Control mappings.
How Cryptographic Runtime Governance maps to NIST, SSDF, and CoSAI controls.
Six proposed minimum criteria.
Six minimum criteria the foundational paper proposes for standardizing the Attested Governance category. We offer them as a starting point for the community to refine, and we welcome other designs that satisfy them. Source: “Attested Governance: Runtime Integrity for Autonomous Systems”, §6.4.
Sealed reference states
ImplementedCriterionProduce cryptographically sealed, signature-bound artifacts binding subject identity, policy reference, and governance parameters, where any modification is cryptographically detectable.
AGA satisfiesPolicy Artifact: Ed25519-signed sealed reference with a composite hash over subject identity (bytes commitment + canonicalized metadata), policy reference, and governance parameters. Tamper-evident after seal; any modification invalidates the signature.
Paper §6.4 C1
Continuous runtime measurement
ImplementedCriterionPerform continuous measurement of runtime state against the sealed reference at a policy-specified cadence, producing a signed cryptographic commitment for each measurement.
AGA satisfiesgateway: continuous measurement at policy-specified cadence, implemented in the reference implementation (available under evaluation access; the published npm package ships a 1000ms default plus on-demand measurement tools). Each measurement produces a signed receipt over canonicalized payload, appended to the continuity chain.
Paper §6.4 C2
Tiered verification levels
PartialCriterionSupport tiered verification calibrated to deployment consequence, with the tier expressed in receipt metadata so relying parties can apply appropriate confidence thresholds.
AGA satisfiesBronze, Silver, and Gold tiers are specified. Gold-equivalent verification through Merkle-checkpointed evidence bundles is implemented today. The explicit tier-metadata fields and Bronze and Silver paths remain spec'd architecture; they are not yet instantiated in the reference codebase.
Paper §6.4 C3
Offline-verifiable evidence bundles
ImplementedCriterionProduce evidence bundles verifiable using standard cryptographic primitives and the issuing authority's public key alone, without network connectivity to the producing system.
AGA satisfiesEvidence bundles verified using Ed25519, SHA-256, and the issuing authority's public key. The Offline Verifier (open-source, runs in the browser) requires no network connectivity to the producing system. Air-gap compatible.
Paper §6.4 C4
Standardized artifact formats
ImplementedCriterionUse machine-parseable, cryptographically interoperable artifact formats that a common verifier procedure can validate identically across multiple independent implementations.
AGA satisfiesJCS-lineage JSON canonicalization, Ed25519 (RFC 8032), SHA-256 and BLAKE2b-256 (RFC 7693). Six verifier configurations across three toolchains (JavaScript, Go, Python) render identical verdicts on all 57 cross-stack conformance cases; the spec's canonical vectors pin byte-for-byte canonical output.
Paper §6.4 C5
Policy-constrained disclosure with cryptographic evidence
ImplementedCriterionSupport structured disclosure of governed evidence under policy constraint, producing cryptographic evidence of what was disclosed, what was withheld, under what policy version, and with what rationale.
AGA satisfiesPolicy-gated disclosure with three modes shipped: PROOF_ONLY (boolean attestation), REVEAL_MIN (bucketed values), and REVEAL_FULL (complete values). Signed substitution receipts record the original claim id, substitute id, policy version, and reason code. An inference-risk check runs before any disclosure.
Paper §6.4 C6
Receipt specification.
The governance receipt is a 15-field record, canonicalized with a JCS-lineage scheme, Ed25519-signed without its signature field, and hash-chained to its predecessor. Receipts package into an evidence bundle with Merkle proofs that a conformant verifier validates in six checks, seven with a pinned issuer key. The full schema, canonicalization rules, algorithm identifiers, and cross-language conformance results live on the specification page.
15
Receipt fields
6
Verification checks
57
Classical vectors
+28
Post-quantum vectors
NIST AI RMF 1.0
AI Risk Management Framework (NIST AI 100-1)
| Control | Requirement | Mechanism | Evidence Field(s) | Verification Step |
|---|---|---|---|---|
| GOVERN 1.1 | Policies established | Policy reference hash in governance receipts | receipt.policy_reference | Verify policy_reference matches expected configuration hash |
| GOVERN 1.3 | Oversight mechanisms | Signed governance receipt chain | receipt.decision, receipt.previous_receipt_hash | Verify receipt signatures, validate chain continuity |
| MAP 1.5 | Risk documented | Evidence bundle with Merkle root commitment | bundle.merkle_root, bundle.policy_reference | Verify Merkle proofs, confirm bundle consistency |
| MAP 3.1 | Benefits/costs assessed | Receipt chain analysis (PERMITTED vs DENIED ratios) | receipt.decision, receipt.reason | Count decisions by type, analyze denial reasons |
| MEASURE 2.3 | Effectiveness tracked | Timestamped receipt chain with tool-level decisions | receipt.tool_name, receipt.decision, receipt.timestamp | Verify receipt signatures, analyze decision patterns over time |
| MEASURE 2.6 | Feedback incorporated | Policy reference versioning across bundles | bundle.policy_reference (changes across bundle versions) | Compare policy_reference across sequential bundles |
| MANAGE 2.4 | Incidents documented | DENIED receipts with reason codes | receipt.decision: DENIED, receipt.reason | Filter denied receipts, verify signatures, analyze reasons |
| MANAGE 4.1 | Risk response deployed | Evidence of denied tool calls | receipt.decision: DENIED, receipt.tool_name | Verify denial receipts exist for high-risk tools |
Evidence Artifact Summary
Policy Artifact provides:
- Governance policy establishment (GOVERN)
- Baseline configuration (CM-2)
- Security requirements (PO.1.1)
Governance Receipt provides:
- Event logging (AU-2)
- Non-repudiation (AU-10)
- Incident documentation (MANAGE)
Continuity Chain provides:
- Audit protection (AU-9)
- Change control (CM-3)
- Effectiveness tracking (MEASURE)
Evidence Bundle provides:
- Offline verification capability
- Outside audit support
- Portable evidence packaging