Agent trust framework · 25 requirements
Instead of learning your baseline from traffic and writing it down, Provenant defines and enforces it in advance for you.
Provenant does it. You can show it before your agent runs.
Where the standard asks you to prevent something the model might do, Provenant limits how far it gets.
Where the standard asks you for a plan, a policy or a test, Provenant hands you what it needs.
| Ref | Requirement | How | Mechanism |
|---|---|---|---|
| I-1 | Unique identifier per instance | Enforced | Every session is identified and signed |
| I-2 | Bound to cryptographic credentials | Enforced | Every session is cryptographically bound |
| I-3 | Ownership and responsibility chain | Enforced | Responsibility stays traceable even when agents call agents |
| I-4 | Documented use and scope | Enforced | What you set up is the scope |
| I-5 | Machine-readable capabilities | Enforced | Your agent's options change with where it is in the work |
| B-1 | Machine-parseable action log | Enforced | Records are written and signed as they happen |
| B-2 | Tied to identity and session | Enforced | Every action ties back to a session and an identity |
| B-3 | Baseline of normal operation | Enforced | Provenant defines and enforces your baseline for you |
| B-4 | Deviation detection | Contained | There is nothing to deviate to |
| B-5 | Retrieve decision rationale | Enforced | You can see why any decision was allowed |
| D-1 | Input structure conformance | Enforced | Inputs are checked before they reach the tool |
| D-2 | Prompt-injection resistance | Contained | An injection can't reach what your agent was never given |
| D-3 | Sensitive-data control | Enforced | You choose what the agent sees, field by field |
| D-4 | Output structure conformance | Enforced | Outputs are checked, and the record proves it |
| D-5 | Data provenance | Enforced | Every value traces back to where it came from |
| S-1 | Permitted resources enumerated | Enforced | Anything your agent can reach is listed up front |
| S-2 | Permitted actions enumerated | Enforced | Listed for every step of the work |
| S-3 | Maximum operations per period | Enforced | You can cap how much happens in a session |
| S-4 | Maximum impact per action | Enforced | You can cap how much any single action does |
| S-5 | Cumulative and cascade limits | Enforced | Runaway loops and cascades are capped |
| R-1 | Automatic halt on repeated failures | Enforced | Repeated failures stop the agent automatically |
| R-2 | Immediate manual termination | Enforced | You can stop an agent immediately |
| R-3 | Invalidate all sessions | Enforced | You can invalidate every session at once |
| R-4 | Undo actions | Evidenced | The record gives you what you need to reverse things |
| R-5 | Fallback to lower autonomy | Enforced | You can drop an agent to a lower level of autonomy |