TRACE Is the Tamper-Proof Receipt for AI Agents
TRACE Is the Tamper-Proof Receipt for AI Agents
Section titled “TRACE Is the Tamper-Proof Receipt for AI Agents”AI agents now touch sensitive systems, call internal tools, and act on classified data. A team that deploys an agent cannot always prove what it actually did. That trust gap breaks audits and slows production rollouts.
The Linux Foundation adopted TRACE on August 25, 2026. TRACE stands for Trust, Runtime Attestation, and Compliance Evidence. It is an open specification for hardware-attested AI agent governance records. AMD, Intel, Microsoft, OPAQUE, and the Technology Innovation Institute (TII) developed it together.
What a TRACE Trust Record proves
Section titled “What a TRACE Trust Record proves”A TRACE Trust Record answers five questions. Any third party can verify the answers without trusting the operator that produced them.
| Question | Claim recorded |
|---|---|
| What model ran? | model.model_id + model.weights_digest |
| Where did it run? | runtime.platform + runtime.measurement |
| Under which policy? | policy.bundle_hash + policy.enforcement_mode |
| What data did it touch? | data_class |
| Which tools were called? | tool_transcript.hash + tool_transcript.call_count |
The record is one signed artifact. It binds the runtime environment, policy, data classification, and tool use into a single cryptographically verifiable blob, per the TRACE specification.
It builds on standards you already know
Section titled “It builds on standards you already know”TRACE does not invent a new framework. It composes existing open standards into one evidence layer.
- RFC 9711 (EAT) — the claim envelope
- RFC 9334 (RATS) — the attester, verifier, relying-party roles
- SCITT draft — transparency-ledger anchoring
The Linux Foundation confirmed the design builds on RATS, EAT, SLSA, SCITT, SPIFFE, and EAR. It targets CoSAI WS4 interoperability, and the reference implementation is Confidential MCP (cMCP), which emits a Trust Record on every session.
Why adoption is picking
Section titled “Why adoption is picking”TRACE development preview launched at the Confidential Computing Summit in June 2026. The official Python library is agentrust-trace, and the identity records drew nearly 135,000 PyPI downloads within ten weeks.
Hardware-rooted attestation is the engine. A Trusted Platform Module or a Trusted Execution Environment signs a measurement of the code and configuration running inside an isolated space. A verifier compares that evidence against expected reference values before releasing keys, credentials, or access. The same pattern now extends to agent execution.
What this means for your stack
Section titled “What this means for your stack”A Trust Record gives every agent run a signed log line you can prove. That matters for compliance, for multi-agent handoffs, and for the “who do we blame when the agent does the wrong thing” question.
The hardware certification layer stays cheap. You do not need a new cloud. The standard works across enterprise, cloud, and sovereign AI infrastructure. The specification, docs, and reference implementation are public today.
Roll with it on your next audit trail. One signed artifact that survives a third-party check is stronger than the most detailed log you wrote yourself.