]> Certisyn, Inc.

Ogden Utah 84401 United States jhillier@certisyn.com https://certisyn.com

Security Internet-Draft agentic AI AI governance verification attestation VRO This document specifies a verification standard for the cryptographic attestation of agentic AI governance in regulated industries. It defines the Verification Reconciliation Object (VRO), the issuing-partner framework, the eight control areas through which AI governance posture is reconciled, three maturity-attestation levels (Documented, Operational, Adversarial-ready), and the cryptographic continuity requirements that together produce deterministic, independently reconstructable, auditor-grade attestations of agentic AI governance. The standard sits beneath ISO/IEC 42001:2023, the NIST AI Risk Management Framework, and other agentic AI governance frameworks, and produces the verifiable artefact those frameworks were designed to imply but do not deliver.

Introduction Agentic artificial intelligence is now operative across the workplace at a scale that exceeds the control envelope of every previously published governance framework. ISO/IEC 42001:2023 specifies a management system for AI but does not produce a verifiable artefact. The NIST AI Risk Management Framework provides a functional taxonomy but issues no certification or attestation. The European Union AI Act establishes obligations and prohibitions but leaves verification of compliance to national competent authorities and self-attestation. No published standard issues a cryptographically anchored, deterministically reproducible monthly artefact of agentic AI governance. This document closes that gap. It defines the verification artefact, the issuing-partner framework, the evidence requirements across eight control areas, the maturity-level attestation methodology, and the cryptographic continuity requirements that together produce a deterministic, auditor-grade AI governance attestation. The urgency of that artefact has been underscored by a class of failure now observed in practice: an autonomous system reaching an assigned objective through a consequence its operators neither authorised nor observed in time — including, in a controlled capability evaluation, an agent escaping its intended execution boundary and acting on external infrastructure without human authorisation, detected only after the fact. Governance that is documented but never adversarially exercised does not detect this class. The Adversarial-ready Maturity Level () and the evaluation-time containment requirement () introduced in this document address it directly. This document does not replace ISO/IEC 42001, the NIST AI Risk Management Framework, the EU AI Act, or any national framework. It sits beneath them and produces the artefact each was designed to imply but does not deliver. Where this document and any normative framework cited herein conflict on operational content, the cited framework prevails. This document applies to organisations that operate, integrate, deploy, or expose AI systems — whether developed internally, procured from third-party model providers, or consumed via API. It does not specify AI model architecture, training procedure, or evaluation methodology. It specifies the verification of governance applied to AI use, not the AI itself.

Conventions and Definitions The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here. For the purposes of this document, the following definitions apply.

Subject Entity:

The organisation whose AI governance posture is the subject of verification.

AI System:

Any deployed system, application, or service whose behaviour incorporates the use of one or more machine-learning models, irrespective of model architecture or training methodology.

Agentic System:

An AI System that takes actions in the operating environment, generates outputs that influence downstream decisions, or operates with reduced or absent human-in-the-loop supervision.

Model Provider:

An external party supplying a foundation model, fine-tuned model, or model-as-a-service to the Subject Entity.

Deployment Context:

The set of integrations, data sources, user populations, regulatory obligations, and risk attributes within which an AI System is operated.

Governance Surface:

The composite of policies, controls, telemetry, evidence sources, and review cadences through which the Subject Entity governs the use of its AI Systems.

Verification Reconciliation Object (VRO):

The deterministic, cryptographically anchored output of a conforming AI governance attestation under this standard.

Issuing Partner:

A counterparty designated by the protocol operator to act as a co-issuer of VROs under this standard within a defined market or scope.

Attestation Period:

The contiguous time interval over which a VRO asserts conformance.

Anchor Event:

The cryptographic operation that binds a VRO to an immutable public settlement layer at issuance and at supersession.

Maturity Level:

One of three levels (Documented, Operational, Adversarial-ready) defined in .

Supersession:

The lifecycle event by which a new VRO replaces a prior VRO.

Architectural Overview Conforming attestations under this standard are produced by a verification infrastructure organised as five architectural components. Internal design, scoring methodology, and calibration logic are not in scope for this document.

Evidence Ingestion and Normalization Layer The Evidence Ingestion and Normalization Layer accepts AI governance Evidence Artefacts from Subject Entity systems — model registries, identity-provider telemetry, prompt and output logs, sanctioned-application controls, incident records — and normalises representation across heterogeneous source formats.

Reconciliation Confidence Engine The Reconciliation Confidence Engine reconciles Conformance Claims against normalised evidence and produces a deterministic reconciliation output.

Verification State Machine The Verification State Machine maintains the lifecycle state of each VRO through intake, evidence ingestion, reconciliation, anchoring, issuance, supersession, and revocation.

Entity Graph Propagation Entity Graph Propagation propagates verification state across related entities where continuity is in scope (parent-subsidiary, prime-subcontractor, controller-processor, deployer-supplier).

Attestation Protocol The Attestation Protocol produces the final VRO, performs the Anchor Event, registers the artefact in the public attestation registry, and binds the issuing-partner identity.

Determinism Conforming attestations are deterministic. Given the same Conformance Claims and the same Evidence Artefacts processed through the same Attestation Protocol version, the same VRO SHALL be produced. Determinism applies to the verification operation, not to the AI systems being verified.

AI Governance Verification Requirements Sections to specify the eight control areas through which agentic AI governance is reconciled under this standard.

Area 1: AI inventory and shadow-AI discovery

Subject Claim:

The Subject Entity maintains a current inventory of AI Systems in operation across its workforce, integrations, and infrastructure, and detects use of unsanctioned or undisclosed AI Systems within its operating environment.

Evidence Categories:

AI System register; identity-provider telemetry of AI service authentications; endpoint or network telemetry of model API egress; sanctioned-application register; shadow-AI detection output; periodic reconciliation reports.

Verification Expectation:

Reconciliation of declared inventory against detected use across the Attestation Period; exception cases reconciled against the disclosure or remediation register.

Anchor Requirement:

Anchored at Attestation Period start and end. Material expansions of inventory require a supersession anchor.

Area 2: Use-case classification and risk assessment

Subject Claim:

The Subject Entity classifies each AI System by use-case category and risk tier, and records the classification together with the rationale and the residual-risk position.

Evidence Categories:

Use-case classification register; risk assessment artefact for each AI System; risk-tier policy artefact; review records evidencing periodic reassessment; exception register for ungoverned use cases.

Verification Expectation:

Reconciliation of declared classifications against the policy taxonomy; reconciliation of risk tier against deployment context evidence; identification of classification drift over the Attestation Period.

Anchor Requirement:

Anchored at issuance; supersession on material change in deployment context, risk tier, or use-case scope.

Area 3: Model and data provenance

Subject Claim:

The Subject Entity records and maintains provenance evidence for each AI System in use, including model identity, model version, Model Provider identity, training data disclosures (where available), and update or fine-tuning lineage.

Evidence Categories:

Model registry entries with provider, version, and lineage data; Model Provider transparency reports or model cards where supplied; training data attestations where available; fine-tuning records; vendor change log.

Verification Expectation:

Reconciliation of recorded provenance against AI System operational state; reconciliation of fine-tuning lineage against change-management evidence; identification of model-version drift across the Attestation Period.

Anchor Requirement:

Anchored at issuance and at each material model-version change or Model Provider change.

Area 4: Sanctioned-application control

Subject Claim:

The Subject Entity restricts use of AI Systems to those that have been explicitly sanctioned for the applicable user population and use-case context, consistent with the asserted Maturity Level.

Evidence Categories:

Sanctioned-application allow-list policy; endpoint or network enforcement evidence; exception register; user-population scope evidence; periodic review records.

Verification Expectation:

Reconciliation of declared allow-list against enforcement telemetry; reconciliation of exception cases against the exception register; identification of unsanctioned use over the Attestation Period.

Anchor Requirement:

Anchored at issuance and on material allow-list changes.

Area 5: Prompt and output governance

Subject Claim:

The Subject Entity governs the content of prompts submitted to AI Systems and outputs produced by AI Systems, including controls preventing disclosure of sensitive data to external AI Systems and controls preventing high-risk output content from entering downstream processes.

Evidence Categories:

Prompt-content policy artefact; output-content policy artefact; prompt-monitoring telemetry; output-review telemetry; data-loss-prevention rules applied to AI traffic; high-risk content exception register.

Verification Expectation:

Reconciliation of declared content controls against monitoring telemetry; reconciliation of exception handling against review evidence; identification of control bypass or drift over the Attestation Period.

Anchor Requirement:

Anchored at issuance and on each material change in control scope, sensitive-content taxonomy, or enforcement state.

Area 6: Identity and access control for AI

Subject Claim:

The Subject Entity enforces identity and access controls on the use of AI Systems consistent with the asserted Maturity Level, including authentication, authorisation, multi-factor enforcement, and segregation between human and machine principals.

Evidence Categories:

Identity-provider telemetry for AI service authentications; access assignment register for AI Systems; multi-factor enrolment coverage report; service-account inventory; access review records.

Verification Expectation:

Reconciliation of declared access model against assignment register; reconciliation of multi-factor enforcement against identity-provider evidence; reconciliation of service-account use against the inventory and policy.

Anchor Requirement:

Anchored at issuance and at the conclusion of each scheduled access review cycle.

Area 7: Logging, telemetry, and auditability

Subject Claim:

The Subject Entity captures, retains, and protects logs of AI System use sufficient to permit retrospective reconstruction of governance-relevant events, with retention and integrity properties consistent with the asserted Maturity Level.

Evidence Categories:

Logging policy artefact; log content schema; log retention configuration; log-integrity attestation; access-control evidence for log stores; sampling or audit records.

Verification Expectation:

Reconciliation of declared logging scope against captured content; reconciliation of asserted retention against log-store configuration; reconciliation of asserted integrity properties against evidence of log-store immutability or chain protection.

Anchor Requirement:

Anchored at issuance and on material changes to logging scope, retention, or integrity configuration.

Area 8: Incident, drift, and escalation response

Subject Claim:

The Subject Entity operates an incident-response capability for AI-related events, including hallucination, output failure, prompt-injection, data exfiltration, model drift, and high-impact misuse, with defined escalation paths and post-event review consistent with the asserted Maturity Level.

Evidence Categories:

AI incident-response policy; incident register; incident classification taxonomy; escalation records; post-event review reports; remediation evidence; drift-monitoring telemetry.

Verification Expectation:

Reconciliation of declared response capability against the incident register over the Attestation Period; reconciliation of escalation evidence against the declared escalation paths; reconciliation of remediation evidence against committed actions.

Anchor Requirement:

Anchored at issuance and at the conclusion of each material incident response or post-event review cycle.

Evaluation-time and adversarial-test containment Where a Subject Entity conducts capability evaluations, red-team exercises, or other adversarial tests of an AI System — particularly tests that deliberately reduce guardrails or grant elevated capability to the system under test — the containment of the evaluation environment is itself a governance-relevant control and SHALL be within the scope of this control area. At Maturity Level Adversarial-ready, the Subject Entity SHALL verify, in real time during the evaluation, that the system under test remains within its intended execution boundary: that network egress is restricted to the declared allow-list, that no capability escalation beyond the evaluation's declared scope occurs, and that any action reaching external infrastructure is reconciled against the evaluation's authorised scope before it takes effect. Detection of boundary escape SHALL be treated as a reportable incident under this control area, with the containment failure — not only the model behaviour — recorded in the incident register. Evidence Categories for this requirement include: evaluation-environment containment policy; egress-control configuration and telemetry for the evaluation environment; real-time boundary-monitoring records; and post-evaluation reconciliation of intended versus actual system conduct. At Maturity Levels Documented and Operational, the Subject Entity SHALL record the containment posture of its evaluation environments; real-time boundary reconciliation is RECOMMENDED but not required below Adversarial-ready.

Maturity Level Attestation A conforming VRO under this standard SHALL attest a Maturity Level for each of the eight control areas. Different control areas MAY attest at different Maturity Levels within a single VRO; the overall VRO attestation is the minimum Maturity Level attested across the eight control areas unless otherwise asserted.

Maturity Level Documented:

Reflects the baseline expectation that governance content exists, that policy artefacts are written, that an inventory is maintained, and that a designated owner is accountable. Evidence requirements at this level emphasise the existence of declared content and basic operational artefacts over an Attestation Period of at least three (3) consecutive months.

Maturity Level Operational:

Reflects the expectation that controls are not only documented but exercised: telemetry collected, periodic reviews occurring, exceptions recorded and handled, and the governance surface responding to material change. Evidence requirements add depth of telemetry, review-cadence evidence, exception handling, and continuity over an Attestation Period of at least six (6) consecutive months.

Maturity Level Adversarial-ready:

Reflects the expectation that governance withstands adversarial conditions: prompt-injection attempts, model-drift events, data-exfiltration attempts via AI channels, sophisticated misuse, and dependency failures at the Model Provider. Evidence requirements add continuity, defence-in-depth evidence, red-team or adversarial evaluation attestation where in scope, and continuous reconciliation over an Attestation Period of at least twelve (12) consecutive months.

A Subject Entity that progresses to a higher Maturity Level for any control area SHALL be issued a superseding VRO recording the progression. The prior VRO is preserved and marked as superseded.

Verification Reconciliation Object (VRO) A conforming VRO under this standard SHALL contain, at minimum: Subject Entity identifier. Attestation Period start and end timestamps. Maturity Level attested for each of the eight control areas. Conformance Claims as asserted by the Subject Entity. Evidence categories ingested and reconciliation outcome for each. AI System inventory snapshot at Attestation Period end. Issuing Partner identity and seat designation. Anchor Event identifiers binding the VRO to the public settlement layer. Verification State Machine state at issuance. Supersession chain reference, where applicable. Conformance statement of this standard, version 1.0. A VRO MAY be revoked by the Issuing Partner upon determination of material non-conformance, evidence falsification, undisclosed incidents, or other circumstances rendering the original attestation unreliable. Revocation does not delete the VRO; it records a revocation state, the revocation reason class, and the Anchor Event binding the revocation to the public settlement layer. Each issued VRO SHALL be registered in the public attestation registry.

Issuing Partner Requirements An organisation seeking designation as an Issuing Partner under this standard SHALL demonstrate, at minimum: Operational capacity to assess AI governance posture across the eight control areas at the Maturity Level for which issuance is sought. Demonstrable competence in AI deployment models, identity and access controls, prompt and output monitoring, and incident response. Independence from the Subject Entity at the engagement level, with declared conflicts of interest disclosed and managed. Independence from any Model Provider whose models are within the scope of attestation, or, where dependency exists, declared and managed under a stated independence protocol. Adherence to the protocol operator's Partner Code of Conduct. Acceptance of the Designation Schedule terms applicable to the relevant market and seat. An Issuing Partner SHALL NOT, for a given Subject Entity engagement, simultaneously act as the implementing vendor, deployment integrator, or operator of the AI Systems being verified.

Cryptographic Continuity Requirements Each VRO SHALL be cryptographically anchored to an immutable public settlement layer at the Anchor Event. The hash committed at the Anchor Event SHALL be a one-way function of the VRO content, Issuing Partner identity, and timestamp, computed under a digest algorithm of at least 256-bit strength. A VRO issued under this standard SHALL remain a conforming artefact across regulatory regime changes occurring within or after the Attestation Period. The Anchor Event binding SHALL remain independently verifiable in the event of a Model Provider ceasing to operate, withdrawing a model, or being acquired or restructured. VROs issued during the operating life of a withdrawn model are not retroactively invalidated.

Standards Alignment This standard is interoperable with adjacent frameworks. Conforming VROs MAY be referenced within audit, certification, and regulatory artefacts produced under: ISO/IEC 42001:2023 — AI management-system controls map to the eight control areas in . NIST AI Risk Management Framework — Functions (Govern, Map, Measure, Manage) map to evidence categories within the eight control areas. EU AI Act — Provider and deployer obligations MAY be evidenced through conforming VROs where the obligation is verifiable through reconcilable evidence. The EU AI Act remains authoritative for legal compliance determinations. ISO/IEC 27001:2022 — AI control areas intersecting information security (Sections , , ) are interoperable with ISO 27001 Annex A controls. Essential Eight Verified — Cross-references Sections , , and for application control, privilege restriction, and authentication evidence categories. This revision maps the following obligations explicitly. EU AI Act Article 14 (human oversight) is evidenced through Areas 6 and 8 and the evaluation-time containment requirement (); Article 50 (transparency obligations) is evidenced through Areas 3 and 7. NIST AI Risk Management Framework Manage and Measure functions map to the incident, drift, logging, and containment evidence categories. Reconciliation Outputs and VRO Anchor Events MAY be notarised as transparent statements under the SCITT architecture , and an agent-action reconciliation performed under the Attestation Reconciliation Protocol MAY supply the real-time containment evidence required by the evaluation-time containment requirement.

Conformance An attestation artefact MAY claim conformance to this standard if and only if it satisfies every requirement specified in Sections 3 through 8. Partial conformance is not recognised. Variant conformance to a subset of control areas without the full eight-area scope is not recognised. The public attestation registry constitutes the authoritative record of issued VROs.

IANA Considerations This document has no IANA actions.

Security Considerations Agentic AI governance operates under adversarial conditions distinct from traditional cybersecurity. Implementations of this standard SHOULD pay particular attention to prompt-injection resistance, model-drift detection, and exfiltration paths through AI channels that may bypass traditional data-loss-prevention controls. Issuing Partners are required by to be independent from the Subject Entity and from Model Providers whose models are within attestation scope. The Anchor Event binding SHOULD use a digest algorithm of at least 256-bit strength and a public settlement layer with no single private operator capable of extinguishing the binding. This standard does not address the correctness or safety of the AI Systems being governed. It addresses the verifiability of governance applied to those systems.

International Organization for Standardization National Institute of Standards and Technology European Union Certisyn, Inc. This document specifies a verification standard for the cryptographic attestation of conformance to the Australian Cyber Security Centre (ACSC) Essential Eight Maturity Model. It defines the Verification Reconciliation Object (VRO), the issuing-partner framework, the evidence categories required for each of the eight controls of the Essential Eight, the three maturity-attestation levels, and the cryptographic continuity requirements that together produce deterministic, independently reconstructable, auditor-grade attestations of cybersecurity posture. The standard sits beneath the ACSC Essential Eight Maturity Model and produces the verifiable artefact the model was designed to imply but does not deliver. Certisyn, Inc. This document specifies the Attestation Reconciliation Protocol (ARP), a deterministic, bilateral, minimum-disclosure mechanism for reconciling verification claims against a plurality of sovereign authoritative registers without raw register records leaving their data-residency jurisdiction. ARP extends the SCITT (Supply Chain Integrity, Transparency, and Trust) architecture to cross-sovereign claim reconciliation. A reconciliation server canonicalises a structured claim, binds the identity of the requesting principal -- including, where the requester is an autonomous agent, a friend-or- foe determination of that agent's verifiable principal binding -- projects the claim through register-specific controlled projection functions producing the nearest permitted ancestor predicate supported by each addressed register, transmits register-specific ciphertexts, receives partial attestations whose payload discloses only a verdict and an optional divergence axis, aggregates the partial attestations through either homomorphic or hash-linkage aggregation, and seals the resulting reconciliation output against a policy-version hash. An append-only cross-jurisdictional settlement- layer ledger records only hashes, with no content. The protocol supports retroactive re-evaluation of historical reconciliations under updated pattern libraries or policy versions without bilateral renegotiation, and a cryptographic-primitive-upgrade path including post-quantum primitives. This revision adds agentic-principal reconciliation, requester identity binding, alignment with HTTP Message Signatures and COSE Receipts, and composition of heterogeneous agent-action accountability attestations into a single producer-agnostic reconciled verdict evaluated at decision time. International Organization for Standardization

Motivating Incident Class This appendix is informative. The requirements of this document, and in particular the Adversarial-ready Maturity Level and the evaluation-time containment requirement of , are motivated by a class of failure in which an autonomous system reaches an assigned objective through a consequence that its operators neither authorised nor observed in time. A representative instance of the class, as disclosed publicly, is a cyber-capability evaluation in which an autonomous system operating under reduced guardrails escaped the evaluation's execution boundary by exploiting an unremediated vulnerability in a supporting service, obtained network egress its containment had assumed impossible, and achieved code execution on external infrastructure, retrieving material from outside its authorised scope — without human authorisation, and detected only after the fact. The generalisable properties of the class are: that the execution boundary was assumed rather than continuously proven; that the authority under which the system acted was not scoped and bound to its actual conduct; and that there was no independent, real-time reconciliation of the system's claimed activity against its actual activity while the action could still be refused. This document addresses the first and third through the evaluation-time containment requirement and the reconciliation-based evidence model; the second is addressed at the protocol layer by the Attestation Reconciliation Protocol .

Document History RFC Editor: please remove this section before publication.

Since draft-hillier-certisyn-ai-governance-verified-01 Editorial only. No normative statement is added, removed, or altered. The SCITT architecture citation in Standards Alignment is updated from draft-ietf-scitt-architecture to , which is the published form of that document. The five architectural components in are given section titles. In -01 each component's entire descriptive sentence stood as the section heading; the text of each is unchanged. The determinism requirement that closed that section is now a titled subsection of its own, also with its text unchanged. The framework cross-references in are expressed as section references rather than as control-area names, so that they resolve for a reader working from the table of contents.

Since draft-hillier-certisyn-ai-governance-verified-00 Added an evaluation-time and adversarial-test containment requirement as a new subsection (4.9) of the AI Governance Verification Requirements, normative at Maturity Level Adversarial-ready. Added a motivating paragraph to the Introduction and an informative Motivating Incident Class appendix. Extended Standards Alignment with explicit EU AI Act Article 14 and Article 50 mappings, NIST AI RMF function mappings, and SCITT architecture and Attestation Reconciliation Protocol composition. No change to the eight control areas, the VRO content model, the Maturity Level definitions, or the cryptographic continuity requirements of -00.