TRACE: Trust, Runtime Attestation, and Compliance Evidence

Specification  |  Schema  |  Examples  |  Test Suite  |  Reference Impl

TRACE Specification is an LF Project, hosted at the Linux Foundation as its own series, "TRACE Specification, a Series of LF Projects, LLC".

Developer Preview. Launched at Confidential Computing Summit, 23 June 2026. Spec v0.2 is current. See LIMITATIONS.md before relying on it in production.

An open specification for hardware-attested AI agent governance records. TRACE defines the format, anchoring protocol, and verification rules for cryptographically provable evidence that an AI agent ran under a specific policy, in a verified hardware environment, on classified data, invoking identified tools, all bound into a single signed artifact rooted in silicon attestation.

A TRACE Trust Record answers: what ran, where, under which policy, touching which data, calling which tools, in a form any third party can verify without trusting the operator.

What a Trust Record proves

Each question maps to a claim a third party can check for themselves.

Question	TRACE claim
What model ran?	model.model_id + model.weights_digest
Where did it run?	runtime.platform + runtime.measurement
Under which policy?	policy.bundle_hash + policy.enforcement_mode
What data did it touch?	data_class
Which tools were called?	tool_transcript.hash + tool_transcript.call_count
Is the record independently anchored?	transparency (SCITT receipt URI)

Quick start

pip install agentrust-trace

import time
from agentrust_trace import generate_key, sign_record

key = generate_key()

record = {
    "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2",
    "iat": int(time.time()),
    "subject": "spiffe://trust.example.org/agent/payments-processor",
    "model": {"provider": "anthropic", "model_id": "claude-sonnet-4-6"},
    "runtime": {"platform": "software-only", "measurement": "sha256:" + "0" * 64},
    "policy": {"bundle_hash": "sha256:" + "b" * 64, "enforcement_mode": "enforce"},
    "data_class": "confidential",
    "build_provenance": {"slsa_level": 1, "digest": "sha256:" + "e" * 64},
    "appraisal": {"status": "none", "verifier": "https://verifier.example.org"},
}

signed = sign_record(record, key)

See the Quickstart guide for key persistence, validation, and anchoring the record to a transparency log.

Resources

📖 Full documentation	trace.agentrust-io.com
📄 Specification	spec/trace-v0.2.md
🔍 Schema	schema/trace-claim.json
📦 PyPI	agentrust-trace
🧪 Test suite	trace-tests
🗂 Registry	trace-registry (not public yet)
🔗 Reference implementation	cmcp
💬 Discussions	GitHub Discussions
📋 Changelog	CHANGELOG.md

Standards alignment

Hosted at the Linux Foundation as its own series, "TRACE Specification, a Series of LF Projects, LLC", under LF Projects policies. The Linux Foundation announced the contribution on 25 August 2026, developed with AMD, Intel, Microsoft, OPAQUE and TII. Builds on RFC 9711 (EAT), RFC 9334 (RATS), and SCITT draft-22.

Frequently asked questions

What is TRACE?

TRACE (Trust, Runtime Attestation, and Compliance Evidence) is an open specification for hardware-attested AI agent governance records. It defines the record format, the anchoring protocol, and the verification rules for cryptographic evidence that an AI agent ran under a specific policy, in a verified hardware environment, on a given data class, invoking identified tools.

What does a TRACE Trust Record prove?

A single signed Trust Record answers, in a form any third party can verify without trusting the operator: what model ran, where it ran, under which policy, what data class it touched, which tools were called, and whether the record is independently anchored to a SCITT transparency ledger.

What standards is TRACE built on?

TRACE builds on open IETF and IRTF standards: RFC 9711 (CBOR Web Token / EAT) for the claim envelope, RFC 9334 (RATS) for the attester, verifier, and relying-party roles, and the SCITT draft for transparency-ledger anchoring. It is designed for CoSAI WS4 interoperability.

How do I create and verify a Trust Record?

Install the Python library with pip install agentrust-trace, sign a record with TrustRecord.sign(claims, signing_key), anchor it to a SCITT ledger with record.anchor(), and check it with record.verify(verifying_key).

How does TRACE relate to AGT and cMCP?

TRACE is the evidence format. AGT and cMCP produce and consume Trust Records, so you can connect them into an end-to-end agent governance pipeline. See the integration guides for details.

What is the current status of TRACE?

The current specification is TRACE v0.2, published with a conformance test suite. See the Limitations page for scope boundaries before relying on it in production.

<script type="application/ld+json"> { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "What is TRACE?", "acceptedAnswer": { "@type": "Answer", "text": "TRACE (Trust, Runtime Attestation, and Compliance Evidence) is an open specification for hardware-attested AI agent governance records. It defines the record format, the anchoring protocol, and the verification rules for cryptographic evidence that an AI agent ran under a specific policy, in a verified hardware environment, on a given data class, invoking identified tools." } }, { "@type": "Question", "name": "What does a TRACE Trust Record prove?", "acceptedAnswer": { "@type": "Answer", "text": "A single signed Trust Record answers, in a form any third party can verify without trusting the operator: what model ran, where it ran, under which policy, what data class it touched, which tools were called, and whether the record is independently anchored to a SCITT transparency ledger." } }, { "@type": "Question", "name": "What standards is TRACE built on?", "acceptedAnswer": { "@type": "Answer", "text": "TRACE builds on open IETF and IRTF standards: RFC 9711 (CBOR Web Token / EAT) for the claim envelope, RFC 9334 (RATS) for the attester, verifier, and relying-party roles, and the SCITT draft for transparency-ledger anchoring. It is designed for CoSAI WS4 interoperability." } }, { "@type": "Question", "name": "How do I create and verify a Trust Record?", "acceptedAnswer": { "@type": "Answer", "text": "Install the Python library with pip install agentrust-trace, sign a record with TrustRecord.sign(claims, signing_key), anchor it to a SCITT ledger with record.anchor(), and check it with record.verify(verifying_key)." } }, { "@type": "Question", "name": "How does TRACE relate to AGT and cMCP?", "acceptedAnswer": { "@type": "Answer", "text": "TRACE is the evidence format. AGT and cMCP produce and consume Trust Records, so you can connect them into an end-to-end agent governance pipeline. See the integration guides for details." } }, { "@type": "Question", "name": "What is the current status of TRACE?", "acceptedAnswer": { "@type": "Answer", "text": "The current specification is TRACE v0.2, published with a conformance test suite. See the Limitations page for scope boundaries before relying on it in production." } } ] } </script>

Contributing

See CONTRIBUTING.md and GOVERNANCE.md. All contributors must agree to the ANTITRUST.md policy.