Specification | Schema | Examples | Test Suite | Reference Impl
TRACE Specification is an LF Project, hosted at the Linux Foundation as its own series, "TRACE Specification, a Series of LF Projects, LLC".
Developer Preview. Launched at Confidential Computing Summit, 23 June 2026. Spec v0.2 is current. See LIMITATIONS.md before relying on it in production.
An open specification for portable, signed runtime evidence about AI agent runs. TRACE defines the format, anchoring protocol, and verification rules for a record of what an agent ran, where, under which policy, touching which data, and calling which tools, signed so any third party can check it offline. A v0.2 signature proves who produced a record and that it has not changed; hardware provenance needs attestation verified against a trusted root, which the proposed v0.3 runtime evidence profile adds.
A TRACE Trust Record answers: what ran, where, under which policy, touching which data, calling which tools, in a form any third party can check offline without asking the operator.
Each question maps to a field in the record. The signature shows who made each claim and that it has not changed; whether a claim is true needs evidence the verifier checks independently, as LIMITATIONS.md describes.
| Question | TRACE claim |
|---|---|
| What model ran? | model.model_id + model.weights_digest |
| Where did it run? | runtime.platform + runtime.measurement |
| Under which policy? | policy.bundle_hash + policy.enforcement_mode |
| What data did it touch? | data_class |
| Which tools were called? | tool_transcript.hash + tool_transcript.call_count |
| Is the record independently anchored? | transparency (SCITT receipt URI) |
pip install agentrust-traceimport time
from agentrust_trace import generate_key, sign_record
key = generate_key()
record = {
"eat_profile": "tag:agentrust-io.com,2026:trace-v0.2",
"iat": int(time.time()),
"subject": "spiffe://trust.example.org/agent/payments-processor",
"model": {"provider": "example-provider", "model_id": "example-model-1"},
"runtime": {"platform": "software-only", "measurement": "sha256:" + "0" * 64},
"policy": {"bundle_hash": "sha256:" + "b" * 64, "enforcement_mode": "enforce"},
"data_class": "confidential",
"build_provenance": {"slsa_level": 1, "digest": "sha256:" + "e" * 64},
"appraisal": {"status": "none", "verifier": "https://verifier.example.org"},
}
signed = sign_record(record, key)See the Quickstart guide for key persistence, validation, and anchoring the record to a transparency log.
| 📖 Full documentation | trace.agentrust-io.com |
| 📄 Specification | spec/trace-v0.2.md |
| 🔍 Schema | schema/trace-claim.json |
| 📦 PyPI | agentrust-trace |
| 🧪 Test suite | trace-tests |
| 🗂 Registry | trace-registry |
| 🔗 Reference implementation | cmcp |
| 💬 Discussions | GitHub Discussions |
| 📋 Changelog | CHANGELOG.md |
Hosted at the Linux Foundation as its own series, "TRACE Specification, a Series of LF Projects, LLC", under LF Projects policies. The Linux Foundation announced the contribution on 25 August 2026, developed with AMD, Intel, Microsoft, OPAQUE and TII. Builds on RFC 9711 (EAT), RFC 9334 (RATS), and SCITT draft-22.
TRACE (Trust, Runtime Attestation, and Compliance Evidence) is an open specification for hardware-attested AI agent governance records. It defines the record format, the anchoring protocol, and the verification rules for cryptographic evidence that an AI agent ran under a specific policy, in a verified hardware environment, on a given data class, invoking identified tools.
A single signed Trust Record answers, in a form any third party can verify without trusting the operator: what model ran, where it ran, under which policy, what data class it touched, which tools were called, and whether the record is independently anchored to a SCITT transparency ledger.
TRACE builds on open IETF and IRTF standards: RFC 9711 (CBOR Web Token / EAT) for the claim envelope, RFC 9334 (RATS) for the attester, verifier, and relying-party roles, and the SCITT draft for transparency-ledger anchoring.
Install the library with pip install agentrust-trace, sign a record with sign_record(record, key), and check one with verify_record(record, public_key_or_jwk=trusted_key), both imported from agentrust_trace. verify_record checks the profile URI, the schema, the signature over the RFC 8785 canonical form, and freshness; it checks revocation only when you pass it a revocation source, and it performs no attestation verification. The library does not anchor a record to a transparency ledger: transparency is a string member holding the SCITT receipt URI, which a producer fills in once its ledger returns one. The Quickstart page carries a runnable version of both steps.
TRACE is the evidence format. AGT and cMCP produce and consume Trust Records, so you can connect them into an end-to-end agent governance pipeline. See the integration guides for details.
The current specification is TRACE v0.2, published with a conformance test suite. See the Limitations page for scope boundaries before relying on it in production.
See CONTRIBUTING.md and GOVERNANCE.md. All contributors must agree to the ANTITRUST.md policy.