agentrust-trace

TRACE: Trust, Runtime Attestation, and Compliance Evidence

Community updates and contributor highlights: AgenTrust on LinkedIn.

Specification  |  Schema  |  Examples  |  Test Suite  |  Reference Impl

TRACE Specification is an LF Project, hosted at the Linux Foundation as its own series, "TRACE Specification, a Series of LF Projects, LLC".

Developer Preview. Launched at Confidential Computing Summit, 23 June 2026. Spec v0.2 is current. See LIMITATIONS.md before relying on it in production.

An open specification for portable, signed runtime evidence about AI agent runs. TRACE defines the format, anchoring protocol, and verification rules for a record of what an agent ran, where, under which policy, touching which data, and calling which tools, signed so any third party can check it offline. A v0.2 signature proves who produced a record and that it has not changed; hardware provenance needs attestation verified against a trusted root, which the proposed v0.3 runtime evidence profile adds.

A TRACE Trust Record answers: what ran, where, under which policy, touching which data, calling which tools, in a form any third party can check offline without asking the operator.

What a Trust Record claims

Each question maps to a field in the record. The signature shows who made each claim and that it has not changed; whether a claim is true needs evidence the verifier checks independently, as LIMITATIONS.md describes.

Quick start

pip install agentrust-trace

import time
from agentrust_trace import generate_key, sign_record

key = generate_key()

record = {
    "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2",
    "iat": int(time.time()),
    "subject": "spiffe://trust.example.org/agent/payments-processor",
    "model": {"provider": "example-provider", "model_id": "example-model-1"},
    "runtime": {"platform": "software-only", "measurement": "sha256:" + "0" * 64},
    "policy": {"bundle_hash": "sha256:" + "b" * 64, "enforcement_mode": "enforce"},
    "data_class": "confidential",
    "build_provenance": {"slsa_level": 1, "digest": "sha256:" + "e" * 64},
    "appraisal": {"status": "none", "verifier": "https://verifier.example.org"},
}

signed = sign_record(record, key)

See the Quickstart guide for key persistence, validation, and anchoring the record to a transparency log.

Resources

Standards alignment

Hosted at the Linux Foundation as its own series, "TRACE Specification, a Series of LF Projects, LLC", under LF Projects policies. The Linux Foundation announced the contribution on 25 August 2026, developed with AMD, Intel, Microsoft, OPAQUE and TII. Builds on RFC 9711 (EAT), RFC 9334 (RATS), and SCITT draft-22.

Frequently asked questions

What is TRACE?

TRACE (Trust, Runtime Attestation, and Compliance Evidence) is an open specification for hardware-attested AI agent governance records. It defines the record format, the anchoring protocol, and the verification rules for cryptographic evidence that an AI agent ran under a specific policy, in a verified hardware environment, on a given data class, invoking identified tools.

What does a TRACE Trust Record prove?

A single signed Trust Record answers, in a form any third party can verify without trusting the operator: what model ran, where it ran, under which policy, what data class it touched, which tools were called, and whether the record is independently anchored to a SCITT transparency ledger.

What standards is TRACE built on?

TRACE builds on open IETF and IRTF standards: RFC 9711 (CBOR Web Token / EAT) for the claim envelope, RFC 9334 (RATS) for the attester, verifier, and relying-party roles, and the SCITT draft for transparency-ledger anchoring.

How do I create and verify a Trust Record?

Install the library with pip install agentrust-trace, sign a record with sign_record(record, key), and check one with verify_record(record, public_key_or_jwk=trusted_key), both imported from agentrust_trace. verify_record checks the profile URI, the schema, the signature over the RFC 8785 canonical form, and freshness; it checks revocation only when you pass it a revocation source, and it performs no attestation verification. The library does not anchor a record to a transparency ledger: transparency is a string member holding the SCITT receipt URI, which a producer fills in once its ledger returns one. The Quickstart page carries a runnable version of both steps.

How does TRACE relate to AGT and cMCP?

TRACE is the evidence format. AGT and cMCP produce and consume Trust Records, so you can connect them into an end-to-end agent governance pipeline. See the integration guides for details.

What is the current status of TRACE?

The current specification is TRACE v0.2, published with a conformance test suite. See the Limitations page for scope boundaries before relying on it in production.

Contributing

See CONTRIBUTING.md and GOVERNANCE.md. All contributors must agree to the ANTITRUST.md policy.