Skip to content

TRACE Is the Tamper-Proof Receipt for AI Agents

TRACE Is the Tamper-Proof Receipt for AI Agents

Section titled “TRACE Is the Tamper-Proof Receipt for AI Agents”

AI agents now touch sensitive systems, call internal tools, and act on classified data. A team that deploys an agent cannot always prove what it actually did. That trust gap breaks audits and slows production rollouts.

The Linux Foundation adopted TRACE on August 25, 2026. TRACE stands for Trust, Runtime Attestation, and Compliance Evidence. It is an open specification for hardware-attested AI agent governance records. AMD, Intel, Microsoft, OPAQUE, and the Technology Innovation Institute (TII) developed it together.

A TRACE Trust Record answers five questions. Any third party can verify the answers without trusting the operator that produced them.

QuestionClaim recorded
What model ran?model.model_id + model.weights_digest
Where did it run?runtime.platform + runtime.measurement
Under which policy?policy.bundle_hash + policy.enforcement_mode
What data did it touch?data_class
Which tools were called?tool_transcript.hash + tool_transcript.call_count

The record is one signed artifact. It binds the runtime environment, policy, data classification, and tool use into a single cryptographically verifiable blob, per the TRACE specification.

TRACE does not invent a new framework. It composes existing open standards into one evidence layer.

  • RFC 9711 (EAT) — the claim envelope
  • RFC 9334 (RATS) — the attester, verifier, relying-party roles
  • SCITT draft — transparency-ledger anchoring

The Linux Foundation confirmed the design builds on RATS, EAT, SLSA, SCITT, SPIFFE, and EAR. It targets CoSAI WS4 interoperability, and the reference implementation is Confidential MCP (cMCP), which emits a Trust Record on every session.

TRACE development preview launched at the Confidential Computing Summit in June 2026. The official Python library is agentrust-trace, and the identity records drew nearly 135,000 PyPI downloads within ten weeks.

Hardware-rooted attestation is the engine. A Trusted Platform Module or a Trusted Execution Environment signs a measurement of the code and configuration running inside an isolated space. A verifier compares that evidence against expected reference values before releasing keys, credentials, or access. The same pattern now extends to agent execution.

A Trust Record gives every agent run a signed log line you can prove. That matters for compliance, for multi-agent handoffs, and for the “who do we blame when the agent does the wrong thing” question.

The hardware certification layer stays cheap. You do not need a new cloud. The standard works across enterprise, cloud, and sovereign AI infrastructure. The specification, docs, and reference implementation are public today.

Roll with it on your next audit trail. One signed artifact that survives a third-party check is stronger than the most detailed log you wrote yourself.