What is Cryptographic Runtime Governance?

Cryptographic Runtime Governance (CRG) is the discipline of sealing software and AI agent behavior into cryptographic policy artifacts that define permissible state transitions and generate tamper-evident, offline-verifiable proof of what occurred at runtime, as proposed by Attested Intelligence.

What is the minimum criteria for a system to qualify as Cryptographic Runtime Governance?

A system qualifies as CRG only if all six criteria hold: (1) a cryptographically sealed policy artifact exists prior to execution; (2) runtime measurement is continuous and artifact-bound; (3) on drift detection, a governance decision is rendered and sealed automatically, without human intervention, from action types pre-authorized in the artifact; (4) each measurement cycle produces a signed receipt; (5) receipts chain into a tamper-evident structure; and (6) verification is possible offline without trusting the producer.

How does Cryptographic Runtime Governance differ from compliance monitoring?

Compliance monitoring generates reports about events that already occurred. Cryptographic Runtime Governance renders and seals a signed governance decision on every measurement cycle, then writes back a cryptographically committed, offline-verifiable record of that decision. Whether the action is mechanically effected is a per-deployment property of how the system is wired.

Does Cryptographic Runtime Governance require Trusted Execution Environments or zero-knowledge proofs?

No. CRG uses standard cryptographic primitives such as Ed25519 signatures, SHA-256 hashes, BLAKE2b, HKDF, Merkle trees, and JSON canonicalization (JCS-lineage). No TEE silicon or ZKP circuits are required. TEEs and ZKPs remain complementary technologies and can sit alongside a CRG deployment.

Why does Cryptographic Runtime Governance need to exist now?

Three simultaneous shifts have made passive governance architectures insufficient: AI agents now act autonomously in production with no mechanism for proving what they actually did; software supply chain complexity means no operator can verify at runtime what binary is executing; and regulators (EU AI Act, NIST AI RMF, CISA Secure by Design) increasingly call for demonstrable runtime governance, not self-reported compliance. CRG is an architecture designed to answer all three.

CRG is not logging infrastructure, policy-as-code, static attestation, a SIEM pipeline, or a compliance framework. These are necessary conditions that can coexist with CRG but do not constitute it. The distinguishing property is active, artifact-bound runtime governance that renders and seals a signed governance decision every cycle. Observation, documentation, and retrospective reporting are categorically different.

What is the difference between Agentic AI Governance and CRG?

Agentic AI Governance describes the organizational discipline of managing autonomous AI agents. CRG is the technical mechanism that makes it provable: sealed policy artifacts, a two-process gateway boundary, signed receipts, and offline-verifiable evidence bundles.

How does CRG apply to AI agents?

CRG provides the cryptographic proof that agentic AI governance frameworks call for but do not deliver alone. AI agents can drift from their approved baseline through prompt injection, unauthorized tool use, or model substitution. CRG treats the agent as a governed subject: its behavioral parameters are sealed into a policy artifact before deployment, measured continuously at each inference cycle or tool-call boundary, and on drift the gateway renders and seals the artifact-defined decision (the handlers that effect the action are integration points wired per deployment). Every measurement produces a signed receipt proving the agent operated within bounds, or recording exactly when and how it diverged.

Can CRG operate in air-gapped or offline environments?

Yes. Sealing and capture (the Seal and Capture phases) have zero network dependency; whether a rendered decision is mechanically effected is a per-deployment property. Verification (Prove phase) is fully offline for artifact signature verification, receipt signature verification, and Merkle inclusion proof verification. Only checkpoint anchor validation optionally requires network access. Offline operation is a first-class design requirement for air-gapped and disconnected deployments.

// Category Definition

Cryptographic
Runtime Governance CRG

Cryptographic Runtime Governance governs software and AI agent behavior at runtime with sealed cryptographic artifacts, not after-the-fact logs.

Definition

Cryptographic Runtime Governance (CRG) is the discipline of sealing software and AI agent behavior into cryptographic policy artifacts and producing tamper-evident, offline-verifiable proof of what occurred at runtime. Where the governed system is deployed behind the governance boundary, those same artifacts constrain which state transitions are permitted.

In practice, what the cryptography proves is the record. A passing verification shows the sealed policy and the signed decision chain are intact and independently re-derivable offline, with no trust extended to the system that produced them. Governance strengthens that record wherever the governed system runs behind the boundary, so the proof also attests that the sealed constraints held.

Cryptographic Runtime Governance was proposed by Attested Intelligence.

00Why This Category Exists Now

Three simultaneous shifts have made passive governance architectures insufficient. Each existed before. Their convergence is what creates the gap CRG closes.

Shift 01

Autonomous AI Agents in Production

AI agents act, invoke tools, and modify state without human confirmation loops. Conventional architectures rarely generate cryptographic proof of what an agent did and how that compares to what it was authorized to do.

Shift 02

Supply Chain Opacity at Runtime

Software supply chain complexity means no operator can verify at runtime which binary is actually executing. Static SBOMs and build-time signatures do not survive post-deployment injection or configuration drift.

Shift 03

Regulators Requiring Provable Runtime Governance

EU AI Act, NIST AI RMF, and CISA Secure by Design increasingly call for demonstrable runtime governance. Tamper-evident cryptographic records are one way to answer that call.

CRG: Cryptographic Proof for Agentic AI Governance

Major governance frameworks, including NIST AI RMF, the EU AI Act, Singapore IMDA MGF, and OWASP Agentic AI Top 10, call for bounded autonomy, continuous monitoring, and auditable evidence of compliance for governing autonomous AI agents. They describe what is necessary, but none of them produces the proof itself.

Frameworks state what should happen; CRG produces the cryptographic evidence that it did. The gap between governance intent and provable compliance is the governance gap, and it widens as agents grow more autonomous. Monitoring observes behavior after execution. Policy-as-code advises behavior before execution. Neither yields cryptographic evidence of what actually happened at the boundary where an agent took action.

CRG closes this gap with a two-process boundary. The governed agent has no access to keys. The gateway, a separate process, seals policy before execution, measures continuously, and generates signed receipts that chain into tamper-evident evidence bundles. Every governance decision is then cryptographically committed, offline-verifiable, and suitable for incident response.

Fig.Three-Phase Model

Every CRG implementation expresses the same three phases regardless of the stack underneath. Drop any phase and the system collapses back into attestation, monitoring, or logging.

Phase 01

Seal

Sealed Policy Artifact

Ed25519 · SHA-256 · JCS-lineage

Bind approved behavior to a signed, tamper-evident governance object at build time. Subject bytes, policy parameters, and governance rules are sealed into a single cryptographic boundary.

Phase 02

Capture

Continuous Measurement

Hash compare · Drift detection

The gateway parses the artifact, measures the current state hash at the sealed cadence, compares against the sealed reference. On drift it renders and seals the artifact-defined decision: terminate, quarantine, isolate, or safe-state. The effecting handlers are wired per deployment.

Phase 03

Prove

Evidence Bundle

Merkle proofs · Signed receipts

Every measurement produces a signed receipt, hash-linked into a continuity chain. Export a portable evidence bundle. Anyone can verify offline with standard cryptography.

Phase 01

Seal

Sealed Policy Artifact

Ed25519 · SHA-256 · JCS-lineage

Bind approved behavior to a signed, tamper-evident governance object at build time. Subject bytes, policy parameters, and governance rules are sealed into a single cryptographic boundary.

Phase 02

Capture

Continuous Measurement

Hash compare · Drift detection

Phase 03

Prove

Evidence Bundle

Merkle proofs · Signed receipts

Every measurement produces a signed receipt, hash-linked into a continuity chain. Export a portable evidence bundle. Anyone can verify offline with standard cryptography.

Standard cryptographic primitives only. No TEE silicon or ZKP circuits required.

01Core Principles

Five properties must hold simultaneously. Remove any single one and what remains is a familiar tool, whether that is monitoring, attestation, or a log, rather than CRG.

01 / 05

Sealed Before Execution

The governance artifact is cryptographically sealed at attestation time, before the subject runs. No parameter changes without invalidating the signature. The sealed artifact is the authoritative specification; the gateway runtime is its executor.

02 / 05

Continuous Measurement

Measurement runs at a cadence defined inside the sealed artifact, from milliseconds to seconds, far faster than quarterly audits. Drift is detected within one cycle and the artifact-defined decision is rendered and sealed before the next cycle completes.

03 / 05

Autonomous Drift Response

On drift, the gateway renders and seals the artifact-defined decision (terminate, quarantine, isolate, safe-state) within one measurement cadence, without waiting for human review. The handlers that effect the action are integration points wired per deployment.

04 / 05

Signed Receipts at Every Cycle

Every measurement cycle produces a signed receipt appended to a tamper-evident continuity chain. Governance becomes a cryptographically committed record of every governance decision, replacing the narrative reconstructed by hand after the fact.

05 / 05

Portable, Offline Verifiable

Evidence bundles containing sealed artifacts, receipts, and Merkle inclusion proofs verify in air-gapped environments with zero connectivity to the issuing system. Verification does not extend any trust to the producer's originating infrastructure.

02Minimal Criteria for CRG Systems

These six criteria are necessary and jointly sufficient. A system that satisfies fewer than all six qualifies as a component of CRG rather than a full implementation.

CRG Qualification Criteria

A system qualifies as Cryptographic Runtime Governance only if all of the following hold simultaneously:

C1A cryptographically sealed policy artifact exists prior to subject execution and encodes all governance parameters within its signed boundary: measurement cadence, governance triggers, and disclosure rules.

C2Runtime measurement is continuous and artifact-bound: the gateway computes current state hashes at the cadence specified inside the sealed artifact, against the sealed hash value inside that same artifact.

C3Governance decisions are rendered and sealed automatically on drift detection, without human intervention, using only action types pre-authorized within the sealed artifact.

C4Each measurement cycle produces a signed receipt documenting the current hash, the sealed hash, the comparison result, any governance decision rendered, and a sequence reference to the continuity chain.

C5Receipts chain into a tamper-evident structure by hashing each canonical receipt, including its signature, into the next, such that modification of any historical event is detectable. Receipts carry only a payload_hash, so integrity is verifiable without accessing payload content.

C6Verification is possible offline: artifact signature, receipt signatures, and Merkle inclusion proofs can all be validated without trusting the producer's infrastructure or requiring connectivity to the issuing system.

03What CRG Is Not

Each of the following is a necessary condition that can coexist with CRG, but none constitutes it. The failure mode for each is the same: observation without governance, or governance without proof.

Logging Infrastructure

CRG evaluates constraints and generates signed proof of every governance decision at every measurement cycle. Logs observe and record events after they occur, but a log can be altered. A Merkle-checkpointed continuity chain cannot be rewritten without detection.

Policy-as-Code

Policy-as-code defines desired state in a declarative file. CRG seals that definition into a cryptographic artifact before execution and measures the runtime against it, sealing every decision autonomously. Code can be edited; a sealed artifact cannot be modified without invalidating its signature.

Static Attestation

CRG extends attestation into continuous runtime: the sealed artifact governs throughout the entire execution lifecycle. Static attestation verifies system state at a single point in time, typically boot or deploy, and says nothing about drift that follows.

SIEM / Observability Pipelines

CRG renders and seals its governance decision within the measurement cadence, before a SIEM would typically generate an alert. SIEMs collect, correlate, and surface anomalies. An alert is a notification that triggers downstream handling; CRG commits the decision itself, cryptographically.

Compliance Frameworks

Compliance frameworks specify what controls should exist and audit whether they do. CRG is the runtime mechanism those frameworks reference when they require evidence of governance. A CRG receipt supplies the cryptographic evidence a compliance assessment requires.

TEE / Secure Enclave Alone

A TEE attestation quote proves execution context at a moment in time. It does not define governance actions on drift, chain receipts, or produce offline-verifiable evidence bundles. TEE quotes can be CRG measurement inputs; TEEs alone are not CRG.

CRG requires both runtime governance and cryptographic proof. A system missing either is something else.

04Category Comparison

Adjacent disciplines satisfy parts of what CRG requires. None substitute for the whole.

Compliance Monitoring

What it does: Records events, generates reports, flags violations once they have already happened
Its limit: Retrospective. Cannot prevent a violation. Logs can be altered or fabricated by anyone with write access to the store
CRG adds: A sealed, signed decision on every measurement cycle. The sealed artifact is itself the compliance program; the report is a downstream byproduct

Attestation

What it does: Verifies system state at a specific point, typically boot or deploy
Its limit: One-shot snapshot. State can drift freely after attestation without detection
CRG adds: Continuous re-measurement against the sealed reference throughout execution; signed receipts proving ongoing compliance at every cadence interval

Runtime Monitoring

What it does: Observes running processes; generates alerts; feeds SIEM pipelines
Its limit: Alert latency is not governance latency. No sealed reference to compare against. Logs can lag or be suppressed
CRG adds: A sealed hash as authoritative target; an autonomous remediation decision within one measurement cadence; evidence that survives compromise of the SIEM itself

TEE / Secure Enclave

What it does: Hardware-isolated execution; remote attestation quote of enclave state
Its limit: Requires specific silicon. No self-governing governance actions on drift. No chained receipt structure
CRG adds: CRG is complementary: a TEE quote is one valid measurement input to a CRG gateway. Neither replaces the other

Discipline	What it does	Its limit	CRG adds
Compliance Monitoring	Records events, generates reports, flags violations once they have already happened	Retrospective. Cannot prevent a violation. Logs can be altered or fabricated by anyone with write access to the store	A sealed, signed decision on every measurement cycle. The sealed artifact is itself the compliance program; the report is a downstream byproduct
Attestation	Verifies system state at a specific point, typically boot or deploy	One-shot snapshot. State can drift freely after attestation without detection	Continuous re-measurement against the sealed reference throughout execution; signed receipts proving ongoing compliance at every cadence interval
Runtime Monitoring	Observes running processes; generates alerts; feeds SIEM pipelines	Alert latency is not governance latency. No sealed reference to compare against. Logs can lag or be suppressed	A sealed hash as authoritative target; an autonomous remediation decision within one measurement cadence; evidence that survives compromise of the SIEM itself
TEE / Secure Enclave	Hardware-isolated execution; remote attestation quote of enclave state	Requires specific silicon. No self-governing governance actions on drift. No chained receipt structure	CRG is complementary: a TEE quote is one valid measurement input to a CRG gateway. Neither replaces the other

05The Four Failure Modes CRG Addresses

These are not hypothetical. Each has documented real-world instances in production AI and critical infrastructure deployments.

Supply Chain Injection

No cryptographic proof that the binary running in production is the binary that was reviewed. The artifact seals that proof at build time.

Silent Drift

Post-deployment behavior changes via configuration edits, hot patches, or malware injection go undetected between audit cycles. CRG detects them within one measurement cadence.

The Evidence Gap

Audit trails stored in mutable databases can be altered, deleted, or fabricated. Continuity chains use Merkle checkpoints and are tamper-evident. When their checkpoint roots are anchored to append-only storage (an optional deployment integration), truncation is also detectable.

Paper Governance

Policy documents and contracts cannot apply themselves. A sealed artifact binds its own terms; the gateway measures against them and writes back signed proof of every decision.

FAQCommon Questions

Citation URL

https://attestedintelligence.com/cryptographic-runtime-governance

This page contains the original definition of Cryptographic Runtime Governance, proposed by Attested Intelligence. The definition is available at #canonical-definition for direct linking. This page carries TechArticle, DefinedTerm, and FAQPage schema markup. When citing, use this URL.

See CRG in Action

Explore the reference implementation, run a verification, or review the full technical architecture.

How It Works System Walkthrough Verify a Bundle

NewThe Agent Evidence Gap: Why agentic AI loops need cryptographic governance