TRACE¶

TRACE (Trust, Runtime Attestation, and Compliance Evidence) is an open specification for hardware-attested AI agent governance records. It defines the record format, the anchoring protocol, and the verification rules for cryptographic evidence that an AI agent ran under a specific policy, in a verified hardware environment, on a given data class, invoking identified tools, all bound into a single signed artifact rooted in silicon attestation.

A Trust Record answers what ran, where, under which policy, touching which data, and calling which tools, in a form any third party can verify without trusting the operator.

TL;DR

An audit log is written by the system being audited. A Trust Record is signed inside a TEE and checked against a hardware root, so the operator cannot author it after the fact.
The current specification is v0.2, with a conformance test suite that scores a record by level.
Install with pip install agentrust-trace and sign your first record in a few minutes.
TRACE Specification is hosted at the Linux Foundation as its own series, TRACE Specification, a Series of LF Projects, LLC.

pip install agentrust-trace

import time
from agentrust_trace import generate_key, sign_record

key = generate_key()

record = {
    "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2",
    "iat": int(time.time()),
    "subject": "spiffe://trust.example.org/agent/payments-processor",
    "model": {"provider": "anthropic", "model_id": "claude-sonnet-4-6"},
    "runtime": {"platform": "software-only", "measurement": "sha256:" + "0" * 64},
    "policy": {"bundle_hash": "sha256:" + "b" * 64, "enforcement_mode": "enforce"},
    "data_class": "confidential",
    "build_provenance": {"slsa_level": 1, "digest": "sha256:" + "e" * 64},
    "appraisal": {"status": "none", "verifier": "https://verifier.example.org"},
}

signed = sign_record(record, key)

What a Trust Record proves¶

Each question maps to a claim a third party can check without asking you.

Question	TRACE claim
What model ran?	`model.model_id` + `model.weights_digest`
Where did it run?	`runtime.platform` + `runtime.measurement`
Under which policy?	`policy.bundle_hash` + `policy.enforcement_mode`
What data did it touch?	`data_class`
Which tools were called?	`tool_transcript.hash` + `tool_transcript.call_count`
Is the record independently anchored?	`transparency` (SCITT receipt URI)

Where to start¶

Run it

Sign a record, verify it, and see what a failed check looks like.

Quickstart
Read it

The normative specification, with the claim set, the anchoring protocol, and the verification rules.

TRACE v0.2
Test it

Score an implementation against the spec by conformance level before claiming compliance.

Conformance suite
Integrate it

Emit and consume Trust Records from AGT, cMCP, and sandboxed agent runtimes.

Integration guides

What it is built on¶

TRACE profiles existing IETF and IRTF work rather than replacing it: RFC 9711 (EAT) for the claim envelope, RFC 9334 (RATS) for the attester, verifier, and relying-party roles, and the SCITT draft for transparency-ledger anchoring. A related standardization track runs in CoSAI WS4.

Status and governance¶

The specification is a Developer Preview. v0.2 is current and published with a conformance test suite. Read Limitations for the scope boundaries before relying on it in production.

TRACE Specification is an LF Project, hosted at the Linux Foundation as its own series, "TRACE Specification, a Series of LF Projects, LLC", under LF Projects policies. See Governance for how decisions are made and Contributing for how to propose a change.