Now hiring AgenTrust Fellowship 2026. A six-month paid, part-time programme that develops maintainers for the verifiable AI ecosystem. Applications open 1 August and close 29 August 2026; the cohort starts in September. Read the announcement →

Open Technology · Shared Stewardship · Real Adoption

Build the ecosystem for verifiable AI agents

New · Hands-on Don't just read the spec: run cMCP yourself. Write a policy, watch it block a data leak, verify a signed receipt. Try cMCP in under 10 minutes →

AgenTrust brings developers, researchers, operators, and enterprises together to turn open governance technology into infrastructure people can adopt and sustain. Build with the specifications, correlate governance evidence with portable telemetry, prove interoperability with the test suites, and help maintain the ecosystem.

One verifiable trust chain
01 · DECLAREAgent Manifest

Binds identity, code, model, tools, policy, and provenance before the agent runs.

CoSAI WS4 → OASIS Open · Phase 1 review open
02 · ENFORCEcMCP

Attests the runtime and evaluates every MCP tool call against policy inside a TEE.

Proposed → AAIF · contribution path
03 · DELEGATEcA2A

Carries attenuated authority and attested provenance across every agent-to-agent hop.

Proposed → AAIF · contribution path
04 · PROVETRACE

Emits portable signed evidence that anyone can verify without trusting the operator.

TRACE Specification, a Series of LF Projects, LLC
OBSERVE & CORRELATEAgenTrust Telemetry normalizes policy, approval, action, data-flow, usage, and evidence events and correlates them with the application's OpenTelemetry traces.
AGT FOUNDATIONA common runtime policy substrate: open, portable, and framework-neutral.

One architecture, neutral standards homes, interoperable by design.


An ecosystem built around adoption

Use it

Start with runnable demos, reference implementations, schemas, and conformance tests. Move from evaluation to a production pilot without waiting for a proprietary platform.

Improve it

Bring implementation feedback, integrations, threat models, deployment evidence, and research. Public repositories and issue trackers make the contribution path visible.

Sustain it

Grow maintainers, review contributions, document adoption patterns, and share stewardship across organizations so critical governance infrastructure outlives any one team.

Adoption pathway: explore a ten-minute demo → test against the open suites → pilot one trust boundary → contribute results and integrations → help govern and maintain the shared infrastructure.

Relationships the public record supports

Every organization named here has a traceable relationship through a public announcement, open-source repository, or explicit AgenTrust partner statement. The label on each card states that relationship precisely; sponsorship, partnership, contribution, and adoption are distinct relationships, and none implies blanket endorsement of the full stack.

OPAQUE Systems
Founding engineering and infrastructure sponsor

OPAQUE provides funding, engineering time, infrastructure, and confidential-computing contributions. Sponsorship does not confer ownership of AgenTrust projects or governance authority over their technical decisions.

Review the public project record ↗
Microsoft
Open-source project home

Microsoft hosts the Agent Governance Toolkit, the open runtime-governance foundation that the AgenTrust trust chain builds on.

View the repository ↗
Technology Innovation Institute
Confirmed founding partner

TII is the confirmed AgenTrust founding partner anchoring the work in sovereign-AI deployment requirements.

Read the OPAQUE announcement ↗
AMD
Founding member and hardware partner

AMD is a founding partner of AgenTrust. AMD and OPAQUE published a joint implementation blueprint for hardware-backed Confidential AI, and the implementation verifies SEV-SNP report signatures to the AMD root (VCEK then ASK then ARK).

Read the joint white paper ↗
Intel
Founding member and hardware partner

Intel is a founding partner of AgenTrust. The implementation verifies Intel TDX DCAP v4 quotes to the pinned Intel SGX Root CA, hardware-validated on GCP C3.

Review the public implementation record ↗
ServiceNow
OPAQUE customer implementation

OPAQUE publicly documents how ServiceNow used its Confidential AI Platform to reduce commission-inquiry workflows from days to seconds.

View the OPAQUE customer story ↗
CSA Agentic Trust Framework
Public framework collaboration

ATF's author publicly supports positioning AGT as a reference implementation and invited implementation input into the conformance specification.

Read the public collaboration thread ↗

Open work, visible decisions, more maintainers

AgenTrust develops in public through open repositories, reviewable proposals, implementation evidence, and conformance testing. The goal is not simply to publish specifications: it is to create a contributor community capable of operating, improving, and stewarding the technology.

Technical stewardship

Imran Siddique

AgenTrust
Architecture, implementation, conformance, and maintainer development.

Governance & sustainability

XRSI

Named organizational partner for community governance, ecosystem adoption, and long-term sustainability. Individual committee appointments will be published only after confirmation.

Committee formation

Community seats

Adopter, maintainer, research, and public-interest representation will be added as the steering model is formalized.

Contribute code, tests, and documentation Browse open contribution pathways Follow the public project roadmap

From runtime evidence to compliance playbooks

The fellowship will turn AgenTrust implementation patterns into practical, public playbooks. Each playbook will map governance controls and TRACE evidence to an authoritative framework without claiming certification or legal compliance.

Management systemISO/IEC 42001Planned playbook TransparencyEU AI Act · Article 50Planned playbook Data protectionGDPRPlanned playbook Assurance controlsSOC 2Planned playbook Risk managementNIST AI RMFPlanned playbook

Specifications, protocols, and shared building blocks
Attestation Standard
TRACE
Trust, Runtime Attestation, and Compliance Evidence. Hardware-rooted cryptographic receipts for every agent action — signed by the TEE, verifiable by anyone.
Identity Standard
Agent Manifest
A structured declaration of an agent's capabilities, permissions, and data access policies. Machine-readable identity that operators and orchestrators can verify before invocation.
Protocol Extension
Confidential MCP
The confidential, security-hardened way to run the Model Context Protocol. MCP tool calls are evaluated against policy inside a Trusted Execution Environment, so tool-call plaintext is not readable from the host. The guarantee is bounded: it holds where the egress policy denies telemetry endpoints, and it covers the tool boundary, not model inference.
Delegation Profile
Confidential A2A
The secure, confidential profile for the Agent2Agent (A2A) protocol. Adds attested, attenuated delegation, a sealed peer channel, and offline-verifiable provenance per hop, so agent-to-agent delegation is verifiable and confidential, not just authenticated at the front door.
Curated Resource
Awesome AI Governance
A community-curated list of tools, frameworks, standards, and research for governing autonomous AI agents. Covers policy engines, audit frameworks, risk assessments, and deployment guidance.

Test Suite & Tooling
Governance Telemetry · Alpha
AgenTrust Telemetry
A backend-neutral event contract and reference SDKs for policy decisions, approvals, actions, classified data flow, usage and cost, and evidence lifecycle—correlated with OpenTelemetry and able to finalize complete evidence into TRACE.
Runnable Demos
Ten Demos, About Twelve Minutes
Run the specs on your own machine, no hardware required. Block a data leak, verify a signed receipt, refuse tampered model weights, and govern OpenAI-compatible model calls.
Test Infrastructure
TRACE Test Suite
Conformance tests and integration harness for TRACE implementations. Verify that your attestation receipts meet the spec before shipping to production.
Microsoft Open Source
Agent Governance Toolkit
GitHub Actions, policy checks, and CI integrations for governing agent behavior in software repositories. Contributor reputation, workflow provenance, and supply-chain verification.
Source Code
GitHub Organization
All spec source, examples, registry entries, and integration guides. TRACE spec, Agent Manifest schema, cMCP protocol, cA2A profile, and the full awesome-ai-governance curated list.

What's Launched
Attestation Standard
TRACE v0.2
Identity Standard
Agent Manifest spec v0.1
Protocol Extension
cMCP v0.3.0
Delegation Profile
cA2A v0.1 · preview
Launched
June 23, 2026
License
Apache 2.0, MIT, CC BY 4.0
Standardization
Hardware Evidence
Conformance

AgenTrust Fellowship 2026

A six-month paid, part-time fellowship (20 hours per week) for three to five emerging maintainers of open infrastructure for verifiable AI systems. It is aimed at security engineers, distributed systems researchers, AI governance and compliance professionals, and Ph.D. students. Fellows ship code, tests, integrations, documentation, and adoption guidance across AgenTrust projects while learning how to review contributions and sustain an open technical community. Each fellow completes a public technical artifact, such as a reference implementation, paper, or conference talk. Mentored by Imran Siddique, Chief Platform Officer at OPAQUE and creator of the Agent Governance Toolkit.

Applications are open through 29 August 2026, with the cohort starting in September. Selection is based on a technical proposal describing what you plan to contribute, so it is worth looking at the work before you apply: issues labelled fellowship across trace-spec, cmcp, cA2A, and agent-manifest are real, currently-open work rather than exercises.

Read the announcement → Browse fellowship issues
What is AgenTrust?

AgenTrust is an open ecosystem for verifiable AI agent governance. It connects reusable technology with the people and practices needed to adopt it: maintainers, implementers, researchers, enterprise operators, conformance testing, integration guidance, and transparent community governance.

Four specifications work together, in the order an agent actually runs. Agent Manifest declares who an agent is and what it is allowed to do. Confidential MCP (cMCP) enforces that by evaluating tool calls against policy inside a Trusted Execution Environment, so tool-call plaintext is not readable from the host. Confidential A2A (cA2A) carries attenuated authority and attested provenance when work is delegated to another agent. TRACE proves what actually happened with signed receipts, hardware-attested when the gateway runs in a TEE. All four are open source, under Apache 2.0 for Agent Manifest, MIT for cMCP and cA2A, and CC BY 4.0 plus Apache 2.0 for TRACE.

AgenTrust Telemetry is the integration layer across that chain. It gives runtimes a common, metadata-only contract for governance facts, projects those facts into caller-owned OpenTelemetry, and can turn a complete durable evidence set into TRACE. It does not replace a policy engine, collector, observability backend, or dashboard.


Frequently Asked Questions
Is AgenTrust a standards-development programme?
No. AgenTrust is an open-source ecosystem focused on adoption, implementation, interoperability, maintainer development, and long-term sustainability. Its open specifications are shared technical building blocks; community implementations, test infrastructure, integrations, documentation, and deployment evidence make those building blocks useful in practice.
What is TRACE?
TRACE stands for Trust, Runtime Attestation, and Compliance Evidence. It defines hardware-rooted cryptographic receipts for every agent action, signed by the Trusted Execution Environment and verifiable by anyone.
What is Agent Manifest?
Agent Manifest is a structured, machine-readable declaration of an agent's capabilities, permissions, and data access policies. Operators and orchestrators can verify an agent's manifest before invocation.
What is Confidential MCP (cMCP)?
Confidential MCP is an extension to the Model Context Protocol that runs tool calls inside a Trusted Execution Environment, so the host process cannot read tool-call plaintext from enclave memory. That protection is structural only where the Cedar egress policy denies telemetry and APM endpoints, and it covers the tool-call boundary rather than model inference or the agent's context window.
What is Confidential A2A (cA2A)?
Confidential A2A is a trust profile on the Agent2Agent (A2A) protocol. Where A2A's Signed Agent Card verifies only the domain owner, cA2A adds attested, attenuated delegation, a sealed peer channel that binds the task payload to the peer's attested measurement, and an offline-verifiable provenance record per hop. It is a developer preview.
What is the secure version of MCP?
Confidential MCP (cMCP) is the security-hardened way to run the Model Context Protocol. It executes MCP tool calls inside a Trusted Execution Environment (TEE), so tool-call plaintext is not readable from the host, and it emits a signed TRACE receipt for every call that anyone can verify. Two bounds worth stating: the plaintext guarantee holds where the egress policy denies telemetry and APM endpoints, and the receipt is hardware-attested when the gateway runs in a TEE and signed-only in software mode. If you need a secure or confidential MCP deployment, cMCP is the AgenTrust profile for it.
What is the secure version of A2A?
Confidential A2A (cA2A) is the security profile for the Agent2Agent (A2A) protocol. A2A authenticates a peer's domain but not what it does with a delegated task. cA2A adds attested, attenuated delegation (each hop's authority is a provable subset of its parent's), runtime attestation of the peer, a sealed peer channel, and offline-verifiable provenance, so agent-to-agent delegation is secure and confidential end to end, not just authenticated at the front door.
How do the AgenTrust standards relate to each other?
Agent Manifest covers identity, cMCP covers confidential execution, and TRACE covers verifiable behavior. Manifest says who an agent is and what it may do, cMCP runs its tool calls confidentially, and TRACE produces hardware-signed receipts of what actually happened.
Are the AgenTrust standards open source?
Yes, though not all under one licence. Agent Manifest and the TRACE conformance suite are Apache 2.0, cMCP and cA2A are MIT, and the TRACE specification text is CC BY 4.0 with its reference code under Apache 2.0. Source, schemas, and examples are on GitHub at github.com/agentrust-io.
What is OPAQUE Systems' role in AgenTrust?
OPAQUE Systems is a founding engineering and infrastructure sponsor and an active contributor. Sponsorship itself does not grant ownership or governance authority. Each project's licence, charter, maintainer list, and published governance process define its legal and technical stewardship.