outcome as unknown instead of resending when delivery is uncertain. Concurrency and crash tests in cMCP never produced a second delivery, though they ran on one machine and the approval ledger must itself be protected from being rolled back.
Imran Siddique
Version 1 / October 1, 2026 / Technical report
Read the report →Model weight custody
A model owner can require checks before a key service releases the model's key, but that does not help if the operator can quietly change the key service itself. This report has the owner check the key service first, confirming its software, its settings and a fresh receiving key, before handing over the model key. Software tests show that changed or outdated setups are refused, but no real hardware or model key was used, and the owner's own records must be protected against rollback.
Imran Siddique
Version 1 / October 1, 2026 / Technical report
Read the report →Tool-call enforcement
When an operator presses an AI agent's kill switch, what is actually stopped, and does it stay stopped after a restart? Testing the cMCP tool gateway, the report finds that new tool calls are refused with signed refusals anyone can check, and that the block survives restarts. It also finds that work already under way can still finish, in one case about 1.2 seconds after the kill switch had returned.
Imran Siddique
Version 1 / October 1, 2026 / Technical report
Read the report →Delegation evidence
When one agent sends a task to another, checking the other agent beforehand does not prove who wrote the answer that comes back, because a relay in between could swap or replay it. This report tests a cA2A mode that lets the caller accept exactly one genuine answer to its exact request, and report the outcome as unknown instead of retrying when something fails. Tests show it blocks swapped, replayed and doubled answers, but the check works only for the live caller and does not prove authorship to anyone else later.
Imran Siddique
Version 1 / October 1, 2026 / Technical report
Read the report →Model serving
A confidential AI model host has to start before it can prove it is trustworthy, so the question is when users should be allowed to reach it. This report sends traffic to the host only after a signed admission receipt for that exact session has been checked, removes the route when the session ends, and keeps a durable record so a revoked session can never be reopened. Software tests confirm the design without a real cluster or confidential GPU, and show that the record itself must be protected against being rolled back.
Imran Siddique
Version 1 / October 1, 2026 / Technical report
Read the report →Tool-call enforcement
Pressing a kill switch, getting a signed refusal and seeing nothing further happen are three different things. Testing the cMCP gateway, the report finds that it refuses new work and stays blocked after a restart, but also that a call already admitted can finish and a tool reached directly, around the gateway, can still act. It proposes a way to evaluate shutdown that checks each of these separately, including a fresh check of whether the block holds now.
Imran Siddique
Version 1 / October 1, 2026 / Technical report
Read the report →Runtime evidence
When an AI agent runs, the people who rely on it often want proof of what it ran: which model, which policy, which tools it called. TRACE proposes one portable, signed record of those facts that anyone can check against their own rules. The report measures how quickly such records are signed and checked and how large they are, and states plainly that a signature alone does not prove the record came from trusted hardware or that its claims are true.
Rishabh Poddar, Aaron Fulkerson, Imran Siddique
Version 3 / October 1, 2026 / Technical report
Read the report →Tool-call enforcement
AI agents act through tools, and MCP (the Model Context Protocol) is a common way they call them. cMCP puts a checkpoint in front of those tool calls: it checks each call against a written policy before it runs and keeps a signed record of the decision. The report tests this in software with made-up healthcare traces; it did not test real confidential hardware or show that every call was captured.
Rishabh Poddar, Aaron Fulkerson, Imran Siddique
Version 2 / October 1, 2026 / Technical report
Read the report →Agent identity
An AI agent is defined by many parts: its instructions, model, policy, tools, memory and the people who approved it. Agent Manifest proposes a signed list of those parts, so that a later change to any of them can be spotted by someone holding the parts and the right keys. The report measures signing speed and tampering tests, notes that the tested version accepted forged human approvals (later versions check them), and states that a signed list alone does not prove the agent actually ran with those parts.
Imran Siddique
Version 2 / October 1, 2026 / Technical report
Read the report →Model weight custody
When a company runs its private AI model on computers someone else controls, it needs a way to keep control of the model. WCM is an open protocol that releases the model's key only to approved, checked software, requires that permission to be renewed, and records evidence of deletion and of any models derived from it. The tested code passed all 91 shared conformance tests; the report also describes two flaws in that version (fixed later) and a missing hardware setting on the tested cloud machine without which the strongest protection does not hold.
Imran Siddique
Version 2 / October 1, 2026 / Technical report
Read the report →Delegation evidence
When one AI agent hands a task to another, the standard A2A protocol does not limit the authority passed along, check what software the other agent runs, or leave a record of who asked whom. cA2A adds those protections on top of A2A: permissions that can only shrink at each handoff, a check of the other agent's hardware evidence before sending, an encrypted task and a signed record of each step. Software tests confirm these behaviors, but trust between hardware run by two independent organizations has not yet been shown.
Rishabh Poddar, Aaron Fulkerson, Imran Siddique
Version 3 / October 1, 2026 / Technical report
Read the report →Governance telemetry
Monitoring tools for AI agents record what happened, but they drop data and can capture sensitive content, so they make poor audit evidence. This report proposes a shared format for six kinds of governance events, such as policy decisions and human approvals, that keeps prompts, outputs and secrets out and keeps everyday monitoring separate from audit evidence. The tested release passed its tests, but whether the evidence is complete is something the producer states rather than something the system measures, and a defect found later let an edited snapshot be signed.
Imran Siddique
Version 2 / October 1, 2026 / Technical report
Read the report →Confidential handoffs
Keeping data private inside one protected AI system is not enough if an agent then passes it to a tool or to another agent. This paper sets out the conditions each handoff must meet for the data to stay private, and says the sender must hold the data back when a recipient cannot meet them. Its software experiments show leaks earlier in a workflow even when the final answer arrives correctly, and it states that today's AgenTrust components do not yet deliver the full guarantee.
Imran Siddique
Version 3 / October 1, 2026 / Technical report
Read the report →Governance telemetry
Monitoring systems can lose events, so their records cannot prove that every governance event was kept. This report proposes recording each event as evidence at the source first, before it is sent to any monitoring system, so a failed export never means lost evidence. Tests confirm that separation and also show its limits: nothing guarantees an event is stored exactly once, and an empty record can still be declared complete.
Imran Siddique
Version 3 / October 1, 2026 / Technical report
Read the report →Model weight custody
Before a model's decryption key is released, the key service checks what software is running but not how its memory behaves. This report adds an extra check: the machine writes and reads back a pattern over a stated memory range, based on a fresh challenge, signs the result, and gets the key only if that result is fresh, clean and signed by the expected key. It passed its software tests, but it covers only the stated range at that moment and does not stop an attacker with physical access to the machine.
Imran Siddique
Version 1 / October 1, 2026 / Technical report
Read the report →Human oversight
A person often approves an AI agent after its signed description, its manifest, has already been issued. This report shows how to sign the rule that a human must approve so nobody can weaken it, while still letting each approver add their own signed approval later. Tests confirm the design and found a gap in the tested version that a later change closed, and the report lists the further checks on identity and action a system still needs before acting on an approval.
Imran Siddique
Version 1 / October 1, 2026 / Technical report
Read the report →Disclosure control
An answer an AI agent writes from confidential data still carries that data's restrictions. This report describes a release step in which the data's owner approves the exact answer for a named recipient and purpose, and the system delivers it at most once, reporting the outcome as unknown instead of resending when delivery is uncertain. Concurrency and crash tests in cMCP never produced a second delivery, though they ran on one machine and the approval ledger must itself be protected from being rolled back.
Imran Siddique
Version 1 / October 1, 2026 / Technical report
Read the report →Model weight custody
A model owner can require checks before a key service releases the model's key, but that does not help if the operator can quietly change the key service itself. This report has the owner check the key service first, confirming its software, its settings and a fresh receiving key, before handing over the model key. Software tests show that changed or outdated setups are refused, but no real hardware or model key was used, and the owner's own records must be protected against rollback.
Imran Siddique
Version 1 / October 1, 2026 / Technical report
Read the report →Tool-call enforcement
When an operator presses an AI agent's kill switch, what is actually stopped, and does it stay stopped after a restart? Testing the cMCP tool gateway, the report finds that new tool calls are refused with signed refusals anyone can check, and that the block survives restarts. It also finds that work already under way can still finish, in one case about 1.2 seconds after the kill switch had returned.
Imran Siddique
Version 1 / October 1, 2026 / Technical report
Read the report →Delegation evidence
When one agent sends a task to another, checking the other agent beforehand does not prove who wrote the answer that comes back, because a relay in between could swap or replay it. This report tests a cA2A mode that lets the caller accept exactly one genuine answer to its exact request, and report the outcome as unknown instead of retrying when something fails. Tests show it blocks swapped, replayed and doubled answers, but the check works only for the live caller and does not prove authorship to anyone else later.
Imran Siddique
Version 1 / October 1, 2026 / Technical report
Read the report →Model serving
A confidential AI model host has to start before it can prove it is trustworthy, so the question is when users should be allowed to reach it. This report sends traffic to the host only after a signed admission receipt for that exact session has been checked, removes the route when the session ends, and keeps a durable record so a revoked session can never be reopened. Software tests confirm the design without a real cluster or confidential GPU, and show that the record itself must be protected against being rolled back.
Imran Siddique
Version 1 / October 1, 2026 / Technical report
Read the report →Tool-call enforcement
Pressing a kill switch, getting a signed refusal and seeing nothing further happen are three different things. Testing the cMCP gateway, the report finds that it refuses new work and stays blocked after a restart, but also that a call already admitted can finish and a tool reached directly, around the gateway, can still act. It proposes a way to evaluate shutdown that checks each of these separately, including a fresh check of whether the block holds now.
Imran Siddique
Version 2 / October 11, 2026 / Technical report
Read the report →