The Governance Audit Record (GAR) for Agentic AI Systems
draft-sato-soos-gar-08
This document is an Internet-Draft (I-D).
Anyone may submit an I-D to the IETF.
This I-D is not endorsed by the IETF and has no formal standing in the
IETF standards process.
| Document | Type | Active Internet-Draft (individual) | |
|---|---|---|---|
| Author | Tom Sato | ||
| Last updated | 2026-09-07 | ||
| RFC stream | (None) | ||
| Intended RFC status | (None) | ||
| Formats | |||
| Additional resources |
Additional Web Page
|
||
| Stream | Stream state | (No stream defined) | |
| Consensus boilerplate | Unknown | ||
| RFC Editor Note | (None) | ||
| IESG | IESG state | I-D Exists | |
| Telechat date | (None) | ||
| Responsible AD | (None) | ||
| Send notices to | (None) |
draft-sato-soos-gar-08
Network Working Group T. Sato
Internet-Draft MyAuberge K.K.
Intended status: Standards Track 7 September 2026
Expires: 7 March 2027
The Governance Audit Record (GAR) for Agentic AI Systems
draft-sato-soos-gar-08
Abstract
This document specifies the Governance Audit Record (GAR), the audit
architecture for agentic AI systems. GAR defines five audit types,
the Session Audit Record (SAR), the Audit Alert system, auditor
principal categories, and the Audit Package for external regulatory
inspection. GAR provides verifiable evidence that AI agent sessions
were governed in accordance with the Intent Declaration Primitive and
the Human Escalation Mechanism. GAR answers the governance question:
can any of this be proven to a regulator? GAR is a domain-specific
application of the SCITT (Supply Chain Integrity, Transparency and
Trust) architecture extended with causal ordering semantics for
agentic governance events. GAR defines the Authority Lifecycle Event
(ALE) category: a normative set of causally-ordered event types
covering the complete agent session revocation and recovery
lifecycle, including single-agent revocation, authority suspension,
partial state recording, recovery initiation, credential restoration,
and multi-agent delegation tree events.
Version -03 adds the SOOS Governance Semantic Convention: the
normative soos.governance.* OpenTelemetry attribute namespace for
governance observability, the SOOS GAR Processor specification for
OTel-to-SAR pipeline construction with Session Block Merkle
integrity, four new Authority Lifecycle Events, three mandatory
provenance fields on Cedar evaluation records, and the XPID mirror
field on ACD session ALEs.
Version -04 made the Session Block construction rules more explicit,
closing three ambiguities found during independent interop
verification at the IETF 126 Hackathon.
Version -05 supersedes -04's Session Block construction text with a
corrected construction: the Merkle leaf and internal-node hashes are
now domain-separated (RFC 9162's Merkle Tree Hash, with 0x00/0x01
prefix octets) and odd-length levels use RFC 9162's k-split recursive
tree shape rather than duplicate-node padding, closing a malleability
class structurally equivalent to CVE-2012-2459 that was present in
-04's construction. This revision is fully self-contained: unlike
-03 and -04, it does not carry forward unreproduced text from an
Sato Expires 7 March 2027 [Page 1]
Internet-Draft GAR for Agentic AI Systems September 2026
earlier version. Version -05 also adds a subject_digest field to
Cedar-evaluation GAR records, the same construction used by the Agent
Accountability Composition as its cross-slot join key, positioning
GAR as a conforming AEP instance under the RATS-bound composition;
the field is normatively scoped to prohibit independent re-
serialization where an upstream party has already established the
action's canonical serialization, per the failure mode documented in
the SCITT typed-reference specification.
Version -06 closes gaps surfaced by a WIMSE-style security review
pass against -05's own text and reference sample code: a JWKS trust-
anchor bootstrap requirement, a corrected key-compromise remediation
procedure that no longer requires re-signing already-committed audit
artifacts, an explicit Level 1/2 residual-risk disclosure for a
compromised-but-signing GEC, a defined failure path for KIA signer
quorum failure at Session Block close, referential-integrity
enforcement for causal_parent_id, and guidance against alert-fatigue
false positives in session_sequence_number gap detection. This
revision also carries an idnits repair pass covering reference
classification, citation hygiene, and formatting.
Version -08 is an editorial revision with no normative content
changes: nine sibling-draft citations had gone stale against
those drafts' current live versions and are updated to
draft-sato-soos-idp-06, draft-sato-soos-hem-07,
draft-sato-soos-cap-06, draft-sato-soos-sov-03,
draft-sato-soos-mjwt-06, draft-sato-soos-mad-05,
draft-sato-soos-kia-06, draft-sato-soos-cap-rrs-04, and
draft-sato-soos-acd-02 respectively.
Status of This Memo
This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet-
Drafts is at https://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
This Internet-Draft will expire on 7 March 2027.
Copyright Notice
Copyright (c) 2026 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents (https://trustee.ietf.org/
license-info) in effect on the date of publication of this document.
Please review these documents carefully, as they describe your rights
and restrictions with respect to this document. Code Components
Sato Expires 7 March 2027 [Page 2]
Internet-Draft GAR for Agentic AI Systems September 2026
extracted from this document must include Revised BSD License text as
described in Section 4.e of the Trust Legal Provisions and are
provided without warranty as described in the Revised BSD License.
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 5
2. Conventions and Definitions . . . . . . . . . . . . . . . . . 6
3. Architecture Overview . . . . . . . . . . . . . . . . . . . . 10
4. Audit Types . . . . . . . . . . . . . . . . . . . . . . . . . 10
4.1. Type 1 -- GEC Self-Audit . . . . . . . . . . . . . . . . 10
4.2. Type 2 -- Session-Close Audit . . . . . . . . . . . . . . 11
4.3. Type 3 -- Event-Triggered Alert . . . . . . . . . . . . . 11
4.4. Type 4 -- Scheduled Audit . . . . . . . . . . . . . . . . 11
4.5. Type 5 -- On-Demand External Audit . . . . . . . . . . . 11
5. Auditor Principal Categories . . . . . . . . . . . . . . . . 12
5.1. HEM Principal . . . . . . . . . . . . . . . . . . . . . . 12
5.2. Audit Principal . . . . . . . . . . . . . . . . . . . . . 12
5.3. Verified External Auditor . . . . . . . . . . . . . . . . 12
5.4. GEC Self-Auditor . . . . . . . . . . . . . . . . . . . . 13
6. Session Audit Record . . . . . . . . . . . . . . . . . . . . 13
6.1. SAR Generation . . . . . . . . . . . . . . . . . . . . . 13
6.2. SAR Schema . . . . . . . . . . . . . . . . . . . . . . . 14
6.3. SAR Signing . . . . . . . . . . . . . . . . . . . . . . . 18
6.4. SAR Retention . . . . . . . . . . . . . . . . . . . . . . 18
7. Audit Alert System . . . . . . . . . . . . . . . . . . . . . 18
7.1. Alert Generation . . . . . . . . . . . . . . . . . . . . 18
7.2. Alert Schema . . . . . . . . . . . . . . . . . . . . . . 18
7.3. Normative Trigger List . . . . . . . . . . . . . . . . . 19
7.4. Alert Delivery . . . . . . . . . . . . . . . . . . . . . 20
8. Event Log Requirements . . . . . . . . . . . . . . . . . . . 20
8.1. IDP Audit Events . . . . . . . . . . . . . . . . . . . . 21
8.2. HEM Audit Events . . . . . . . . . . . . . . . . . . . . 21
8.3. GAR Audit Events . . . . . . . . . . . . . . . . . . . . 22
8.4. CAP Audit Events . . . . . . . . . . . . . . . . . . . . 24
8.5. ALE Audit Events . . . . . . . . . . . . . . . . . . . . 24
8.6. Mandatory Provenance Fields on Cedar Evaluation
Records . . . . . . . . . . . . . . . . . . . . . . . . . 26
8.7. XPID Mirror Field . . . . . . . . . . . . . . . . . . . . 28
9. Audit Package . . . . . . . . . . . . . . . . . . . . . . . . 28
9.1. Package Composition . . . . . . . . . . . . . . . . . . . 28
9.2. Package Schema . . . . . . . . . . . . . . . . . . . . . 28
9.3. Access Control . . . . . . . . . . . . . . . . . . . . . 29
10. SCITT Integration . . . . . . . . . . . . . . . . . . . . . . 30
10.1. Relationship to SCITT . . . . . . . . . . . . . . . . . 30
10.2. SAR as SCITT Signed Statement . . . . . . . . . . . . . 32
10.3. Audit Package SCRAPI Submission . . . . . . . . . . . . 32
10.4. Conformance Level Requirements . . . . . . . . . . . . . 33
Sato Expires 7 March 2027 [Page 3]
Internet-Draft GAR for Agentic AI Systems September 2026
11. EU AI Act Applicability . . . . . . . . . . . . . . . . . . . 33
11.1. Article 12 Mapping . . . . . . . . . . . . . . . . . . . 33
12. Authority Lifecycle Events . . . . . . . . . . . . . . . . . 34
12.1. ALE Design Principles . . . . . . . . . . . . . . . . . 34
12.2. ALE Causal Ordering Model . . . . . . . . . . . . . . . 35
12.3. ALE-001: ALE_SESSION_REVOKED . . . . . . . . . . . . . . 36
12.4. ALE-002: ALE_AUTHORITY_SUSPENDED . . . . . . . . . . . . 36
12.5. ALE-003: ALE_PARTIAL_STATE_RECORDED . . . . . . . . . . 37
12.6. ALE-004: ALE_RECOVERY_INITIATED . . . . . . . . . . . . 37
12.7. ALE-005: ALE_PARTIAL_STATE_DISPOSITION . . . . . . . . . 38
12.8. ALE-006: ALE_CREDENTIAL_RESTORED . . . . . . . . . . . . 38
12.9. ALE-007: ALE_KIA_REATTESTATION_COMPLETED . . . . . . . . 38
12.10. ALE-008: ALE_AUTHORITY_RESTORED . . . . . . . . . . . . 39
12.11. ALE-009: ALE_DELEGATION_CHILD_REVOKED . . . . . . . . . 39
12.12. ALE-010: ALE_CLUSTER_PARTIAL_REVOCATION . . . . . . . . 40
12.13. ALE-011: ALE_SIBLING_REVOCATION_NOTICE . . . . . . . . . 40
12.14. ALE-012: ALE_DELEGATION_TREE_RECOVERY_INITIATED . . . . 41
12.15. ALE-NEW-01: CAP_CONSENT_EXCEPTION_ACTIVATED . . . . . . 41
12.16. ALE-NEW-02: CAP_CATALOG_CONFLICT_DETECTED . . . . . . . 42
12.17. ALE-NEW-03: CATALOG_VERSION_CONFLICT . . . . . . . . . . 43
12.18. ALE-NEW-04: INTERPRETATION_SUPERSEDED . . . . . . . . . 44
12.19. ALE-NEW-05: CATALOG_VERSION_CONFLICT_RESOLVED . . . . . 45
12.20. ALE-NEW-06: INTERPRETATION_SUPERSEDED_RESOLVED . . . . . 46
13. SOOS Governance Semantic Convention (OTel) . . . . . . . . . 46
13.1. Purpose and Design Rationale . . . . . . . . . . . . . . 46
13.2. soos.governance.* Core Attributes . . . . . . . . . . . 47
13.3. soos.cap.* Cedar Policy Attributes . . . . . . . . . . . 48
13.4. soos.acd.* ACD Handshake Attributes . . . . . . . . . . 49
13.5. soos.consent.* Consent Governance Attributes . . . . . . 50
13.6. soos.mandate.* Mandate Scope Attributes . . . . . . . . 50
13.7. soos.gar.* Integrity Attributes . . . . . . . . . . . . 50
13.8. OTel Pipeline Trust Model . . . . . . . . . . . . . . . 51
14. SOOS GAR Processor . . . . . . . . . . . . . . . . . . . . . 52
14.1. Purpose . . . . . . . . . . . . . . . . . . . . . . . . 52
14.2. Processing Pipeline . . . . . . . . . . . . . . . . . . 52
14.3. Session Block Construction . . . . . . . . . . . . . . . 53
14.4. Tamper Evidence Model . . . . . . . . . . . . . . . . . 56
14.5. FROST Threshold Signing . . . . . . . . . . . . . . . . 57
14.6. SCITT Alignment . . . . . . . . . . . . . . . . . . . . 57
15. Security Considerations . . . . . . . . . . . . . . . . . . . 58
16. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 63
16.1. GAR Audit Alert Triggers Registry . . . . . . . . . . . 63
16.2. GAR Auditor Principal Types Registry . . . . . . . . . . 64
16.3. GAR Authority Lifecycle Event Types Registry . . . . . . 65
16.4. GAR OTel Attribute Namespaces Registry . . . . . . . . . 66
17. References . . . . . . . . . . . . . . . . . . . . . . . . . 67
17.1. Normative References . . . . . . . . . . . . . . . . . . 67
17.2. Informative References . . . . . . . . . . . . . . . . . 69
Sato Expires 7 March 2027 [Page 4]
Internet-Draft GAR for Agentic AI Systems September 2026
Appendix A. Vibe Coding Assets . . . . . . . . . . . . . . . . . 70
Appendix B. Changes from Previous Versions . . . . . . . . . . . 71
Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 75
1. Introduction
Agentic AI systems require governance across four questions:
o What did the agent intend before acting?
[I-D.sato-soos-idp] -- The Intent Declaration Primitive (IDP)
for Agentic AI Systems
o Who governed the agent's decisions?
[I-D.sato-soos-hem] -- The Human Escalation Mechanism (HEM)
for Agentic AI Systems
o Were those decisions within the law?
[I-D.sato-soos-cap] -- The Constitutional AI Protocol (CAP)
for Agentic AI Systems
o Can any of this be proven to a regulator?
This document -- The Governance Audit Record (GAR) for Agentic
AI Systems
GAR is the evidentiary layer of this protocol family. IDP, HEM, and
CAP generate governance events; GAR specifies how those events are
collected, synthesized, signed, and made available for audit.
If you are building an agentic AI system today, the absence of a
standard audit record format means that when something goes wrong,
you cannot prove to a regulator, insurer, or audit firm what your
agent decided or whether that record was tampered with after the
fact. GAR closes this gap by specifying a non-suppressible,
causally-ordered, GEC-signed audit stream that survives adversarial
conditions and is anchored to a SCITT transparency log. Without it,
your agent's governance record is a log file -- deletable, editable,
and legally worthless.
SA-13 adds the Authority Lifecycle Event (ALE) category to GAR. ALE
events record the complete authority lifecycle of an agent session:
from initial revocation through partial state recording, human
review, recovery initiation, credential restoration, and authority
reinstatement. This lifecycle corresponds to the right half of the
revocation-recovery protocol that CAEP's session-revoked signal
leaves unspecified. ALE events are causally ordered via
prior_event_id fields and form an independently auditable chain
alongside the session's Event Log. The ALE schemas are defined in
Section 12. Multi-agent topology events (ALE-009 through ALE-012)
Sato Expires 7 March 2027 [Page 5]
Internet-Draft GAR for Agentic AI Systems September 2026
extend the single-agent lifecycle to cover delegation tree
revocation, cluster achievability collapse, and sibling revocation
notification.
The architectural property GAR enforces is non-suppressibility: the
Governing Enforcement Component (GEC) MUST generate audit artifacts
automatically, MUST sign them, and MUST NOT allow any agent,
application, or principal to suppress, modify, or delete them. This
property -- the GEC cannot suppress bad news from its principals --
is the foundation of accountable AI governance.
GAR defines five audit types ranging from continuous GEC self-audit
(Type 1) to on-demand external regulatory inspection (Type 5). The
Session Audit Record (SAR) is the primary audit artifact: a complete,
GEC-signed record of every governance event in a session, generated
automatically at session close.
The SAR is a candidate SCITT Signed Statement
[I-D.ietf-scitt-architecture]. Section 10 specifies the SCITT
integration: how SARs are submitted to a SCITT transparency log and
how Audit Packages are submitted via SCRAPI. At Level 3 GEC
conformance, SCITT submission is REQUIRED.
This specification is a companion to [I-D.sato-soos-idp],
[I-D.sato-soos-hem], [I-D.sato-soos-cap], [I-D.sato-soos-sov],
[I-D.sato-soos-mjwt], [I-D.sato-soos-kia], [I-D.sato-soos-mad],
[I-D.sato-soos-cap-rrs], and [I-D.sato-soos-acd]. Readers should
be familiar with those documents before reading this document.
2. Conventions and Definitions
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
"OPTIONAL" in this document are to be interpreted as described in
BCP 14 [RFC2119] [RFC8174] when, and only when, they
appear in all capitals, as shown here.
The following terms are defined in this document or inherited from
companion specifications:
Audit Principal:
A registered principal with read-only access to governance audit
artifacts. Distinct from a HEM Principal. Receives Audit Alerts
and reviews Session Audit Records.
Governing Enforcement Component (GEC):
As defined in [I-D.sato-soos-idp]: a runtime component that
enforces authorization policy, records agent actions to a tamper-
Sato Expires 7 March 2027 [Page 6]
Internet-Draft GAR for Agentic AI Systems September 2026
evident Event Log, and mediates agent access to governed objects.
The GEC may be implemented as an application-layer library
(Level 1), an isolated process or sidecar (Level 2), or an
attested hardware execution environment (Level 3). See
[I-D.sato-soos-idp] Section 9 for conformance level definitions.
GEC-signed:
A record signed by the Governing Enforcement Component using the
signing key appropriate to its conformance level. The JSON field
name kernel_signature is preserved for wire-format compatibility.
The label field within kernel_signature MUST indicate the GEC's
conformance level (L1, L2, or L3).
Governance Audit Record (GAR):
The audit architecture specified in this document, comprising five
audit types, the SAR, the Audit Alert system, and the Audit
Package.
GEC Self-Auditor:
An architectural property of the GEC, not a human role. The GEC
evaluates its own Event Log after every commitment and generates
KERNEL_AUDIT_ANOMALY entries when inconsistencies are detected.
IDP Commitment Gap:
A condition detected by the GEC when an agent's actual state
transition does not match the agent's declared IDP commitment.
Classified as a critical audit finding.
IDP Commitment Verification Record:
A GEC-generated record produced after every governed state
transition, recording whether the agent's action matched its IDP
commitment.
Rationale Store:
A GEC-managed object store, separate from the Event Log, holding
Policy Rationale Declaration (PRD) objects and Decision Rationale
Records (DRR) indexed by their respective identifiers.
Session Audit Record (SAR):
A GEC-generated, GEC-signed summary of all governance events in a
session, produced automatically at session close.
Sovereign Object (SO):
As defined in [I-D.sato-soos-sov]: a causally ordered, policy-
governed, typed, living document that evolves through a predefined
finite state space under GEC authority.
Verified External Auditor:
Sato Expires 7 March 2027 [Page 7]
Internet-Draft GAR for Agentic AI Systems September 2026
A regulator, accounting firm, or other external party granted
time-limited, scope-limited read access to GEC audit artifacts by
the operator. Produces an Audit Package.
Authority Lifecycle Event (ALE):
A GAR event category introduced in Section 12. ALE events record
the authority status lifecycle of an agent session: revocation,
suspension, partial state, recovery, credential restoration, and
authority reinstatement. ALE events are causally ordered via
prior_event_id and form a chain independently verifiable from the
session's primary Event Log.
ALE Causal Chain:
The sequence of ALE events for a given agent_id or session_id,
linked via prior_event_id fields into a directed acyclic graph.
The GEC MUST ensure that every ALE entry references a
prior_event_id that exists in the ALE store, with the exception of
ALE-001 (ALE_SESSION_REVOKED) and ALE-002
(ALE_AUTHORITY_SUSPENDED), which are causal chain roots.
mandate_hold:
A normative hold placed on MJWT issuance for an agent during a
recovery flow. Recorded as mandate_hold: true in
ALE_RECOVERY_INITIATED (ALE-004). Any MJWT issuance attempt for
an agent with an active mandate_hold MUST be rejected with error
code AGENT_IN_RECOVERY. Lifted when ALE_AUTHORITY_RESTORED
(ALE-008) is committed with mandate_hold_lifted: true.
SO Cluster:
A coordination group of Sovereign Object instances whose goals are
aggregated under a shared completion rule (QUORUM | ALL_COMPLETE |
FIRST_COMPLETE | ANY). The GEC tracks cluster achievability and
records ALE_CLUSTER_PARTIAL_REVOCATION (ALE-010) when any member
is revoked.
SOOS Governance Semantic Convention:
The normative OpenTelemetry attribute namespace defined in
Section 13 of this document. The convention specifies the
soos.governance.*, soos.cap.*, soos.acd.*, soos.consent.*,
soos.mandate.*, and soos.gar.* attribute sets that MUST be
emitted on governance spans by conforming GEC implementations.
Session Block:
The unit of Merkle-protected integrity in the GAR audit record.
A Session Block is constructed by the SOOS GAR Processor from
the set of OTel spans belonging to a single governed session
(identified by soos.governance.session_id). The Session Block
has a block_id (equal to the OTel trace_id), a Merkle root over
Sato Expires 7 March 2027 [Page 8]
Internet-Draft GAR for Agentic AI Systems September 2026
all event delta records, and a KIA signature over the Merkle
root.
SOOS GAR Processor:
The OTel processor component, specified in Section 14, that
filters governance spans, aggregates them into Session Blocks,
computes Merkle roots, requests KIA signatures, writes signed
Session Blocks to GAR tiered storage, and anchors Merkle DAGs
across multiple Session Blocks.
soos.gar.prev_span_hash:
An OTel span attribute computed by the kernel before a span
leaves the kernel boundary. The value is the hash of the
immediately preceding governance span in the session. Any
modification of a span after emission breaks this hash chain
and is detectable.
The value MUST be computed as:
prev_span_hash = SHA-256(
session_id || "|" ||
decision || "|" ||
kernel_id || "|" ||
cap_profile_hash || "|" ||
timestamp || "|" ||
prev_span_hash )
where "||" denotes concatenation, each field is rendered as
its UTF-8 string representation, "|" (0x7C) is a literal
pipe-character field separator, the six named fields are
session_id, decision, kernel_id, cap_profile_hash, timestamp,
and prev_span_hash (of the immediately preceding governance
span; the empty string for the first span in a session), and
the result is hex-encoded.
This is a narrow, low-latency hash: it is computed over these
six fields only and MUST NOT be read as covering the full
content of the span, the full event delta record, or any
Section 13.3 provenance field. See Section 14.4 for the
two-layer tamper evidence model and Section 15 S.15.d for the
resulting coverage asymmetry.
ACD session ALE:
An ALE entry recording an ACD (Agent Compliance Disclosure)
handshake event. ACD session ALEs (numbered ALE-056 through
ALE-063) carry the XPID mirror field (Section 8.7).
xpid:
Sato Expires 7 March 2027 [Page 9]
Internet-Draft GAR for Agentic AI Systems September 2026
The XPID UUID-v5 for cross-principal audit correlation.
Carried in ACD session ALEs. Derived per the FROST-based
XPID derivation scheme specified in [I-D.sato-soos-kia].
3. Architecture Overview
The GAR architecture comprises five audit types operating at
different timescales and with different principals:
+----------------------------------------------------------+
| GOVERNING ENFORCEMENT COMPONENT (GEC) |
| |
| [IDP Events] [HEM Events] [CAP Events] [GAR Events] |
| | | | | |
| v v v v |
| +--------------------------------+ |
| | EVENT LOG | |
| | append-only, GEC-signed | |
| +--------------------------------+ |
| | |
| +------------+------------+ |
| | | |
| v v |
| [Type 1: Self-Audit] [Type 2: SAR at close] |
| continuous session summary |
| | | |
| v v |
| GEC_AUDIT_ANOMALY SAR (GEC-signed) |
| | | |
+--------|-------------------------|--------------------+ |
v v
[Type 3: Audit Alerts] [Type 4: Scheduled Audit]
to Audit Principals cross-session patterns
|
v
[Type 5: Audit Package] [SCITT Transparency Log]
to Verified External Auditor SAR Signed Statements
The GEC is the sole source of audit truth. No agent, application,
HEM Principal, or Audit Principal can generate, modify, or suppress
GEC audit artifacts.
4. Audit Types
4.1. Type 1 -- GEC Self-Audit
Sato Expires 7 March 2027 [Page 10]
Internet-Draft GAR for Agentic AI Systems September 2026
The GEC MUST evaluate its own Event Log after every Event Log
commitment. If the GEC detects an inconsistency -- a state
transition without a corresponding IDP submission, a HEM resolution
without a recorded trigger, a mandate referenced by an IDP that does
not exist in the mandate store -- the GEC MUST generate a
KERNEL_AUDIT_ANOMALY Event Log entry.
KERNEL_AUDIT_ANOMALY entries are immutable once written. The GEC
MUST NOT suppress KERNEL_AUDIT_ANOMALY entries. A
KERNEL_AUDIT_ANOMALY entry MUST immediately trigger a Type 3 Audit
Alert at CRITICAL severity (Section 7.3).
The GEC MUST also generate an IDP Commitment Verification Record
after every governed state transition (Section 8.1). An
IDP_COMMITMENT_GAP result MUST be treated as a critical audit finding
equivalent to KERNEL_AUDIT_ANOMALY for alert severity purposes.
4.2. Type 2 -- Session-Close Audit
The GEC MUST generate a Session Audit Record (SAR) automatically at
the close of every governed session. SAR generation is not
requestable by any external party -- it fires unconditionally on
session close. The SAR specification is in Section 6.
4.3. Type 3 -- Event-Triggered Alert
The GEC MUST generate an Audit Alert when a normative trigger
condition is detected. Audit Alerts are delivered to all registered
Audit Principals for the governed session. The normative trigger
list is in Section 7.3.
4.4. Type 4 -- Scheduled Audit
Audit Principals MAY initiate cross-session pattern audits covering
a specified time range or SO Type population. The GEC MUST expose
a GEC Query Interface for this purpose [I-D.sato-soos-idp]. Type 4
audits produce cross-session pattern reports and MUST be recorded as
SCHEDULED_AUDIT_INITIATED and SCHEDULED_AUDIT_COMPLETED Event Log
entries.
The GEC SHOULD initiate a Type 4 audit automatically when a PRD
review_date is exceeded, covering all sessions governed by the
overdue policy.
4.5. Type 5 -- On-Demand External Audit
Sato Expires 7 March 2027 [Page 11]
Internet-Draft GAR for Agentic AI Systems September 2026
Operators MAY grant Verified External Auditors time-limited, scope-
limited read access to GEC audit artifacts. Access grants MUST be
recorded as EXTERNAL_AUDIT_ACCESS_GRANTED Event Log entries. Access
revocation MUST be recorded as EXTERNAL_AUDIT_ACCESS_REVOKED. Audit
Packages produced by Verified External Auditors are specified in
Section 9. At Level 3 conformance, Audit Packages SHOULD be
submitted to a SCITT transparency log via SCRAPI (Section 10.2).
5. Auditor Principal Categories
GAR defines four distinct auditor categories. These are not
interchangeable.
5.1. HEM Principal
A HEM Principal is registered in a designation chain and resolves
HEM escalations. A HEM Principal is NOT an auditor. HEM Principals
do not receive Audit Alerts and do not have access to the Rationale
Store or Event Log beyond what is included in the HEM Escalation
Request.
5.2. Audit Principal
An Audit Principal is a registered principal with principal_type:
AUDIT. Audit Principals receive Audit Alerts, review Session Audit
Records, and may initiate Type 4 scheduled audits.
An Audit Principal MUST NOT appear in a HEM designation chain. The
GEC MUST reject SO Type configurations that place an Audit Principal
in a designation chain.
Audit Principals have read-only access to:
o The Event Log (via GEC Query Interface [I-D.sato-soos-idp])
o The Rationale Store
o Session Audit Records
o IDP Commitment Verification Records
Audit Principals MUST NOT be able to modify any GEC artifact.
5.3. Verified External Auditor
Sato Expires 7 March 2027 [Page 12]
Internet-Draft GAR for Agentic AI Systems September 2026
A Verified External Auditor is a regulator, accounting firm, or
other external party granted temporary read access by the operator.
Access is time-limited and scope-limited. The operator declares the
access scope (session range, SO Type filter, time window) and expiry
at grant time.
A Verified External Auditor produces an Audit Package (Section 9)
covering the declared scope. The Audit Package is GEC-signed as of
the production timestamp.
5.4. GEC Self-Auditor
The GEC Self-Auditor is an architectural property, not a human role.
It refers to the Type 1 continuous self-audit function executed by
the GEC after every Event Log commitment. It cannot be disabled,
configured, or bypassed.
6. Session Audit Record
6.1. SAR Generation
The GEC MUST generate a SAR automatically at the close of every
governed session regardless of close reason (normal completion,
TERMINATE decision, mandate expiry, session timeout, or error).
SAR generation MUST be atomic with session close. The GEC MUST NOT
return a session close confirmation to any external party before the
SAR is committed to the audit store.
The GEC MUST sign every SAR using Ed25519 with the GEC's signing
key. The signing key MUST be consistent with the GEC's conformance
level: at Level 1, an application-managed key; at Level 2, a key
held by the isolated GEC process; at Level 3, a key bound to a
RATS-attested execution environment [I-D.sato-soos-idp] Section 9.
The GEC signing key is published via the operator's JWKS
endpoint. (NEW, WIMSE checklist A4 fix) The JWKS endpoint URL
itself MUST be bound to the operator via the same out-of-band,
human-verified channel already used to establish the operator's
identity in the deployment's trust chain (e.g., the KIA-05 GEC
Attestation Certificate provisioning process) -- it MUST NOT be
discovered dynamically from agent-supplied or session-supplied
metadata. Every downstream Security Considerations guarantee in
this document (SAR integrity, Audit Alert integrity, ALE
integrity) is only as strong as this bootstrap step; a verifier
that resolves a spoofed JWKS URL has no basis for trusting any
signature verified against it.
Sato Expires 7 March 2027 [Page 13]
Internet-Draft GAR for Agentic AI Systems September 2026
6.2. SAR Schema
A SAR MUST contain the following fields. All fields are REQUIRED
unless stated otherwise.
sar_id:
GEC-generated UUID v7 [RFC9562]. Unique identifier for this SAR.
session_id:
The session identifier. Links the SAR to all Event Log entries
for this session.
so_id:
The Sovereign Object instance identifier [I-D.sato-soos-sov]
Section 4.2.1. Links the SAR to the specific SO Instance
governed during this session.
mandate_id:
The governing mandate identifier. The jti claim of the
Mandate JWT [I-D.sato-soos-mjwt] in force at session open.
(REVISED, Pattern 1 fix) No mid-session mandate-replacement
path exists anywhere in this suite: a mandate change always
closes the current session (ALE_SESSION_REVOKED, Section 12.3)
rather than mutating mandate_id in an open session's SAR. This
field is therefore stable for the life of the SAR by
construction, not merely by convention.
mission_ref:
The MissionDeclaration reference. Null if no mission was declared
for this session.
open_timestamp:
ISO 8601 UTC timestamp of session open.
close_timestamp:
ISO 8601 UTC timestamp of session close.
close_reason:
Controlled vocabulary. One of: NORMAL_COMPLETION |
TERMINATE_DECISION | MANDATE_EXPIRY | SESSION_TIMEOUT | ERROR |
CAP_SUSPENSION.
causal_parent_id:
The sar_id of the Session Audit Record that causally preceded
this record in the governance event chain. OPTIONAL. Present
when this SAR records a session that was directly triggered by
the outcome of governance evaluation in a prior session (for
example: a HEM escalation in session A resolved with
Sato Expires 7 March 2027 [Page 14]
Internet-Draft GAR for Agentic AI Systems September 2026
APPROVE_WITH_CONSTRAINTS, causing session B to open under the
conditional constraints). NULL for the first session in a
causal chain. This field is the primary mechanism by which GAR
extends SCITT's append-only model with directed causal graph
semantics. (REVISED, WIMSE checklist / SDB-GAR-03 fix) When
present, causal_parent_id MUST reference a sar_id that exists
in the audit store at the time this SAR is generated -- the GEC
MUST verify this before committing the SAR, the same
referential-integrity requirement Section 12.1 already imposes
on ALE prior_event_id links. A causal_parent_id that does not
resolve MUST be treated as a KERNEL_AUDIT_ANOMALY (Section 4.1),
not silently accepted; a dangling causal reference is exactly
the kind of Event Log inconsistency Type 1 self-audit exists to
catch. This closes the gap by which causal_parent_id was
previously decorative -- accepted but never checked, so a
verifier's causal-chain traversal (Section 10) could silently
terminate at a reference that was never real.
session_sequence_number:
A monotonically increasing integer assigned by the GEC at
session open, scoped to the GEC instance. The GEC MUST
increment this counter for every governed session and MUST NOT
reuse values. Together with sar_id and causal_parent_id, this
field supports causal chain reconstruction across sessions.
Verifiers SHOULD check for gaps in session_sequence_number
sequences as an indicator of suppressed sessions. (NEW, WIMSE
checklist D fix) A gap alone is not proof of suppression:
legitimate concurrent-session counter races can produce
apparent gaps that later resolve as later-numbered sessions
commit. Verifiers SHOULD distinguish a transient gap (a higher
sequence number already observed, lower one still pending) from
a persistent one (the gap remains after a reasonable observation
window) before treating it as a suppression indicator, and
implementations SHOULD rate-limit or deduplicate gap-triggered
alerts per GEC instance -- an adversarial party able to
influence session timing could otherwise manufacture spurious
gap alerts to desensitize downstream monitoring to genuine
suppression (alert fatigue).
governance_decision:
The terminal governance disposition for the session. Controlled
vocabulary: ALLOW | DENY | ESCALATE | SUSPEND. Populated from the
terminal Event Log entry for the session:
ALLOW: session completed with all governed actions authorized.
DENY: session terminated by GEC DENY or CAP refusal.
ESCALATE: session closed while a HEM escalation was unresolved.
SUSPEND: session suspended by CAP_SUSPENSION.
Sato Expires 7 March 2027 [Page 15]
Internet-Draft GAR for Agentic AI Systems September 2026
idp_submissions:
Array of IDP summary records. Each entry contains:
idp_id: IDP identifier.
goal_summary: Human-readable goal description.
cedar_outcome: PERMIT | DENY | HEM_ROUTED.
hem_triggered: Boolean.
hem_decision: Decision type if HEM was triggered, null
otherwise.
hem_events:
Array of HEM event summary records. Each entry contains:
hem_id: HEM event identifier.
trigger_class: One of the ten defined trigger classes
(Classes 1-10) per [I-D.sato-soos-hem]
Section 5.
trigger_source: AGENT_DETECTED | TRAVELER_REQUEST |
SYSTEM_EVENT.
policy_rationale_id: PRD identifier, null if absent.
decision_type: Final decision type.
decision_rationale_class: DRR rationale class, null if absent.
resolution_time_seconds: Integer. Wall time from trigger to
resolution.
state_transitions:
Array of state transition records. Each entry contains:
from_state: Prior Sovereign Object state.
to_state: Resulting Sovereign Object state.
action: Cedar action string.
timestamp: ISO 8601 UTC.
cap_violations:
Array of CAP violation records. Each entry contains:
violation_id: CAP Violation Record identifier.
tier: 0 | 1 | 2.
prohibition_id: Prohibition identifier.
action: Action attempted.
outcome: REFUSED | SESSION_SUSPENDED | HEM_FIRED.
ale_events:
Array of ALE event summary records for this session. OPTIONAL;
present only when one or more ALE events were recorded. Each
entry contains:
ale_event_id: ALE event UUID v7.
ale_event_type: ALE event type string (e.g.,
ALE_SESSION_REVOKED).
occurred_at: ISO 8601 UTC timestamp.
recovery_ref: Recovery flow UUID v7 if part of a recovery
flow; null otherwise.
Sato Expires 7 March 2027 [Page 16]
Internet-Draft GAR for Agentic AI Systems September 2026
summary: Human-readable one-line description.
Full ALE event schemas are in the ALE store (Section 12). The
SAR ale_events array carries summary data only.
audit_summary:
Summary counts block. Contains:
total_transitions: Integer.
hem_events_count: Integer.
terminate_count: Integer.
auto_approve_count: Integer.
policy_rationale_gaps: Integer. HEM events with no PRD.
decision_rationale_gaps: Integer. HEM events where DRR was
required but absent.
cap_violation_count: Integer.
jurisdictional_conflicts: Integer.
ale_events_count: Integer. ALE events in this session.
transparency_refs_missing: Integer. DENY/ESCALATE/SUSPEND
entries without record_id. Non-zero
is a conformance finding per
[I-D.sato-soos-cap] Section 12a.6.
kernel_signature:
Ed25519 signature over the canonical serialization of all SAR
fields except kernel_signature itself. The label field within
this signature MUST indicate the GEC's conformance level (L1,
L2, or L3). The field name kernel_signature is preserved for
wire-format compatibility.
The idp_submissions, hem_events, state_transitions, and
cap_violations arrays carry reference fields and key summary data
only. Full detail for each record is available in the Event Log and
Rationale Store. The SAR is a governance summary and index, not a
duplicate of the Event Log.
The following four fields are added to the SAR header schema.
These fields are REQUIRED for all newly generated SARs.
cap_profile_id (string, REQUIRED):
Identifier of the CAP profile active during this session.
Derived from [I-D.sato-soos-cap] S.12a PTD active_prohibitions
set.
cap_profile_hash (string, REQUIRED):
SHA-256 of the Cedar policy set active during this session.
MUST match the cedar_policy_hash in the GEC Manifest
([I-D.sato-soos-kia]) and in the PTD at session open time.
A mismatch constitutes a CAP_TRANSPARENCY_VIOLATION per
[I-D.sato-soos-cap] Section 12a.6.
Sato Expires 7 March 2027 [Page 17]
Internet-Draft GAR for Agentic AI Systems September 2026
acd_session_id (string, CONDITIONAL):
Bilateral audit correlation identifier from the ACD handshake
([I-D.sato-soos-acd]). REQUIRED when an ACD session was
active during this session. Null otherwise. Enables
cross-correlation between the GEC audit record and the
resource provider's compliance log.
soos.gar.block_id (string, REQUIRED):
The Session Block identifier for this session. Equal to the
OTel trace_id for the session's governance span set. Used
by the SOOS GAR Processor (Section 14) to aggregate spans
into the Session Block.
6.3. SAR Signing
The GEC MUST sign the SAR using Ed25519 prior to committing it to
the audit store. The canonical serialization for signing is the JSON
serialization of all fields except kernel_signature, with keys in
lexicographic order and no whitespace.
Audit Principals and Verified External Auditors MUST verify the
kernel_signature before relying on SAR content.
6.4. SAR Retention
Operators SHOULD retain Session Audit Records for a minimum of 12
months from session close_timestamp. Operators subject to EU AI Act
Article 12 obligations MUST retain SARs for the period required by
applicable law. The GEC SHOULD warn Audit Principals when a SAR
approaches its configured retention expiry.
At Level 3 conformance, SARs MUST additionally be submitted to a
SCITT transparency log per Section 10. SCITT submission provides
independent tamper-evidence that complements the GEC's internal
non-suppressibility guarantee.
7. Audit Alert System
7.1. Alert Generation
The GEC MUST generate an Audit Alert when any normative trigger
condition listed in Section 7.3 is detected. Alert generation is
synchronous with the triggering event -- the GEC MUST generate the
alert before returning any response to the triggering agent or
principal.
7.2. Alert Schema
Sato Expires 7 March 2027 [Page 18]
Internet-Draft GAR for Agentic AI Systems September 2026
An Audit Alert MUST contain the following fields:
alert_id:
GEC-generated UUID v7.
alert_severity:
CRITICAL | HIGH | MEDIUM | LOW.
alert_trigger:
Identifier of the normative trigger condition. See Section 7.3.
session_id:
The session in which the trigger occurred.
so_id:
The Sovereign Object instance identifier for the session in which
the trigger occurred [I-D.sato-soos-sov].
hem_id:
The HEM event identifier, if the trigger is HEM-related. Null
otherwise.
cap_violation_id:
The CAP Violation Record identifier, if the trigger is CAP-
related. Null otherwise.
detail:
Human-readable description of the trigger condition. REQUIRED.
timestamp:
ISO 8601 UTC timestamp of alert generation.
kernel_signature:
Ed25519 signature over canonical serialization of all fields
except kernel_signature.
delivered_to:
Array of Audit Principal identifiers to whom the alert was
delivered.
7.3. Normative Trigger List
Sato Expires 7 March 2027 [Page 19]
Internet-Draft GAR for Agentic AI Systems September 2026
The following trigger conditions MUST generate an Audit Alert.
Trigger identifiers are registered in the GAR Audit Alert Triggers
registry (Section 16.1).
+-----------------------------------------+-----------+
| Trigger | Severity |
+-----------------------------------------+-----------+
| KERNEL_AUDIT_ANOMALY | CRITICAL |
| IDP_COMMITMENT_GAP | CRITICAL |
| CAP_TRANSPARENCY_VIOLATION | CRITICAL |
| TERMINATE_DECISION | HIGH |
| AUTO_APPROVE_DISPOSITION | HIGH |
| HEM_CHAIN_EXHAUSTED | HIGH |
| MISSION_REVOKE_CASCADE | HIGH |
| MANDATE_NARROWING_VIOLATION | HIGH |
| HEM_TERMINATE_RATIONALE_REQUIRED | MEDIUM |
| THREE_OR_MORE_HEM_EVENTS_IN_SESSION | MEDIUM |
| PRD_REVIEW_DATE_EXCEEDED | MEDIUM |
| POLICY_RATIONALE_GAPS_IN_SAR | LOW |
+-----------------------------------------+-----------+
Table 1: Normative Audit Alert Triggers
MANDATE_NARROWING_VIOLATION is added in this revision. It is
triggered when the GEC detects that a presented Child Mandate
violates the Narrowing Property as defined in [I-D.sato-soos-mjwt]
Section 5. This is a HIGH severity finding because it indicates
an attempted authorization escalation.
7.4. Alert Delivery
Audit Alerts MUST be delivered to all registered Audit Principals
for the governed session. Delivery MUST be recorded as an
AUDIT_ALERT_FIRED Event Log entry, followed by AUDIT_ALERT_DELIVERED
on successful delivery.
Implementations SHOULD use the Shared Signals Framework (SSF)
[RFC9672] for cross-system Audit Alert delivery.
Audit Principals SHOULD acknowledge Audit Alerts. Acknowledgement
MUST be recorded as AUDIT_ALERT_ACKNOWLEDGED.
8. Event Log Requirements
The Event Log is the append-only, GEC-maintained record of all
governance events in a session. This section specifies the GAR-
specific Event Log entries that MUST be supported.
Sato Expires 7 March 2027 [Page 20]
Internet-Draft GAR for Agentic AI Systems September 2026
8.1. IDP Audit Events
IDP_SUBMITTED:
Recorded when an IDP is submitted to the GEC. Entry type
specified in [I-D.sato-soos-idp].
IDP_COMMITMENT_VERIFIED:
Recorded after every governed state transition. The GEC MUST
generate an IDP Commitment Verification Record and commit this
event. Fields: idp_id, state_transition_id, verified_at,
match_result (MATCHED | IDP_COMMITMENT_GAP), kernel_signature.
IDP_COMMITMENT_GAP:
Recorded when match_result is IDP_COMMITMENT_GAP. This is a
critical audit finding. The GEC MUST immediately:
(a) generate a CRITICAL Audit Alert (alert_trigger:
IDP_COMMITMENT_GAP), and
(b) fire HEM_AGENT_ESCALATED (Class 2) for the active session.
The GEC MUST NOT allow a session to continue after an
IDP_COMMITMENT_GAP without HEM resolution.
8.2. HEM Audit Events
The following HEM Event Log entries gain new fields under GAR:
HEM_TRIGGERED:
Existing entry type. GAR adds: policy_rationale_id (REQUIRED,
null if PRD absent -- absence recorded in audit_summary.
policy_rationale_gaps).
HEM_DECISION_RECEIVED:
Existing entry type. GAR adds: decision_rationale_class
(REQUIRED when DRR is mandatory for the decision type; OPTIONAL
otherwise).
The following HEM Event Log entries are recorded in the GAR Event
Log. Their normative semantics are defined in [I-D.sato-soos-hem];
the fields listed here are the GAR-required fields for audit
purposes.
HEM_DECISION_NOT_PERMITTED_FOR_TRIGGER_CLASS:
Recorded when a human principal submits a decision type that is
not valid for the active trigger class (e.g., APPROVE on a
Class 6 trigger). Fields: hem_id, trigger_class,
submitted_decision_type, rejection_code
(HEM_DECISION_INVALID), timestamp.
HEM_TERMINATE_RATIONALE_REQUIRED:
Sato Expires 7 March 2027 [Page 21]
Internet-Draft GAR for Agentic AI Systems September 2026
Recorded when a TERMINATE decision is rejected because no DRR
with safety_basis was provided. Fields: hem_id, principal_id,
rejection_code (HEM_DRR_REQUIRED), timestamp. MUST trigger a
MEDIUM Audit Alert (alert_trigger:
HEM_TERMINATE_RATIONALE_REQUIRED).
HEM_HUMAN_DECISION_CONSTITUTIONAL_VIOLATION:
Recorded when a human principal's HEM decision is refused by the
CAP Constitutional Evaluation Engine because it would authorize a
Tier 0 or Tier 1 prohibited action. Fields: hem_id,
principal_id, decision_type, violation_tier (0|1),
prohibition_id, timestamp. MUST trigger a CRITICAL Audit Alert.
HEM_CHAIN_CONSTITUTIONAL_EXHAUSTED:
Recorded when the full HEM designation chain has been exhausted
because every submitted decision was refused by the CAP CEE.
Equivalent to HEM_CHAIN_EXHAUSTED but with constitutional refusal
as the exhaustion cause. Fields: hem_id, refusal_count,
final_prohibition_id, timestamp. MUST trigger a CRITICAL Audit
Alert.
KERNEL_AUDIT_ANOMALY
HEM_LAYER_DISCREPANCY:
Recorded when SOOS-HEM fires and the triggering IDP
reasoning_basis contains no uncertainty signal. Governance review
event only; does not create a separate HEM lifecycle. Fields per
[I-D.sato-soos-hem] Section 6.5: hem_id, trigger_class, idp_id,
idp_reasoning_mode, idp_confidence_level, idp_hem_urgency,
discrepancy_note, timestamp.
8.3. GAR Audit Events
The following Event Log entry types are introduced by this document:
SAR_GENERATED:
Recorded when a SAR is committed to the audit store. Fields:
sar_id, session_id, so_id, close_reason, causal_parent_id (null
if no causal predecessor), session_sequence_number,
governance_decision, kernel_signature.
SAR_SCITT_SUBMITTED:
Recorded when a SAR is submitted to a SCITT transparency log.
Fields: sar_id, scitt_entry_id, transparency_log_uri,
submitted_at, kernel_signature. See Section 10.1.
PTD_QUERIED:
Recorded when the PTD query interface is accessed. Fields:
Sato Expires 7 March 2027 [Page 22]
Internet-Draft GAR for Agentic AI Systems September 2026
requester_id (if authenticated), timestamp, ptd_version,
cedar_policy_hash. Per [I-D.sato-soos-cap] Section 12a.4.
Note on DENY/ESCALATE/SUSPEND entries (SA-10): Every Event Log entry
with governance_decision DENY, ESCALATE, or SUSPEND MUST carry a
record_id field referencing the CAP-RRS Regulation Record
([I-D.sato-soos-cap-rrs]) that caused the decision, or a
policy_reference fallback when no record_id exists (e.g., Tier 3
policies). This requirement is upgraded from SHOULD to MUST. A
non-zero transparency_refs_missing count in the SAR audit_summary
is a Type 1 self-audit finding. See also [I-D.sato-soos-cap]
Section 12a.6 (CAP_TRANSPARENCY_VIOLATION).
AUDIT_ALERT_FIRED:
Recorded when an Audit Alert is generated. Fields: alert_id,
alert_trigger, alert_severity, session_id, so_id.
AUDIT_ALERT_DELIVERED:
Recorded when an Audit Alert is successfully delivered to an
Audit Principal. Fields: alert_id, principal_id, delivered_at.
AUDIT_ALERT_ACKNOWLEDGED:
Recorded when an Audit Principal acknowledges an Audit Alert.
Fields: alert_id, principal_id, acknowledged_at.
SCHEDULED_AUDIT_INITIATED:
Recorded when a Type 4 scheduled audit begins. Fields:
audit_id, initiated_by, scope_description, initiated_at.
SCHEDULED_AUDIT_COMPLETED:
Recorded when a Type 4 scheduled audit completes. Fields:
audit_id, completed_at, findings_count.
EXTERNAL_AUDIT_ACCESS_GRANTED:
Recorded when a Verified External Auditor is granted access.
Fields: auditor_id, granted_by, scope, expiry, granted_at.
AUDIT_PACKAGE_PRODUCED:
Recorded when a Verified External Auditor produces an Audit
Package. Fields: package_id, auditor_id, scope, produced_at,
package_hash.
EXTERNAL_AUDIT_ACCESS_REVOKED:
Recorded when Verified External Auditor access expires or is
revoked. Fields: auditor_id, revoked_at, revocation_reason.
PRD_REVIEW_DATE_EXCEEDED:
Recorded by the GEC's continuous self-audit when a PRD
Sato Expires 7 March 2027 [Page 23]
Internet-Draft GAR for Agentic AI Systems September 2026
review_date is exceeded. Fields: prd_id, policy_id,
review_date, detected_at. This entry MUST trigger a MEDIUM
Audit Alert (alert_trigger: PRD_REVIEW_DATE_EXCEEDED).
8.4. CAP Audit Events
The following CAP Event Log entries are specified in
[I-D.sato-soos-cap] and recorded in the GAR Event Log:
CAP_VIOLATION_DETECTED:
AI-initiated action refused by the Constitutional Evaluation
Engine. Fields: violation_id, tier, prohibition_id, action,
outcome, timestamp, kernel_signature.
CAP_HUMAN_VIOLATION_DETECTED:
Human principal decision refused by the Constitutional Evaluation
Engine. Fields: violation_id, tier, prohibition_id, decision,
outcome, timestamp, kernel_signature.
CAP_TIER1_CONFLICT_DETECTED:
Jurisdictional conflict detected at Tier 1. Fields: conflict_id,
conflicting_jurisdictions, resolution_method, hem_id, timestamp.
APPROVE_WITH_LEGAL_BASIS_RECORDED:
Principal submitted APPROVE_WITH_LEGAL_BASIS decision. Fields:
hem_id, principal_id, legal_basis (authority_type, authority_ref,
jurisdiction, expiry, document_hash), timestamp.
SESSION_CAP_SUSPENDED:
Session suspended due to CAP violation. Fields: session_id,
violation_id, suspended_at.
8.5. ALE Audit Events
Sato Expires 7 March 2027 [Page 24]
Internet-Draft GAR for Agentic AI Systems September 2026
The following Event Log entry types are introduced by this document
for Authority Lifecycle Events. ALE entries are recorded in the ALE
store, which is a separate, append-only store within the GEC audit
infrastructure, distinct from the primary Event Log. ALE entries are
linked to the primary Event Log via prior_event_id references.
Full ALE event schemas are specified in Section 12. The following
three ALE event types are specified in this subsection because they
arise from resource governance events (SA-15a, DR-DATA-ARCH-01)
rather than the revocation-recovery lifecycle:
ALE_CLUSTER_BUDGET_TRANSFER (ALE-018):
Recorded when a BUDGET_TRANSFER Cedar action is executed, moving
unexpended resource budget from one SO Cluster member to another.
Fields: event_id, prior_event_id, occurred_at, cluster_id,
source_agent_id, source_session_id, destination_agent_id,
destination_session_id, transferred_resource_type
(TIME | COMPUTE | MEMORY | API_CALLS | CUSTOM),
transferred_amount, remaining_cluster_budget, transfer_authority
(GEC_INITIATED | OPERATOR_CONFIGURED), gec_signature.
The GEC MUST record ALE_CLUSTER_BUDGET_TRANSFER before completing
the BUDGET_TRANSFER Cedar action.
ALE_CLUSTER_BLOCK_START (ALE-019):
Recorded when a SO Cluster enters CLUSTER_BLOCKED state. A cluster
enters CLUSTER_BLOCKED when its coordinator SO is under HEM
escalation or CAP suspension and new member sessions cannot be
authorized until the block is resolved. Fields: event_id,
prior_event_id, occurred_at, cluster_id, orchestrator_session_id,
block_reason
(HEM_ESCALATION_PENDING | CAP_SUSPENSION | OPERATOR_HOLD),
block_ref (hem_id or cap_violation_id), affected_member_count,
estimated_resolution_time (ISO 8601, OPTIONAL), gec_signature.
The GEC MUST deliver a CLUSTER_STATUS_CHANGE Context Package
trigger to all active cluster members when this entry is
committed, with cluster_achievability: DEGRADED.
ALE_CLUSTER_BLOCK_END (ALE-020):
Recorded when a SO Cluster exits CLUSTER_BLOCKED state.
Fields: event_id, prior_event_id (MUST reference ALE-019 for this
cluster), occurred_at, cluster_id, orchestrator_session_id,
resolution_type (HEM_RESOLVED | CAP_CLEARED | OPERATOR_RELEASED),
resolution_ref, block_duration_seconds, gec_signature.
The GEC MUST deliver a CLUSTER_STATUS_CHANGE Context Package
trigger to all blocked member sessions when this entry is
committed.
Sato Expires 7 March 2027 [Page 25]
Internet-Draft GAR for Agentic AI Systems September 2026
8.6. Mandatory Provenance Fields on Cedar Evaluation Records
Every GAR record produced by a Cedar policy evaluation MUST
carry the following four provenance fields.
subject_digest (string, REQUIRED):
SHA-256 of the RFC 8785 JCS canonical serialization of the
governed action being evaluated -- the same subject_digest
construction used by the Agent Accountability Composition
[I-D.mih-sato-agent-accountability-composition] as the shared
join key across independently-produced accountability
profiles. This is the field that allows a GAR record to
serve as a conforming AEP instance under
[I-D.sokolov-rats-aep-composition] Section 3's "covered
action and outcome fields" property.
The GEC MUST NOT independently serialize the governed action
and compute subject_digest over that serialization. Where
the action's subject_digest was already established upstream
-- for example, by the CAN slot's authorization decision
under [I-D.mih-sato-agent-accountability-composition] -- the
GEC MUST carry that value verbatim into the GAR record.
Where GAR is itself the first party to establish the
serialization for a given action, its serialization becomes
the canonical one other legs MUST echo. Independently
re-serializing produces a well-formed but silently mismatched
digest: both records validate individually under their own
profile, and neither party is alerted that the cross-slot
join has failed. See [I-D.hillier-scitt-arp] Appendix D for
the general statement of this failure mode.
cedar_policy_id (string, REQUIRED):
The identifier of the Cedar policy that produced this
governance decision. Format:
{cap_rrs_control_id}-v{policy_version}.
cap_rrs_control_id (string, REQUIRED):
The OSCAL control ID of the CAP-RRS Regulation Record that
produced the Cedar policy. Format:
{catalog_id}:{control_id}.
authority_source_uri (string, REQUIRED):
The canonical URI of the law article or statutory provision
that governs this action. For Japanese law implementations,
the e-Gov URI format is RECOMMENDED:
https://elaws.e-gov.go.jp/document?lawid={law_id}#{xpath}
This URI MUST be identical to the soos.cap.authority_source_uri
Sato Expires 7 March 2027 [Page 26]
Internet-Draft GAR for Agentic AI Systems September 2026
OTel span attribute emitted for the same Cedar evaluation per
Section 13.3. A mismatch between the GAR record value and the
OTel span value constitutes a PTD inconsistency detectable by
the SOOS GAR Processor.
Scope of applicability:
+-------------------------------------+----------------------------+
| GAR record type | Provenance fields required |
+-------------------------------------+----------------------------+
| CEDAR_PERMIT | REQUIRED |
| CEDAR_DENY | REQUIRED |
| CAP_CONSENT_EXCEPTION_ACTIVATED | REQUIRED |
| (ALE-NEW-01) | |
| CAP_CATALOG_CONFLICT_DETECTED | REQUIRED |
| (ALE-NEW-02) | |
| Session lifecycle events | Not Required |
| HEM escalation events | Not Required |
| ACD handshake events | Not Required |
| Resource governance events | Not Required |
| Temporal events | Not Required |
+-------------------------------------+----------------------------+
Table 6a: Mandatory Provenance Field Scope
cedar_policy_id Assignment Procedure at Catalog Load (normative):
When the GEC loads a CAP-RRS catalog, it MUST:
(1) Read the control_id from each OSCAL control in the catalog.
(2) Assign cedar_policy_id = "{catalog_id}:{control_id}-v
{catalog_version}" to the compiled Cedar policy.
(3) Store the mapping cedar_policy_id -> cap_rrs_control_id ->
authority_source_uri in kernel memory.
(4) Use this mapping to populate provenance fields in every
subsequent GAR record for Cedar evaluations from this policy.
Session Block Delta Template Optimization:
For sessions where the same Cedar policy governs many similar
actions (typical for booking agents processing APPI personal data),
cedar_policy_id, cap_rrs_control_id, and authority_source_uri
MAY be registered as ALE-012 delta template defaults. Per-event
overhead is eliminated -- fields appear once in template
registration, not per event. Tamper evidence is fully preserved:
Sato Expires 7 March 2027 [Page 27]
Internet-Draft GAR for Agentic AI Systems September 2026
any change to template defaults changes the Session Block Merkle
root and invalidates the KIA signature.
8.7. XPID Mirror Field
ACD session ALEs (ALE-056 through ALE-063) MUST carry the
following additional field:
xpid (string, REQUIRED on ACD session ALEs):
The XPID UUID-v5 for the agent principal involved in the ACD
handshake. Derived per the FROST-based XPID derivation scheme
in [I-D.sato-soos-kia]. Enables cross-principal audit
correlation across ACD handshakes from the same agent.
The xpid field MUST be derived from KIA-verified agent identity.
The GEC MUST NOT populate xpid from client-supplied metadata.
9. Audit Package
9.1. Package Composition
An Audit Package is produced by a Verified External Auditor and
covers a declared scope (session range, SO Type filter, or time
window). The Audit Package is a GEC-signed compilation of:
o All SARs within scope
o All Event Log entries within scope
o All PRD records from the Rationale Store for policies governing
sessions within scope
o All DRR records from the Rationale Store for decisions within
scope
o All Audit Alert records within scope
o All CAP Violation Records within scope
9.2. Package Schema
Sato Expires 7 March 2027 [Page 28]
Internet-Draft GAR for Agentic AI Systems September 2026
An Audit Package MUST contain the following fields:
package_id:
GEC-generated UUID v7.
auditor_id:
Verified External Auditor identifier.
scope:
Declaration of what the package covers. Fields: session_range,
so_type_filter (optional), time_window.
sar_records:
Array of all SARs within scope.
event_log_records:
Array of all Event Log entries within scope.
prd_records:
Array of all PRD objects from the Rationale Store for policies
governing sessions within scope.
drr_records:
Array of all DRR objects from the Rationale Store for decisions
within scope.
audit_alert_records:
Array of all Audit Alert records within scope.
cap_violation_records:
Array of all CAP Violation Records within scope.
chain_of_custody:
Block containing:
package_hash: SHA-256 hash of all package content fields.
kernel_signature: Ed25519 signature over package_hash.
produced_by: Verified External Auditor identifier.
produced_at: ISO 8601 UTC timestamp.
9.3. Access Control
Sato Expires 7 March 2027 [Page 29]
Internet-Draft GAR for Agentic AI Systems September 2026
The GEC MUST verify that the requesting party holds a valid,
unexpired Verified External Auditor access grant before producing an
Audit Package. The access grant MUST be scoped to include the
requested sessions.
(NEW, evidence-visibility fix) Audit Package production (this
section) is the sole path to auditor-facing Layer 2 verification. Raw
Session Block access is never granted directly to a Verified External
Auditor or any other party outside the GEC itself -- every disclosure
of governance evidence to an external verifier passes through Audit
Package production and is scoped by this section's access grant. This
closes the query-time gap the same way Section 7.7's DAM-01
counterpart does, for the audit-access surface specifically.
Audit Package production MUST be recorded as AUDIT_PACKAGE_PRODUCED
in the Event Log.
10. SCITT Integration
10.1. Relationship to SCITT
Sato Expires 7 March 2027 [Page 30]
Internet-Draft GAR for Agentic AI Systems September 2026
GAR is a domain-specific application of the SCITT architecture
[I-D.ietf-scitt-architecture]. It inherits SCITT's core properties:
append-only transparency log, Signed Statements produced by an
identified Issuer, and receipt-based inclusion proofs for Relying
Parties. These properties are not modified by this specification.
GAR extends SCITT in one specific dimension: the causal ordering of
governance events.
SCITT is artifact-centric. A SCITT Signed Statement asserts a claim
about an artifact at a point in time. The append-only log preserves
the history of statements about artifacts, but the statements
themselves are not causally related to one another in the SCITT data
model.
GAR is event-centric. A GAR entry (specifically, a Session Audit
Record) records a governance decision -- ALLOW, DENY, ESCALATE, or
SUSPEND -- about an agent action. The causal relationship between
GAR entries is normatively significant: action B was caused by the
outcome of governance evaluation of action A. A DENY in session A
may directly cause a HEM escalation that opens session B. A
conditional ALLOW in session A may impose constraints carried forward
into session B's mandate. This causal structure has no equivalent in
the base SCITT data model.
To carry this structure, GAR declares the following extensions to the
SCITT Signed Statement payload:
causal_parent_id: The sar_id of the causally preceding
SAR. NULL for the root of a causal
chain.
session_sequence_number: Monotonically increasing per GEC
instance. Gap detection enables
suppression auditing.
governance_decision: Terminal disposition (ALLOW | DENY |
ESCALATE | SUSPEND) for the session.
These three fields constitute the GAR SCITT causal ordering
extension. All other SCITT properties are inherited without
modification.
A GAR-compliant SCITT transparency log SHOULD index SAR Signed
Statements by causal_parent_id to support causal chain traversal
queries.
Sato Expires 7 March 2027 [Page 31]
Internet-Draft GAR for Agentic AI Systems September 2026
10.2. SAR as SCITT Signed Statement
The Session Audit Record (SAR) is a SCITT Signed Statement as
defined in [I-D.ietf-scitt-architecture]. It carries all properties
required of a SCITT Signed Statement: it is produced by an identified
Issuer (the GEC), signed with a key bound to that Issuer's attested
execution environment, and carries a payload that a Relying Party can
evaluate against a known governance policy.
This specification constitutes GAR's formal declaration as a SCITT
application profile. Implementations that submit SARs to a SCITT
transparency log MUST conform to both this specification and
[I-D.ietf-scitt-architecture].
The SAR SCITT Signed Statement payload is the canonical JSON
serialization of the SAR as defined in Section 6.2. The COSE
[RFC9052] protected header MUST include:
o alg: EdDSA (Ed25519)
o kid: Key identifier of the GEC's signing key
o content_type: application/soos.gar.sar+json
o issuer: GEC identifier
o causal_parent_id: The sar_id of the causally preceding SAR, or
absent if this SAR is the root of a causal chain. This field
in the COSE protected header allows SCITT transparency log
operators to index causal relationships without parsing the SAR
payload.
Upon successful SCITT submission, the GEC MUST record a
SAR_SCITT_SUBMITTED Event Log entry (Section 8.3) containing the
SCITT transparency log entry identifier and the transparency log URI.
10.3. Audit Package SCRAPI Submission
The Audit Package (Section 9) maps directly onto the SCRAPI
[SCITT-SCRAPI] POST /entries endpoint [I-D.ietf-scitt-architecture].
A Verified External Auditor MAY submit an Audit Package to a SCITT
transparency log via SCRAPI. Once registered, the append-only
guarantee of the SCITT transparency log ensures that the Audit
Package cannot be altered or removed independently of what the
operator or GEC does.
The SCRAPI submission provides the external tamper-evidence property
that complements GAR's internal non-suppressibility guarantee.
SCRAPI Audit Package submission MUST be recorded as
AUDIT_PACKAGE_PRODUCED in the Event Log with a scitt_entry_id field
if submission is performed.
Sato Expires 7 March 2027 [Page 32]
Internet-Draft GAR for Agentic AI Systems September 2026
10.4. Conformance Level Requirements
SCITT submission requirements vary by GEC conformance level, as
defined in [I-D.sato-soos-idp] Section 9:
Level 1 (Application Profile):
SCITT SAR submission is RECOMMENDED. Non-suppressibility is
probabilistic; SCITT submission is the primary compensating
control. Operators SHOULD configure automatic SAR submission to
a SCITT transparency log.
Level 2 (Isolated Profile):
SCITT SAR submission is RECOMMENDED. The isolated GEC process
provides architectural non-suppressibility; SCITT provides
independent external evidence.
Level 3 (Kernel Profile):
SCITT SAR submission is REQUIRED. Every SAR MUST be submitted
to a SCITT transparency log before the GEC returns a session
close confirmation. The SAR_SCITT_SUBMITTED Event Log entry MUST
precede or be atomic with SAR_GENERATED.
11. EU AI Act Applicability
11.1. Article 12 Mapping
Sato Expires 7 March 2027 [Page 33]
Internet-Draft GAR for Agentic AI Systems September 2026
EU AI Act [EU-AI-ACT] Article 12 requires high-risk AI systems to
automatically generate logs enabling post-market monitoring and
audit. The following table maps Article 12 provisions to GAR
mechanisms. This mapping is normative: the Event Log fields and SAR
structure specified in this document satisfy Article 12(3)
traceability requirements for deployments governed by [I-D.sato-soos-
hem]. Operators may reference this section directly in conformance
documentation.
+------------------------------+-----------------------------+------+
| Article 12 Provision | GAR Mechanism | Sec. |
+------------------------------+-----------------------------+------+
| 12(1) Automatic logging | Event Log: append-only, | 8 |
| capability | GEC-generated, cannot be | |
| | suppressed | |
+------------------------------+-----------------------------+------+
| 12(2) Logging period | SAR close_timestamp + | 6.4 |
| commensurate with purpose | operator retention | |
| | configuration; SHOULD | |
| | minimum 12 months | |
+------------------------------+-----------------------------+------+
| 12(3) Traceability of AI | hem_id chain across Event | 8 |
| system operation | Log entries -- full causal | |
| | history reconstructible | |
| | from any event | |
+------------------------------+-----------------------------+------+
| 12(3) Human oversight audit | principal_type + | 8.2 |
| record | principal_id + | |
| | decision_type + DRR on | |
| | every HEM_DECISION_RECEIVED | |
| | entry | |
+------------------------------+-----------------------------+------+
| 12(3) Policy audit record | PRD + prd_id on every | 8.2 |
| | HEM_TRIGGERED entry | |
+------------------------------+-----------------------------+------+
Table 2: EU AI Act Article 12 Mapping
12. Authority Lifecycle Events
12.1. ALE Design Principles
Sato Expires 7 March 2027 [Page 34]
Internet-Draft GAR for Agentic AI Systems September 2026
The Authority Lifecycle Event (ALE) category records the complete
authority status lifecycle of an agent session. Four design
principles govern the ALE system:
Non-suppressibility:
Every authority state transition MUST produce a signed ALE entry.
No agent, application, or operator can suppress ALE generation.
The GEC's non-suppressibility guarantee (Section 4) applies to ALE
entries with the same force as to SARs and Event Log entries.
Causal completeness:
The ALE causal chain for any session MUST be reconstructible from
the ALE store alone. Every ALE entry except chain roots (ALE-001
and ALE-002) MUST carry a prior_event_id that references an
existing ALE entry for the same agent or session.
External signing for R-8 events:
ALE entries arising from R-8 (Compromise) revocations MUST be
signed by an external KIA Verification Service, not the GEC
instance under attestation. A compromised kernel cannot
self-attest its own recovery. See ALE-007 (Section 12.9).
Recovery gate enforcement:
ALE_RECOVERY_INITIATED (ALE-004) carries mandate_hold: true. The
GEC MUST reject any MJWT issuance for an agent with an active
mandate_hold. Only ALE_AUTHORITY_RESTORED (ALE-008) with
mandate_hold_lifted: true opens the re-authorization gate.
12.2. ALE Causal Ordering Model
Sato Expires 7 March 2027 [Page 35]
Internet-Draft GAR for Agentic AI Systems September 2026
ALE events form a directed causal chain within a recovery flow. The
normative single-agent chain is:
ALE-001 (SESSION_REVOKED)
-> ALE-003 (PARTIAL_STATE_RECORDED) [if PARTIAL or UNKNOWN]
-> ALE-004 (RECOVERY_INITIATED)
-> ALE-005 (PARTIAL_STATE_DISPOSITION) [if PARTIAL states exist]
-> ALE-006 (CREDENTIAL_RESTORED) or ALE-007 (KIA_REATTESTATION)
-> ALE-008 (AUTHORITY_RESTORED)
Account-level suspension uses ALE-002 as chain root instead of
ALE-001. Multi-agent events (ALE-009 through ALE-012) are causally
linked to the single-agent chain of the triggering revocation event
via prior_event_id.
Each ALE entry MUST carry prior_event_id referencing the immediately
preceding event in its causal chain. Gap detection: a verifier
SHOULD flag any ALE chain where prior_event_id references a missing
entry, as this indicates a suppressed or lost event.
ALE event identifiers ALE-013 through ALE-017 are reserved for
future use. They are not defined in this document. Implementations
MUST NOT assign semantics to these identifiers without a standards-
track document updating this specification.
12.3. ALE-001: ALE_SESSION_REVOKED
Fires: when any revocation trigger causes AEP_SESSION_CLOSED with
closure_reason MANDATE_REVOKED. This is the causal chain root for
single-session revocations. Trigger classes R-1 through R-8 are
defined in [I-D.sato-soos-mad] Section 3.6.4.
Fields: event_type ("ALE_SESSION_REVOKED"), event_id (UUID v7),
prior_event_id (causal link to last AEP event; REQUIRED),
occurred_at, session_id, agent_id, mandate_jwt_id, so_id,
revocation_class (R-1|R-2|R-3|R-4|R-5|R-6|R-7|R-8),
revocation_reason, revocation_source (CAEP_SIGNAL|OPERATOR|
CAP_VIOLATION|PT_THRESHOLD|KIA_ATTESTATION|CASCADE),
trigger_event_ref, completion_state (CLEAN|PARTIAL|UNKNOWN),
natural_breakpoint_reached (boolean), irreversible_actions_taken
(boolean), rollback_available (boolean), so_state_at_revocation,
iterations_completed, cascade_depth, gec_signature.
When completion_state is PARTIAL or UNKNOWN, the GEC MUST immediately
commit ALE_PARTIAL_STATE_RECORDED (ALE-003).
12.4. ALE-002: ALE_AUTHORITY_SUSPENDED
Sato Expires 7 March 2027 [Page 36]
Internet-Draft GAR for Agentic AI Systems September 2026
Fires: when all sessions for an agent are suspended at account or
operator level. Equivalent to RISC account-disabled. Causal chain
root for account-level suspension flows.
Fields: event_type ("ALE_AUTHORITY_SUSPENDED"), event_id,
prior_event_id,
occurred_at, agent_id, suspension_reason (CREDENTIAL_COMPROMISE|
OPERATOR_HOLD|REGULATORY_HOLD|KIA_ATTESTATION_FAILURE|
PT_SYSTEMIC_FAILURE), suspension_source (RISC_SIGNAL|OPERATOR|
REGULATORY_AUTHORITY), trigger_event_ref, affected_session_ids[],
affected_so_ids[], recovery_permitted (boolean),
operator_authority_ref (REQUIRED when source is OPERATOR),
gec_signature.
12.5. ALE-003: ALE_PARTIAL_STATE_RECORDED
Fires: when completion_state in ALE-001 is PARTIAL or UNKNOWN.
The GEC MUST commit this entry before session close is confirmed.
Fields: event_type ("ALE_PARTIAL_STATE_RECORDED"), event_id,
prior_event_id (MUST reference ALE_SESSION_REVOKED; REQUIRED),
occurred_at, session_id, so_id, so_state_at_suspension,
last_committed_action, last_committed_event_id, uncommitted_idp_ref,
irreversible_actions[] ({action, event_id, occurred_at}),
rollback_path[] ({action, from_state, to_state}),
hem_escalation_id (UUID v7; REQUIRED), disposition_required_by
(ISO 8601), gec_signature.
The GEC MUST fire HEM_TRIGGERED immediately after committing this
entry, using hem_escalation_id as the HEM event identifier, with
trigger_class: 3.
12.6. ALE-004: ALE_RECOVERY_INITIATED
Sato Expires 7 March 2027 [Page 37]
Internet-Draft GAR for Agentic AI Systems September 2026
Fires: when an operator or human principal initiates a recovery flow.
Establishes the mandate_hold gate.
Fields: event_type ("ALE_RECOVERY_INITIATED"), event_id,
prior_event_id (MUST reference ALE-001 or ALE-002; REQUIRED),
occurred_at, agent_id, recovery_ref (UUID v7; recovery flow ID),
initiated_by (OPERATOR|HUMAN_PRINCIPAL|REGULATORY_AUTHORITY),
initiator_ref, revocation_ref, recovery_type (CREDENTIAL_ROTATION|
KIA_REATTESTATION|PT_REHABILITATION|OPERATOR_REINSTATEMENT|
REGULATORY_CLEARANCE), estimated_completion (OPTIONAL),
mandate_hold (boolean; MUST be true), gec_signature.
mandate_hold: true is normatively required. Any MJWT issuance attempt
for this agent_id while mandate_hold is active MUST be rejected with
error code AGENT_IN_RECOVERY.
12.7. ALE-005: ALE_PARTIAL_STATE_DISPOSITION
Fires: when a human principal decides the fate of a PARTIAL SO state.
Fields: event_type ("ALE_PARTIAL_STATE_DISPOSITION"), event_id,
prior_event_id (MUST reference ALE_PARTIAL_STATE_RECORDED; REQUIRED),
occurred_at, recovery_ref, session_id, so_id,
disposition (ROLLBACK|COMPLETE|ABANDON|DEFER), decided_by,
principal_signature (REQUIRED), disposition_rationale (REQUIRED),
rollback_target_state (REQUIRED when disposition is ROLLBACK),
completion_agent_id (REQUIRED when disposition is COMPLETE),
completion_mandate_ref (REQUIRED when disposition is COMPLETE),
abandon_compensation[] ({action, rationale}),
defer_deadline (ISO 8601; REQUIRED when disposition is DEFER),
gec_signature.
ALE_AUTHORITY_RESTORED (ALE-008) MUST NOT be committed while any
PARTIAL state for this agent has disposition DEFER or is unresolved.
12.8. ALE-006: ALE_CREDENTIAL_RESTORED
Fires: when a compromised or expired credential has been rotated.
Fields: event_type ("ALE_CREDENTIAL_RESTORED"), event_id,
prior_event_id (links to ALE_RECOVERY_INITIATED), occurred_at,
recovery_ref, agent_id, credential_type (MJWT|KIA_ATTESTATION|
WIMSE_SVID|ALL), new_credential_ref, old_credential_ref,
rotation_method (KEY_ROTATION|REATTESTATION|REISSUANCE),
pt_score_at_restoration (float 0.0-1.0), gec_signature.
12.9. ALE-007: ALE_KIA_REATTESTATION_COMPLETED
Sato Expires 7 March 2027 [Page 38]
Internet-Draft GAR for Agentic AI Systems September 2026
Fires: for R-8 revocations only. CRITICAL: This entry MUST be signed
by an external KIA Verification Service, NOT the GEC being re-
attested. The field name kia_verifier_signature replaces
gec_signature.
Fields: event_type ("ALE_KIA_REATTESTATION_COMPLETED"), event_id,
prior_event_id (links to ALE_RECOVERY_INITIATED), occurred_at,
recovery_ref, gec_instance_id, prior_attestation_id,
new_attestation_id, new_cedar_policy_hash, new_kernel_version,
attestation_gap_duration (integer; seconds),
sessions_during_gap[] (session_ids during gap),
kia_verifier_signature (Ed25519; REQUIRED), kia_verifier_id.
Sessions in sessions_during_gap MUST be flagged in GAR with an
ATTESTATION_GAP_WARNING note. Their StateTransitionEvents are not
automatically invalidated (INV-17 horizontal non-contamination
applies), but the gap period MUST be disclosed in any Audit Package
for these sessions.
12.10. ALE-008: ALE_AUTHORITY_RESTORED
Fires: when all recovery conditions are met. This is the normative
endpoint of the recovery lifecycle and the gate that lifts
mandate_hold.
Fields: event_type ("ALE_AUTHORITY_RESTORED"), event_id,
prior_event_id (MUST reference ALE-006 or ALE-007; REQUIRED),
occurred_at, recovery_ref, agent_id,
restored_by (OPERATOR|REGULATORY_AUTHORITY),
restoration_scope (FULL|CONSTRAINED),
constraints[] (Cedar fragments; REQUIRED when CONSTRAINED),
prior_revocation_ref, partial_state_disposition_ref (REQUIRED if
any PARTIAL states existed), pt_score_at_restoration (float;
REQUIRED), mandate_hold_lifted (boolean; MUST be true),
new_mandate_jwt_id (OPTIONAL), gec_signature.
pt_score_at_restoration below the operator-configured
re-authorization threshold requires restoration_scope: CONSTRAINED.
12.11. ALE-009: ALE_DELEGATION_CHILD_REVOKED
Sato Expires 7 March 2027 [Page 39]
Internet-Draft GAR for Agentic AI Systems September 2026
Fires: on the parent agent's GEC session when a child mandate is
revoked. The GEC MUST deliver a DELEGATION_EVENT Context Package
trigger to the parent session at next SENSE.
Fields: event_type ("ALE_DELEGATION_CHILD_REVOKED"), event_id,
prior_event_id (causal link to last event in parent session;
REQUIRED), occurred_at, parent_session_id, parent_mandate_jwt_id,
revoked_child_mandate_id, revoked_agent_id, revoked_so_id,
revocation_class (R-1 through R-8), child_completion_state
(CLEAN|PARTIAL|UNKNOWN), delegation_depth, cascade_depth_remaining,
cluster_id (null if not in cluster), parent_goal_impact
(BLOCKING|NON_BLOCKING|UNKNOWN), gec_signature.
When parent_goal_impact is BLOCKING, the DELEGATION_EVENT Context
Package trigger MUST carry goal_impact: BLOCKING, and the parent
agent MUST NOT submit the next ACT without re-delegating or
escalating to HEM.
12.12. ALE-010: ALE_CLUSTER_PARTIAL_REVOCATION
Fires: on the SO Cluster coordination record when any cluster member
is revoked.
Fields: event_type ("ALE_CLUSTER_PARTIAL_REVOCATION"), event_id,
prior_event_id (causal link to ALE_SESSION_REVOKED of revoked member;
REQUIRED), occurred_at, cluster_id, orchestrator_session_id,
revoked_member_agent_id, revoked_member_so_id,
revoked_completion_state, members_still_active[],
members_completed[], members_revoked[],
aggregation_rule (QUORUM|ALL_COMPLETE|FIRST_COMPLETE|ANY),
cluster_achievability (ACHIEVABLE|DEGRADED|UNACHIEVABLE),
recommended_disposition (CONTINUE|HALT_REMAINING|REASSIGN_REVOKED),
gec_signature.
When cluster_achievability is UNACHIEVABLE: recommended_disposition
MUST be HALT_REMAINING; the GEC MUST commit ALE-009 to the
Orchestrator session with parent_goal_impact: BLOCKING; the GEC
SHOULD halt remaining active cluster members.
12.13. ALE-011: ALE_SIBLING_REVOCATION_NOTICE
Sato Expires 7 March 2027 [Page 40]
Internet-Draft GAR for Agentic AI Systems September 2026
Fires: on any agent session sharing a SO instance with a revoked
peer. Receipt does NOT invalidate the notified agent's work. INV-4
horizontal non-contamination [I-D.sato-soos-mad] means sibling
revocation does not cascade horizontally.
Fields: event_type ("ALE_SIBLING_REVOCATION_NOTICE"), event_id,
prior_event_id (causal link to last event in notified session;
REQUIRED), occurred_at, notified_session_id, notified_agent_id,
shared_so_id, revoked_agent_id, revoked_session_id,
revoked_mandate_jwt_id, revocation_class, last_revoked_event_id,
peer_relationship (SIBLING|COUSIN|UNRELATED_SAME_SO),
contamination_assessment (CLEAN_SEPARATION|INTERLEAVED|UNKNOWN),
gec_signature.
12.14. ALE-012: ALE_DELEGATION_TREE_RECOVERY_INITIATED
Fires: on the root orchestrator session when recovery begins for any
revoked descendant.
Fields: event_type ("ALE_DELEGATION_TREE_RECOVERY_INITIATED"),
event_id, prior_event_id (causal link to
ALE_DELEGATION_CHILD_REVOKED; REQUIRED), occurred_at,
root_mandate_jwt_id, orchestrator_session_id, recovery_ref (UUID v7;
tree-level recovery flow ID), revoked_subtree_root, revoked_agents[]
({agent_id, mandate_jwt_id, completion_state, so_id}),
still_active_agents[] ({agent_id, mandate_jwt_id, so_id}),
partial_so_ids[], tree_recovery_strategy (REDELEGATION|
PARTIAL_COMPLETION|FULL_ABORT|HUMAN_DECISION),
mandate_hold_scope (SUBTREE_ONLY|FULL_TREE), gec_signature.
mandate_hold_scope: FULL_TREE means the root orchestrator session
also receives MANDATE_REVOCATION trigger at next SENSE.
12.15. ALE-NEW-01: CAP_CONSENT_EXCEPTION_ACTIVATED
Sato Expires 7 March 2027 [Page 41]
Internet-Draft GAR for Agentic AI Systems September 2026
Trigger: A Cedar consent exception evaluation returns PERMIT.
Scope: every Cedar consent exception evaluation returning PERMIT.
Provenance fields (Section 8.6): REQUIRED.
Schema:
+---------------------------+----------+---------------------------+
| Field | Type | Description |
+---------------------------+----------+---------------------------+
| ale_type | string | CAP_CONSENT_EXCEPTION_ |
| | | ACTIVATED |
| cedar_policy_id | string | Consent exception Cedar |
| | | policy |
| cap_rrs_control_id | string | OSCAL control ID |
| authority_source_uri | string | Law article URI |
| consent_reference | string | Consent record URI/token |
| consent_timestamp | ISO8601 | When consent was recorded |
| consenting_party | string | SELF | GUARDIAN | |
| | | AUTHORIZED_ |
| | | REPRESENTATIVE |
| purpose_codes_active | string[] | Purpose codes at eval |
| data_category_accessed | string | Data category covered |
| consent_source | string | MJWT | HEM_RUNTIME | |
| | | INHERITED_FROM_PARENT |
| consent_expiry | ISO8601 | Consent expiry timestamp |
| jurisdiction | string | ISO 3166-1 alpha-2 |
| governing_law | string | Law citation |
| kernel_timestamp | ISO8601 | Kernel evaluation time |
| session_id | string | GAR session ID |
| kernel_id | string | KIA identity |
+---------------------------+----------+---------------------------+
Table 4a: ALE-NEW-01 Schema
12.16. ALE-NEW-02: CAP_CATALOG_CONFLICT_DETECTED
Sato Expires 7 March 2027 [Page 42]
Internet-Draft GAR for Agentic AI Systems September 2026
Trigger: GEC detects conflict between a newly loaded catalog entry
and existing higher-tier policy at catalog load time.
Cross-reference: [I-D.sato-soos-cap] Section 8.8.
+---------------------------+----------+---------------------------+
| Field | Type | Description |
+---------------------------+----------+---------------------------+
| ale_type | string | CAP_CATALOG_CONFLICT_ |
| | | DETECTED |
| conflicting_catalog_id | string | Catalog containing |
| | | conflict |
| conflicting_cedar_ | string | The conflicting Cedar |
| policy_id | | policy |
| superior_catalog_id | string | Higher-tier catalog |
| superior_cedar_policy_id | string | Higher-tier Cedar policy |
| conflict_type | enum | EXPLICIT_PERMIT_OVERRIDE |
| | | | SCOPE_AMBIGUITY |
| resolution | enum | ENTRY_REJECTED | |
| | | HEM_ESCALATION_TRIGGERED |
| timestamp | ISO8601 | Detection timestamp |
| kernel_id | string | KIA identity |
+---------------------------+----------+---------------------------+
Table 4b: ALE-NEW-02 Schema
12.17. ALE-NEW-03: CATALOG_VERSION_CONFLICT
Sato Expires 7 March 2027 [Page 43]
Internet-Draft GAR for Agentic AI Systems September 2026
Trigger: A statutory amendment posterior to a Regulation Record's
endorsed_at timestamp is detected via amendment_detection_endpoint
polling.
Cross-reference: [I-D.sato-soos-cap-rrs] Section 10.2 for full
schema. GAR registers this event type; CAP-RRS owns the
normative schema.
GAR requirements on CATALOG_VERSION_CONFLICT:
(a) The GEC MUST write this ALE entry before suspending the Cedar
policy or invoking HEM escalation.
(b) The entry MUST be included in the Session Block for the
session in which the conflict was detected.
(c) (REVISED, Pattern 1 fix) Resolution is NOT recorded by updating
the resolution field
in-place. In-place mutation of an already-recorded Event Log
entry is a Direct Conflict with GAR's append-only model (Section
12, HMAC-chained entries). Resolution MUST instead be recorded
as a new, separate CATALOG_VERSION_CONFLICT_RESOLVED event per
Section 12.19, carrying a resolves_event_id back-reference to
this event.
Key fields (abbreviated; see CAP-RRS Section 10.2 for full
schema): ale_type, catalog_entry_id, authority_source_profile,
authority_source_law_id, authority_source_article_ref, endorsed_at,
conflicting_amendment_promulgation_date, conflict_delta_days,
suspension_effective_at, hem_escalation_id. (REVISED:
resolution field removed from this event's own schema, see
Section 12.19.)
12.18. ALE-NEW-04: INTERPRETATION_SUPERSEDED
Sato Expires 7 March 2027 [Page 44]
Internet-Draft GAR for Agentic AI Systems September 2026
Trigger: An interpretive ruling supersedes the resolution_basis
of a Regulation Record's endorsement without any change to the
underlying statutory text.
Cross-reference: [I-D.sato-soos-cap-rrs] Section 10.3 for full
schema. GAR registers this event type; CAP-RRS owns the
normative schema.
GAR requirements on INTERPRETATION_SUPERSEDED:
(a) Distinct from CATALOG_VERSION_CONFLICT. Both may be active
simultaneously for the same catalog entry (e.g., a statute
was simultaneously amended AND its prior interpretation was
superseded by a court judgment).
(b) The GEC MUST write this ALE entry before suspending the Cedar
policy.
(c) The prior_interpretation_id in the superseding_interpretation
block MUST match the resolution_instrument_id in the
Regulation Record's endorsement block.
(d) (REVISED, Pattern 1 fix) Same append-only correction as
Section 12.17(c): resolution MUST be recorded as a new
INTERPRETATION_SUPERSEDED_RESOLVED event per Section 12.20,
never as an in-place update.
Key fields (abbreviated; see CAP-RRS Section 10.3): ale_type,
catalog_entry_id, authority_source_profile, authority_source_law_id,
authority_source_article_ref, endorsed_at, superseding_interpretation
(issuing_authority, instrument_type, instrument_id, effective_date,
prior_interpretation_id), suspension_effective_at, hem_escalation_id.
(REVISED: resolution field removed from this event's own schema,
see Section 12.20.)
12.19. ALE-NEW-05: CATALOG_VERSION_CONFLICT_RESOLVED
Sato Expires 7 March 2027 [Page 45]
Internet-Draft GAR for Agentic AI Systems September 2026
Trigger: Re-endorsement or human override resolves a pending
CATALOG_VERSION_CONFLICT. Cross-reference: [I-D.sato-soos-cap-rrs]
Section 10.2.1 for full schema. GAR registers this event type; CAP-
RRS owns the normative schema.
GAR requirements on CATALOG_VERSION_CONFLICT_RESOLVED:
(a) The GEC MUST write this ALE entry as a new Event Log entry, never
as a mutation of the
original CATALOG_VERSION_CONFLICT entry (Section 12.17).
(b) resolves_event_id MUST match the event_id of an existing
CATALOG_VERSION_CONFLICT
entry in the same SO Instance's Event Log.
Key fields (abbreviated; see CAP-RRS Section 10.2.1): ale_type,
resolves_event_id, type, resolved_at, resolved_by, new_endorsed_at,
rationale.
12.20. ALE-NEW-06: INTERPRETATION_SUPERSEDED_RESOLVED
Trigger: Re-endorsement resolves a pending INTERPRETATION_SUPERSEDED.
Cross-reference: [I-D.sato-soos-cap-rrs] Section 10.3.1 for full
schema. GAR registers this event type; CAP-RRS owns the normative
schema.
GAR requirements on INTERPRETATION_SUPERSEDED_RESOLVED: same shape as
Section 12.19 (a)-(b), with resolves_event_id referencing an
INTERPRETATION_SUPERSEDED entry (Section 12.18) instead.
Key fields (abbreviated; see CAP-RRS Section 10.3.1): ale_type,
resolves_event_id, type, resolved_at, resolved_by, new_endorsed_at,
rationale.
13. SOOS Governance Semantic Convention (OTel)
13.1. Purpose and Design Rationale
Sato Expires 7 March 2027 [Page 46]
Internet-Draft GAR for Agentic AI Systems September 2026
Existing operational observability tooling (Prometheus, Grafana,
Jaeger, Zipkin) uses OpenTelemetry [OPENTELEMETRY] as its primary
signal format. SOOS deployments operate in environments where OTel
infrastructure is already present. Without a normative attribute
namespace, each SOOS implementation emits governance telemetry in ad-
hoc formats that cannot be aggregated, compared, or fed into shared
monitoring infrastructure across deployments.
The SOOS Governance Semantic Convention defines the normative
soos.governance.*, soos.cap.*, soos.acd.*, soos.consent.*,
soos.mandate.*, and soos.gar.* attribute sets. Attributes in
these namespaces appear as span attributes on OTel spans produced
during GEC operation.
Architectural note on trust: the OTel pipeline is explicitly
untrusted. The integrity guarantee comes not from OTel
infrastructure but from the kernel:
o soos.gar.prev_span_hash is computed by the kernel before the
span leaves the kernel boundary. Any modification after
emission breaks the hash chain.
o The KIA signature covers the Session Block Merkle root, not
individual spans. A regulator verifies the KIA signature
against the published KIA attestation chain independently of
the OTel backend.
o The OTel pipeline is a transport, not a trust anchor.
13.2. soos.governance.* Core Attributes
Sato Expires 7 March 2027 [Page 47]
Internet-Draft GAR for Agentic AI Systems September 2026
These attributes MUST appear on all governance spans produced by
a Cedar evaluation.
+---------------------------------+----------+-------------------+
| Attribute | Type | Description |
+---------------------------------+----------+-------------------+
| soos.governance.decision | string | PERMIT | DENY | |
| | | SUSPENDED | |
| | | ESCALATE |
| soos.governance.kernel_id | string | KIA-derived |
| | | kernel instance |
| | | identifier |
| soos.governance.session_id | string | GAR session ID |
| soos.governance.cap_profile_id | string | Active CAP |
| | | profile ID |
| soos.governance.cap_profile_hash| string | SHA-256 of active |
| | | Cedar policy set |
+---------------------------------+----------+-------------------+
Table 8: soos.governance.* Core Attributes
13.3. soos.cap.* Cedar Policy Attributes
Sato Expires 7 March 2027 [Page 48]
Internet-Draft GAR for Agentic AI Systems September 2026
These attributes MUST appear on PERMIT and DENY governance spans.
+---------------------------------+----------+-------------------+
| Attribute | Type | Description |
+---------------------------------+----------+-------------------+
| soos.cap.subject_digest | string | SHA-256 of the |
| | | canonicalized |
| | | governed action |
| soos.cap.cedar_policy_id | string | Cedar policy ID |
| soos.cap.cap_rrs_control_id | string | OSCAL control ID |
| soos.cap.authority_source_uri | string | Law article URI |
| soos.cap.tier | string | 0-A | 0-B | 1 | 2 |
| soos.cap.conflict_detected | boolean | true on ALE-NEW- |
| | | 02 events |
+---------------------------------+----------+-------------------+
Table 9: soos.cap.* Cedar Policy Attributes
CONF-GAR-OTEL-01: The soos.cap.authority_source_uri attribute MUST
be identical to the authority_source_uri field in the corresponding
GAR record for the same Cedar evaluation (Section 8.6). Any
mismatch is a PTD inconsistency.
CONF-GAR-OTEL-02: The soos.cap.subject_digest attribute MUST be
identical to the subject_digest field in the corresponding GAR
record for the same Cedar evaluation (Section 8.6). Any mismatch
is a PTD inconsistency.
13.4. soos.acd.* ACD Handshake Attributes
These attributes appear on ACD handshake spans.
+---------------------------------+----------+-------------------+
| Attribute | Type | Description |
+---------------------------------+----------+-------------------+
| soos.acd.session_id | string | Bilateral audit |
| | | correlation ID |
| soos.acd.record_hash | string | SHA-256 of ACD |
| | | Record |
| soos.acd.validation_result | string | PASS | FAIL | |
| | | PARTIAL |
| soos.acd.failed_layer | integer | Layer if failed |
| soos.acd.resource_provider_id | string | Resource provider |
| | | KIA identity |
+---------------------------------+----------+-------------------+
Table 10: soos.acd.* ACD Handshake Attributes
Sato Expires 7 March 2027 [Page 49]
Internet-Draft GAR for Agentic AI Systems September 2026
13.5. soos.consent.* Consent Governance Attributes
These attributes appear on spans where consent context governs
the Cedar evaluation.
+---------------------------------+----------+-------------------+
| Attribute | Type | Description |
+---------------------------------+----------+-------------------+
| soos.consent.reference | string | Consent record |
| | | URI or token |
| soos.consent.purpose_codes | string[] | Active purpose |
| | | codes |
| soos.consent.data_category | string | Data category |
| | | accessed |
| soos.consent.source | string | MJWT | |
| | | HEM_RUNTIME | |
| | | INHERITED_FROM_ |
| | | PARENT |
| soos.consent.governing_law | string | Law citation |
| soos.consent.jurisdiction | string | ISO 3166-1 a-2 |
+---------------------------------+----------+-------------------+
Table 11: soos.consent.* Consent Governance Attributes
13.6. soos.mandate.* Mandate Scope Attributes
These attributes appear on all governance spans and describe the
mandate context of the session.
+---------------------------------+----------+-------------------+
| Attribute | Type | Description |
+---------------------------------+----------+-------------------+
| soos.mandate.operator_id | string | Operator identity |
| | | URI |
| soos.mandate.delegation_depth | integer | Depth in |
| | | delegation tree |
| soos.mandate.scope_type | string | Mandate scope |
| | | classification |
| soos.mandate.resource_bound | string | SMALL | MEDIUM | |
| | | LARGE | ENTERPRISE|
+---------------------------------+----------+-------------------+
Table 12: soos.mandate.* Mandate Scope Attributes
13.7. soos.gar.* Integrity Attributes
Sato Expires 7 March 2027 [Page 50]
Internet-Draft GAR for Agentic AI Systems September 2026
These attributes provide the hash-chain and Merkle integrity
anchors for the Session Block.
+---------------------------------+----------+-------------------+
| Attribute | Type | Description |
+---------------------------------+----------+-------------------+
| soos.gar.block_id | string | Session Block ID |
| | | (= OTel trace_id) |
| soos.gar.event_merkle_root | string | Merkle root over |
| | | block events |
| soos.gar.block_signature | string | KIA signature |
| | | over Merkle root |
| soos.gar.anchor_id | string | Merkle DAG |
| | | anchor ID |
| soos.gar.prev_span_hash | string | Hash of preceding |
| | | span; kernel- |
| | | computed before |
| | | emission |
+---------------------------------+----------+-------------------+
Table 13: soos.gar.* Integrity Attributes
CONF-GAR-PREVHASH-01: The GEC MUST compute soos.gar.prev_span_hash
before the span leaves the kernel boundary. The GEC MUST NOT
allow the OTel pipeline to compute or modify this field.
13.8. OTel Pipeline Trust Model
Sato Expires 7 March 2027 [Page 51]
Internet-Draft GAR for Agentic AI Systems September 2026
The OTel pipeline MUST be treated as an untrusted transport.
Conforming implementations MUST NOT rely on OTel infrastructure
integrity for audit evidence.
The audit integrity chain operates as follows:
(1) The kernel computes soos.gar.prev_span_hash for each span
before emission. This creates a span-level hash chain within
a session.
(2) The SOOS GAR Processor (Section 14) aggregates spans by
soos.governance.session_id into a Session Block and computes
the Session Block Merkle root over all event delta records.
(3) The GEC requests a KIA signature over the Merkle root. The
KIA signature is produced using the Governance Identity
Keypair (GIK) ([I-D.sato-soos-kia]).
(4) The signed Session Block is written to GAR tiered storage.
A regulator verifying audit integrity:
(a) Obtains the signed Session Block from GAR storage.
(b) Recomputes the Merkle root over the event delta records.
(c) Verifies the KIA signature using the kernel's published
attestation chain from [I-D.sato-soos-kia].
(d) Verifies the soos.gar.prev_span_hash chain within the block.
This verification requires no access to the OTel backend.
14. SOOS GAR Processor
14.1. Purpose
The SOOS GAR Processor is a SOOS-specific OTel processor that
runs in or adjacent to the kernel. Its function is to transform
the OTel governance span stream into signed Session Blocks
suitable for GAR storage and regulatory inspection.
The GAR Processor is the normative implementation pattern for
Section 13 attribute consumption. Implementations MAY use a
different architecture provided the same tamper evidence
properties are achieved.
14.2. Processing Pipeline
Sato Expires 7 March 2027 [Page 52]
Internet-Draft GAR for Agentic AI Systems September 2026
The GAR Processor executes the following six-stage pipeline for
each session:
Stage 1 -- Filter:
Identifies governance spans by presence of one or more
soos.governance.* attributes. Non-governance spans from the
same OTel pipeline are passed through without modification.
Stage 2 -- Aggregate:
Groups governance spans by soos.governance.session_id into
a Session Block. Spans arriving out of order are sorted by
soos.gar.prev_span_hash chain before aggregation.
Stage 3 -- Compute Merkle root:
Computes the Merkle root over all event delta records in the
Session Block. The Merkle tree uses SHA-256 as the hash
function with domain separation between leaf and internal
node hashes; see Section 14.3 for the exact construction.
Stage 4 -- Request KIA signature:
Requests a KIA signature from the GEC over the computed
Merkle root. The signature uses the Governance Identity
Keypair (GIK). One signature is requested per Session Block
at block close -- not per span. This is an intentional
design choice (DEC-OTEL-03): per-span signing would
impose unacceptable latency at high throughput.
Stage 5 -- Write:
Writes the signed Session Block to GAR tiered storage. The
block includes: block_id (trace_id), block header (OTel
resource attributes), event delta records (OTel spans),
Merkle root, and KIA signature.
Stage 6 -- Anchor:
Periodically computes and signs a Merkle DAG anchor across
multiple completed Session Blocks. The anchor provides
cross-session integrity: a single KIA signature covers a
set of Session Blocks, enabling efficient audit of time
ranges rather than individual sessions.
14.3. Session Block Construction
Session Block structure:
block_id: = soos.gar.block_id = OTel trace_id
block_header: OTel resource attributes for this session
events: ordered array of event delta records
(derived from OTel spans), each carrying
Sato Expires 7 March 2027 [Page 53]
Internet-Draft GAR for Agentic AI Systems September 2026
block_id (see below)
merkle_root: SHA-256 Merkle root over events, computed
per the domain-separated construction below
block_signature: {
algorithm: "Ed25519",
key_id: KIA GIK key identifier,
signature: Ed25519 signature over merkle_root
}
Session Block generation trigger: session close event (ALE-005
SESSION_COMPLETE, ALE-002 SESSION_HALTED_CLEAN, ALE-003
SESSION_HALTED_PARTIAL, or ALE-004 SESSION_HALTED_UNKNOWN).
CONF-GAR-BLOCK-01: The GEC MUST NOT close a session without
generating a signed Session Block.
Signer failure at close (SDB-GAR-10 fix): (NEW) Stage 4 (Request KIA
signature) of the processing pipeline (Section 14.2) can fail: in
FROST threshold deployments, a signing cluster below quorum causes
[I-D.sato-soos-kia]'s signer to throw KIA_QUORUM_FAILURE (KIA-06
CONF-KIA-18) rather than return a signature. CONF-GAR-BLOCK-01's
requirement that the GEC MUST NOT close a session without a signed
Session Block, combined with a signer that does not guarantee
success, means session close MUST block until quorum is regained --
the GEC MUST NOT close the session with an unsigned or partially-
signed Session Block, and MUST NOT silently drop the close request.
On signer failure, the GEC MUST emit a KERNEL_AUDIT_ANOMALY Audit
Alert (Section 7, CRITICAL severity) satisfying KIA-05's own CONF-
KIA-19 requirement that quorum failure surface a
KERNEL_AUDIT_ANOMALY, and MUST retry Stage 4 once quorum is restored.
The session remains open (not closed, not lost) for the duration of
the outage; agent-initiated transitions on that session during the
outage are governed by whatever fail-closed behavior the deployment's
conformance level otherwise requires for a GEC that cannot commit
signed state.
Canonical leaf serialization and domain-separated Merkle
combination (RFC 9162 Section 2.1.1):
The following rules are normative for Stage 2 (Aggregate) and
Stage 3 (Compute Merkle root) of the processing pipeline (Section
14.2). This construction is RFC 9162 [RFC9162] Section 2.1.1's
Merkle Tree Hash (MTH), adopted directly rather than an ad-hoc
variant, specifically because MTH's domain separation between
leaf and internal-node hashes closes the second-preimage /
malleability class of attack (structurally the same class as
CVE-2012-2459) that an undifferentiated SHA-256(left || right)
combination is vulnerable to: without a type-prefix byte, an
Sato Expires 7 March 2027 [Page 54]
Internet-Draft GAR for Agentic AI Systems September 2026
attacker can in principle craft an internal node whose raw bytes
are also a valid leaf hash for a differently-shaped tree with the
same root.
(1) block_id MUST be attached to each event delta record before
Merkle leaf computation. Leaf computation MUST NOT occur
over an event delta record that does not yet carry block_id.
A Session Block whose stored events carry block_id but whose
merkle_root was computed over events lacking block_id is
malformed: the root does not cover the events it claims to
cover, even absent any tampering.
(2) Each Merkle leaf MUST be computed as:
leaf = SHA-256( 0x00 || UTF-8 bytes of
JCS(event_delta_record) )
where 0x00 is a single literal octet prepended before
hashing (the RFC 9162 leaf domain-separation prefix), and
JCS is the JSON Canonicalization Scheme of [RFC8785] applied
to the event delta record (including block_id).
Canonicalization exists to make leaf computation
reproducible byte-for-byte across independent
implementations (e.g. a Python or Go re-implementation of
the same logical entry) regardless of source object field
ordering. Implementations MAY use a conformant JCS library,
or MAY use a reduced canonicalizer covering only the field
types present in a GAR event delta record (strings and
booleans), provided that a general JCS library is used
instead as soon as any field of a different JSON type
(e.g. a number) is introduced.
(3) Parent Merkle nodes MUST be computed by concatenating a
single literal 0x01 octet (the RFC 9162 internal-node
domain-separation prefix) with the raw digest bytes of
their child nodes, not the hex-encoded text of those
digests:
parent = SHA-256( 0x01 || left_digest_bytes ||
right_digest_bytes )
Hex encoding, where used (e.g. for storage, for
soos.gar.event_merkle_root, or for transmission), MUST be
applied only at the point of storage or transmission of the
final root, never as an intermediate step during tree
construction. Concatenating hex text instead of raw bytes
at any level of the tree is non-conformant and produces a
root that does not verify against an independent, correct
Sato Expires 7 March 2027 [Page 55]
Internet-Draft GAR for Agentic AI Systems September 2026
implementation. Omitting the 0x00/0x01 domain-separation
prefixes is equally non-conformant: it produces a tree with
no cryptographic separation between leaf and internal-node
content, and is the specific defect this construction
exists to close.
(4) Tree shape for an odd node count at any level MUST follow
RFC 9162 Section 2.1.1's recursive split: for n > 1 inputs,
the tree is split into two subtrees at k, the largest power
of two strictly less than n, with the left subtree covering the
first k inputs and the right subtree covering the remaining
n - k. This is applied recursively. Implementations MUST
NOT duplicate the final node of an odd-length level to force
a balanced tree; k-split and duplicate-final-node produce
different roots for the same leaf set, and only the k-split
construction is conformant. For n = 0 (empty tree), the
Merkle root MUST be SHA-256('') (the SHA-256 digest of the
empty string), per RFC 9162 Section 2.1.1's MTH({}) definition.
A verifier MUST reject any inclusion proof presented against
the empty-tree root. [I-D.hillier-scitt-arp] Appendix
Section 4.9 documents the same rejection-at-the-verifier
rationale for its own, differently-valued empty-tree
convention (thirty-two zero octets rather than SHA-256('')):
any value a verifier can reproduce for an empty input must
be rejected explicitly, rather than trusted as a root that
commits to something, regardless of which specific value a
given construction adopts.
CONF-GAR-BLOCK-02: The GEC MUST perform Merkle leaf and root
computation exactly as specified in items (1) through (4) above,
including the 0x00/0x01 domain-separation prefixes. This
requirement exists to ensure Session Blocks verify identically
across independent, interoperating implementations, and to close
the malleability class named above; see Section 14.6 for the
corresponding SCITT boundary requirement.
14.4. Tamper Evidence Model
Sato Expires 7 March 2027 [Page 56]
Internet-Draft GAR for Agentic AI Systems September 2026
The tamper evidence model provides two independent integrity
layers:
Layer 1 -- Span hash chain (within a Session Block):
soos.gar.prev_span_hash forms a linked list within the session.
Any modification to a span changes its hash. The modification
propagates: the next span's prev_span_hash no longer matches.
Deletion of a span breaks the chain.
Layer 2 -- Session Block Merkle root and KIA signature (across
the Session Block):
Any span modification changes the event delta record, which
changes the Merkle leaf, which changes the Merkle root, which
invalidates the KIA signature.
These two layers operate independently. An attacker who can
forge a KIA signature cannot also repair the span hash chain
(the two layers use different key material and different
structures).
14.5. FROST Threshold Signing
FROST threshold signing (per [I-D.sato-soos-kia]) is RECOMMENDED
for high-availability deployments where the GEC operates as a
cluster. The KIA signature requested in Stage 4 of the processing
pipeline MAY be a FROST threshold signature rather than a single
Ed25519 signature.
FROST threshold signing is not required for correctness. The
same KIA keypair and the same Merkle root produce an equivalent
tamper evidence guarantee whether signed by a single key or by
a FROST threshold.
14.6. SCITT Alignment
Sato Expires 7 March 2027 [Page 57]
Internet-Draft GAR for Agentic AI Systems September 2026
The GAR Session Block Merkle anchoring model is structurally
compatible with SCITT's transparent append-only ledger.
CONF-GAR-SCITT-01 (informative): At Level 3 GEC conformance,
GEC implementations SHOULD submit Session Block anchor records
to a SCITT transparency log via SCRAPI (Section 10.2).
SCITT-compatible transparency statements for Session Block
anchors MUST use the same domain-separated, JCS-canonicalization-
plus-SHA-256 binding rule specified in Section 14.3 items (1)
through (4). No separate or additional encoding step is
introduced at the SCITT boundary: the payload bound into the
SCITT Signed Statement's registration policy hash is the
identical Session Block merkle_root produced by Section 14.3,
hex-decoded to raw bytes before being carried in the Signed
Statement. This keeps the value verifiable via Section 14.3
alone, without a regulator or third-party verifier needing to
understand any SCITT-specific transform. This resolution is
consistent with the Canonical Payload Binding profile currently
under discussion in the SCITT working group; should that
profile's final text impose additional requirements, a future
GAR revision will reconcile against it.
The architectural parallel: a SCITT Signed Statement is a signed
claim about an artifact. A GAR Session Block is a signed claim
about a governance session. The SCITT issuance protocol
(SCRAPI) can carry Session Block anchor records as SCITT Signed
Statements with the SOOS GAR content type.
15. Security Considerations
The GAR audit architecture relies on the following security
properties:
GEC signing key integrity:
All SAR, Audit Alert, IDP Commitment Verification Record, and
Audit Package chain-of-custody signatures depend on the
integrity of the GEC's Ed25519 signing key. At Level 3, the
key MUST be bound to a RATS-attested execution environment. At
Level 2, the key MUST be held in the isolated GEC process,
inaccessible to agent code. At Level 1, key protection is
application-managed; HSM controls are RECOMMENDED. Key
compromise MUST be treated as a critical security incident
requiring immediate rotation. (REVISED, WIMSE checklist A5
fix) "Re-signing all affected audit artifacts" was previously
stated here as a compromise-response requirement -- this is a
Direct Conflict with the Event Log append-only property
immediately below: an already-committed, already-SCITT-anchored
Sato Expires 7 March 2027 [Page 58]
Internet-Draft GAR for Agentic AI Systems September 2026
SAR or ALE entry cannot be re-signed in place without rewriting
it, which this document elsewhere treats as tampering (see
Section 14.4). The correct remediation on key compromise is:
(a) rotate to a new signing key immediately; (b) generate a
new, separately-signed GEC_KEY_COMPROMISE_DISCLOSED Event Log
entry identifying the compromised key's fingerprint and the
compromise window (best-effort start and end timestamps); (c)
treat every SAR, Audit Alert, and ALE entry signed under the
compromised key during that window as suspect-but-not-
invalidated evidence -- their original signatures remain part
of the historical record exactly as committed, and a Verified
External Auditor evaluating them MUST cross-reference the
compromise window disclosed in (b) rather than expect a fresh
signature. Nothing in this document is re-signed in place;
compromise disclosure is itself a new, append-only artifact.
Routine key rotation cadence: (NEW, WIMSE checklist A5 fix)
this document does not mandate a specific rotation interval
(deployment-dependent), but operators MUST publish a stated
rotation policy, and the JWKS endpoint (Section 6.1) MUST
retain every superseded-but-not-compromised signing key
indefinitely, or for at least the SAR retention period declared
under Section 6.4, whichever is longer -- a verifier validating
a historically-signed SAR after routine rotation MUST be able
to resolve the key that was current at signing time, not only
the GEC's current key.
Event Log append-only property:
The Event Log MUST be implemented as an append-only data
structure. No API MUST allow deletion or modification of
existing entries. Audit Principals and Verified External
Auditors MUST have read-only access.
Non-suppressibility:
The GEC MUST NOT expose any interface that allows an agent,
application, HEM Principal, or Audit Principal to suppress SAR
generation, Audit Alert firing, or IDP Commitment Verification.
Implementations MUST be reviewed for any code path that could
conditionally skip these operations.
Compromised-but-signing GEC (residual risk, Level 1/2): (NEW,
WIMSE checklist F2 fix) Every check this document defines --
Merkle recomputation, signature verification, SCITT append-only
anchoring -- verifies that an artifact matches what the GEC
signed, not that the GEC's signing was trustworthy at signing
time. An attacker who achieves code execution inside a Level 1
or Level 2 GEC without extracting the Ed25519 private key can
sign arbitrary false SARs, Audit Alerts, and ALE entries --
Sato Expires 7 March 2027 [Page 59]
Internet-Draft GAR for Agentic AI Systems September 2026
including an ALE_AUTHORITY_RESTORED entry lifting its own
mandate_hold, or a governance_decision: ALLOW SAR for a session
that actually violated CAP policy -- and every downstream check
in this document would pass. Section 12.1's R-8 (Compromise)
carve-out addresses this for exactly one event type (external KIA
Verification Service signing); it is
not addressed generally. At Level 3, RATS hardware attestation
is the actual mitigation. At Level 1 and Level 2, non-
suppressibility against a fully-compromised (not merely key-
stolen) GEC is probabilistic at best, consistent with how
Section 10.3 already treats SCITT submission as Level 1's
compensating control rather than a guarantee. Implementations
MUST NOT represent Level 1/2 conformance as providing non-
suppressibility against this threat class; operators requiring
that guarantee MUST deploy at Level 3.
Audit Principal separation:
Audit Principals MUST be registered separately from HEM
Principals. The same party SHOULD NOT hold both roles for the
same SO Type. Separation prevents a principal from suppressing
audit findings about their own HEM decisions.
Verified External Auditor access:
GEC interfaces for Verified External Auditor access MUST enforce
scope limitations at the query layer. Access grants MUST expire
automatically. The GEC MUST reject queries outside the declared
scope. (NEW) This is the GAR-side half of an evidence-visibility
gap shared with [I-D.sato-soos-kia] Section 6.6/14.4/15.12
(evidence visible to unintended federation verifiers): both
documents currently defer the cross-cutting mechanism (encrypting
Evidence to the intended verifier's key, following the draft-ritz-
seat-proxies pattern) to a successor specification, and are cross-
referenced here so that successor-doc work treats this as one
shared problem rather than two independently-deferred ones. Until
that mechanism lands, KIA's interim operational SHOULD (minimizing
Lead/intermediate verifier fan-out) is the only mitigation; this
section's own query-layer scoping addresses GAR's access grant
surface but does not by itself close the KIA-side federation-
topology exposure.
PRD review_date enforcement:
Operators MUST ensure that PRD review_date values reflect genuine
governance review cycles. Stale PRDs with extended review_dates
undermine the living governance record property that PRD is
designed to provide.
SCITT submission integrity:
At Level 3, SAR submission to a SCITT transparency log is
Sato Expires 7 March 2027 [Page 60]
Internet-Draft GAR for Agentic AI Systems September 2026
REQUIRED. Implementations MUST verify that the SCITT transparency
log returns a valid receipt before recording SAR_SCITT_SUBMITTED.
A failed SCITT submission at Level 3 MUST be treated as a critical
audit finding and MUST trigger a CRITICAL Audit Alert.
Personal data in ALE event records:
ALE event records may contain personal data as defined in
Regulation (EU) 2016/679 (GDPR) [GDPR] Article 4(1). In
particular: agent_id and Party Registry identifiers may be
directly or indirectly linked to natural persons;
revocation_reason and disposition_rationale fields MUST NOT
contain personal data beyond what is necessary for the governance
record purpose; session_id and mandate_jwt_id values may
constitute pseudonymous identifiers under GDPR Article 4(5).
Operators MUST assess ALE retention periods against applicable
data protection law. Operators subject to GDPR SHOULD consider
whether ALE records containing identifiers linked to natural
persons are subject to the Article 17 right to erasure, and MUST
ensure that erasure obligations can be satisfied without
compromising the integrity of the audit causal chain -- for
example, by pseudonymizing personal identifiers in archived ALE
records while preserving causal ordering fields.
Session revocation and re-authorization:
For session revocation trigger taxonomy and continuation mandate
authority, see [I-D.sato-soos-mad] Sections 3.6.4 and 3.6.6.
WAL tamper-evidence (S.15.a):
The GAR Write-Ahead Log (WAL) MUST carry the prev_span_hash
field (equal to soos.gar.prev_span_hash) on every entry.
Each entry's prev_span_hash MUST be computed by the kernel
over the preceding WAL entry before writing. A WAL that is
missing an entry (gap in the prev_span_hash chain) or whose
prev_span_hash does not match the preceding entry is tampered
or corrupted. Implementations MUST detect and alert on both
conditions.
OTel semantic layer integrity (S.15.b):
Three attack surfaces exist for the soos.governance.* OTel
attribute namespace:
(1) Namespace collision: an adversary adds soos.governance.*
attributes to non-governance spans to pollute the audit
stream. Defense: the GAR Processor (Section 14) MUST
validate that spans carrying soos.governance.* attributes
originate from the authenticated kernel process (via
OTel resource attributes carrying the KIA identity).
Spans with soos.governance.* attributes from unauthenticated
Sato Expires 7 March 2027 [Page 61]
Internet-Draft GAR for Agentic AI Systems September 2026
processes MUST be quarantined and generate a
KERNEL_AUDIT_ANOMALY entry.
(2) Span suppression: an adversary deletes governance spans
before they reach the GAR Processor. Defense: the
prev_span_hash chain (Section 13.7) detects gaps. A
gap in the chain generates a KERNEL_AUDIT_ANOMALY entry.
(3) Span replay: an adversary replays an earlier governance
span to replace a later one. Defense: the
soos.governance.session_id and session_sequence_number
fields detect out-of-order or duplicate spans within a
session. The Session Block Merkle root detects content
tampering.
CVE-2026-50141 class defense (S.15.c):
CVE-2026-50141 class refers to attacks in which an agent
fabricates a verified identity in the audit record -- claiming
a KIA-verified identity without possessing the corresponding
key material. Defense: the GEC MUST NOT accept agent-
supplied identity claims for the kernel_id, soos.governance.
kernel_id, or xpid fields in GAR records and ALE entries.
These fields MUST be derived from the KIA attestation chain
([I-D.sato-soos-kia]) by the GEC, not from agent-supplied
metadata. The XPID mirror field (Section 8.7) MUST be
derived from KIA-verified identity per the same rule.
Layer 1 / Layer 2 coverage asymmetry (S.15.d):
The two tamper evidence layers of Section 14.4 do not cover
the same fields, and this is a documented, intentional
property of the design, not a silent gap.
Layer 1 (soos.gar.prev_span_hash, Section 2) covers exactly
the six fields in its formula: session_id, decision,
kernel_id, cap_profile_hash, timestamp, and the preceding
prev_span_hash. Layer 1 does NOT cover entry_id,
causal_parent_id, or any Section 13.3 provenance field,
including cedar_policy_id, cap_rrs_control_id,
authority_source_uri, tier, conflict_detected,
escalation_class, or so_reference.
Only Layer 2 (Session Block Merkle recomputation, Section
14.3) detects tampering to those fields, because Layer 2
covers the full canonicalized event delta record. Verifying
Layer 2, unlike Layer 1, requires a verifier to hold the
complete Session Block rather than a single span and its
immediate predecessor.
Sato Expires 7 March 2027 [Page 62]
Internet-Draft GAR for Agentic AI Systems September 2026
Consequently: implementations or downstream consumers that
need real-time detection of tampering to provenance fields
(for example, a live monitor reacting span-by-span before a
Session Block closes) SHOULD NOT rely on Layer 1 alone for
that purpose, and MUST wait for Layer 2 verification against
a closed, signed Session Block. Whether Layer 1 should be
widened in a future version to cover some or all of these
fields -- trading its current low latency for broader
real-time coverage -- is an open design question tracked as
OQ-GAR-04-01 and is deliberately left unresolved in this
version pending a Decision Record.
Merkle malleability closure (S.15.e):
Prior to this revision, the Merkle tree construction in
Section 14.3 combined child hashes without domain separation
and duplicated the final node of an odd-length level to force
a balanced tree. This combination is structurally the same
malleability class as CVE-2012-2459: absent a type-prefix
byte distinguishing a leaf hash from an internal-node hash,
an attacker can in principle craft an internal node whose raw
bytes double as a valid leaf hash for a differently-shaped
tree yielding the same root, and duplicate-node padding
independently permits multiple distinct trees to produce the
same root for certain odd leaf counts. This revision closes
both: Section 14.3 items (2) and (3) domain-separate leaf and
internal-node hashes with 0x00/0x01 prefixes per RFC 9162 Section
2.1.1, and item (4) replaces duplicate-node padding with RFC
9162's k-split tree shape, which is uniquely determined by leaf
count alone. Implementations of any GAR revision prior to this one
SHOULD be upgraded; Session Blocks anchored under the prior
construction remain internally self-consistent but SHOULD NOT be
assumed malleability-resistant against a sufficiently motivated
adversary with the ability to submit crafted event delta records.
16. IANA Considerations
16.1. GAR Audit Alert Triggers Registry
Sato Expires 7 March 2027 [Page 63]
Internet-Draft GAR for Agentic AI Systems September 2026
This document establishes the "Governance Audit Record Audit Alert
Triggers" registry.
Registration procedure: Specification Required.
Initial values:
+------------------------------------------+-----------+-----------+
| Trigger Identifier | Severity | Reference |
+------------------------------------------+-----------+-----------+
| KERNEL_AUDIT_ANOMALY | CRITICAL | Sec. 7.3 |
| IDP_COMMITMENT_GAP | CRITICAL | Sec. 7.3 |
| CAP_TRANSPARENCY_VIOLATION | CRITICAL | Sec. 8.3 |
| TERMINATE_DECISION | HIGH | Sec. 7.3 |
| AUTO_APPROVE_DISPOSITION | HIGH | Sec. 7.3 |
| HEM_CHAIN_EXHAUSTED | HIGH | Sec. 7.3 |
| MISSION_REVOKE_CASCADE | HIGH | Sec. 7.3 |
| MANDATE_NARROWING_VIOLATION | HIGH | Sec. 7.3 |
| HEM_TERMINATE_RATIONALE_REQUIRED | MEDIUM | Sec. 7.3 |
| THREE_OR_MORE_HEM_EVENTS_IN_SESSION | MEDIUM | Sec. 7.3 |
| PRD_REVIEW_DATE_EXCEEDED | MEDIUM | Sec. 7.3 |
| POLICY_RATIONALE_GAPS_IN_SAR | LOW | Sec. 7.3 |
| CATALOG_VERSION_CONFLICT_ACTIVE | HIGH | Sec. 12.17|
| INTERPRETATION_SUPERSEDED_ACTIVE | HIGH | Sec. 12.18|
| OTEL_SPAN_CHAIN_GAP | CRITICAL | Sec. 15 |
| OTEL_NAMESPACE_COLLISION | HIGH | Sec. 15 |
+------------------------------------------+-----------+-----------+
Table 3: Initial GAR Audit Alert Triggers Registry Values
16.2. GAR Auditor Principal Types Registry
Sato Expires 7 March 2027 [Page 64]
Internet-Draft GAR for Agentic AI Systems September 2026
This document establishes the "Governance Audit Record Auditor
Principal Types" registry.
Registration procedure: Standards Action.
Initial values:
+---------------------------+---------------------------------------+
| Type | Description |
+---------------------------+---------------------------------------+
| HEM_PRINCIPAL | Resolves HEM escalations. |
| | NOT an auditor. |
+---------------------------+---------------------------------------+
| AUDIT_PRINCIPAL | Receives Audit Alerts, reviews SARs, |
| | initiates Type 4 scheduled audits. |
| | Read-only GEC access. |
+---------------------------+---------------------------------------+
| VERIFIED_EXTERNAL_AUDITOR | Regulator or accounting firm. |
| | Time-limited, scope-limited GEC |
| | access. Produces Audit Packages. |
+---------------------------+---------------------------------------+
| GEC_SELF_AUDITOR | Architectural property of the GEC. |
| | Not a human role. |
+---------------------------+---------------------------------------+
Table 4: Initial GAR Auditor Principal Types Registry Values
16.3. GAR Authority Lifecycle Event Types Registry
Sato Expires 7 March 2027 [Page 65]
Internet-Draft GAR for Agentic AI Systems September 2026
This document establishes the "Governance Audit Record Authority
Lifecycle Event Types" registry.
Registration procedure: Specification Required.
Initial values:
+-------------------------------------+-------+-------------------+
| Event Type | Class | Reference |
+-------------------------------------+-------+-------------------+
| ALE_SESSION_REVOKED | SA | Sec. 12.3 |
| ALE_AUTHORITY_SUSPENDED | SA | Sec. 12.4 |
| ALE_PARTIAL_STATE_RECORDED | SA | Sec. 12.5 |
| ALE_RECOVERY_INITIATED | SA | Sec. 12.6 |
| ALE_PARTIAL_STATE_DISPOSITION | SA | Sec. 12.7 |
| ALE_CREDENTIAL_RESTORED | SA | Sec. 12.8 |
| ALE_KIA_REATTESTATION_COMPLETED | SA | Sec. 12.9 |
| ALE_AUTHORITY_RESTORED | SA | Sec. 12.10 |
| ALE_DELEGATION_CHILD_REVOKED | MA | Sec. 12.11 |
| ALE_CLUSTER_PARTIAL_REVOCATION | MA | Sec. 12.12 |
| ALE_SIBLING_REVOCATION_NOTICE | MA | Sec. 12.13 |
| ALE_DELEGATION_TREE_RECOVERY_INIT. | MA | Sec. 12.14 |
| ALE_CLUSTER_BUDGET_TRANSFER | RG | Sec. 8.5 |
| ALE_CLUSTER_BLOCK_START | RG | Sec. 8.5 |
| ALE_CLUSTER_BLOCK_END | RG | Sec. 8.5 |
| CAP_CONSENT_EXCEPTION_ACTIVATED | CA | Sec. 12.15 |
| CAP_CATALOG_CONFLICT_DETECTED | CA | Sec. 12.16 |
| CATALOG_VERSION_CONFLICT | CA | Sec. 12.17 |
| INTERPRETATION_SUPERSEDED | CA | Sec. 12.18 |
| CATALOG_VERSION_CONFLICT_RESOLVED | CA | Sec. 12.19 |
| INTERPRETATION_SUPERSEDED_RESOLVED | CA | Sec. 12.20 |
+-------------------------------------+-------+-------------------+
Class values:
SA = Single-Agent lifecycle event.
MA = Multi-Agent topology event.
RG = Resource Governance event (SA-15a, DR-DATA-ARCH-01).
CA = Constitutional/Catalog event.
Table 5: Initial GAR Authority Lifecycle Event Types Registry Values
16.4. GAR OTel Attribute Namespaces Registry
Sato Expires 7 March 2027 [Page 66]
Internet-Draft GAR for Agentic AI Systems September 2026
This document establishes the "SOOS Governance OTel Attribute
Namespaces" registry at:
https://www.iana.org/assignments/soos-otel-namespaces
Registration procedure: Specification Required.
Initial values:
+-----------------------+---------------------+-----------------+
| Namespace | Description | Reference |
+-----------------------+---------------------+-----------------+
| soos.governance.* | Core governance | Section 13.2 |
| | decision attributes | |
| soos.cap.* | Cedar policy | Section 13.3 |
| | provenance | |
| soos.acd.* | ACD handshake | Section 13.4 |
| soos.consent.* | Consent governance | Section 13.5 |
| soos.mandate.* | Mandate scope | Section 13.6 |
| soos.gar.* | Integrity chain | Section 13.7 |
+-----------------------+---------------------+-----------------+
Table 6: SOOS Governance OTel Attribute Namespaces
Note to the RFC Editor
This document contains two deliberate normative downrefs.
RFC 8785 (JSON Canonicalization Scheme): the digest construction
in Section 14.3 depends on RFC 8785's specific canonicalization
rules, and no substitute canonicalization scheme would produce
the same, interoperable digest. This reference is not currently
in the Downref Registry.
RFC 9162 (Certificate Transparency Version 2.0): the Merkle Tree
Hash construction in Section 14.3 is taken verbatim from RFC 9162
Section 2.1.1. This reference is already listed in the Downref
Registry.
Please carry both downrefs in the Last Call announcement per
Section 2 of RFC 8067.
17. References
17.1. Normative References
Sato Expires 7 March 2027 [Page 67]
Internet-Draft GAR for Agentic AI Systems September 2026
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
2119 Key Words", BCP 14, RFC 8174, May 2017.
[RFC9052] Schaad, J., "CBOR Object Signing and Encryption (COSE):
Structures and Process", RFC 9052, August 2022.
[RFC9562] Davis, B., Peabody, C., and P. Leach, "Universally
Unique IDentifiers (UUIDs)", RFC 9562, May 2024.
[RFC8785] Rundgren, A., Jordan, B., and S. Erdtman, "JSON
Canonicalization Scheme (JCS)", RFC 8785, June 2020.
[RFC9162] Laurie, B., Messeri, E., and R. Stradling, "Certificate
Transparency Version 2.0", RFC 9162, December 2021.
[I-D.sato-soos-idp]
Sato, T., "The Intent Declaration Primitive (IDP) for
Agentic AI Systems", draft-sato-soos-idp-06, September
2026.
[I-D.sato-soos-hem]
Sato, T., "The Human Escalation Mechanism (HEM) for
Agentic AI Systems", draft-sato-soos-hem-07,
September 2026.
[I-D.sato-soos-cap]
Sato, T., "Constitutional AI Protocol (CAP) for Agentic
AI Systems", draft-sato-soos-cap-06, September 2026.
[I-D.sato-soos-sov]
Sato, T., "The Sovereign Object (SOV) for Agentic AI
Systems", draft-sato-soos-sov-03, September 2026.
[I-D.sato-soos-mjwt]
Sato, T., "The Mandate JWT (MJWT) for Agentic AI Systems",
draft-sato-soos-mjwt-06, September 2026.
[I-D.sato-soos-mad]
Sato, T., "Multi-Agent Delegation (MAD) for Agentic AI
Systems", draft-sato-soos-mad-05, September 2026.
[I-D.sato-soos-kia]
Sato, T., "Kernel Identity Attestation (KIA) for Agentic
AI Systems", draft-sato-soos-kia-06, September 2026.
[I-D.sato-soos-cap-rrs]
Sato, T., "Constitutional AI Protocol -- Regulation Record
Sato Expires 7 March 2027 [Page 68]
Internet-Draft GAR for Agentic AI Systems September 2026
Specification (CAP-RRS)", draft-sato-soos-cap-rrs-04,
September 2026.
[I-D.sato-soos-acd]
Sato, T., "Agent Compliance Disclosure (ACD) for
Agentic AI Systems", draft-sato-soos-acd-02, September
2026, work in progress.
[I-D.ietf-scitt-architecture]
Birkholz, H., et al., "An Architecture for Trustworthy
and Transparent Digital Supply Chains",
draft-ietf-scitt-architecture-22, work in progress.
[SCITT-SCRAPI]
Birkholz, H., et al., "SCITT Reference API",
draft-ietf-scitt-scrapi, work in progress.
[OPENTELEMETRY]
OpenTelemetry Authors, "OpenTelemetry Specification",
<https://opentelemetry.io/docs/specs/otel/>.
17.2. Informative References
Sato Expires 7 March 2027 [Page 69]
Internet-Draft GAR for Agentic AI Systems September 2026
[RFC9672] Backman, A., Scurtescu, M., Zundel, B., Hunt, P., and
Jones, M., "Shared Signals: A Secure Webhooks Framework",
RFC 9672, November 2024.
[EU-AI-ACT]
European Parliament and Council, "Regulation (EU)
2024/1689 laying down harmonised rules on artificial
intelligence", OJ L 2024/1689, July 2024.
[GDPR] European Parliament and Council, "Regulation (EU)
2016/679 on the protection of natural persons with regard
to the processing of personal data", OJ L 2016/119, 2016.
[I-D.mih-sato-agent-accountability-composition]
Mih, S., Sato, T., Schrock, I., Bu, S., and A. Sokolov,
"Agent Accountability: Composition and Conformance",
draft-mih-sato-agent-accountability-composition-01,
work in progress.
[I-D.sokolov-rats-aep-composition]
Sokolov, A., "Composing Application-Layer Action
Evidence with Remote Attestation Procedures",
draft-sokolov-rats-aep-composition-04, work in
progress.
[I-D.hillier-scitt-arp]
Hillier, J. D., "Attestation Reconciliation Protocol",
draft-hillier-scitt-arp-03, 13 August 2026, work in
progress.
Appendix A. Vibe Coding Assets
Sato Expires 7 March 2027 [Page 70]
Internet-Draft GAR for Agentic AI Systems September 2026
This appendix provides structured machine-readable references to
support AI-assisted implementation of GAR. Informative.
C.1. Protocol Summary
Protocol: Governance Audit Record (GAR)
Version: draft-sato-soos-gar-07
Family: SOOS protocol suite
Role: Audit architecture -- non-suppressible, causally-ordered,
domain-separated-Merkle-anchored, OTel-observable,
SCITT-anchored governance record
New in -05: corrected (domain-separated) Merkle construction per
RFC 9162 Section 2.1.1, closing a CVE-2012-2459-class
malleability defect (S.15.e); subject_digest field on
Cedar-evaluation records (S.8.6), positioning GAR as a
conforming AEP instance for cross-slot composition
New in -02: SCITT profile declaration (SA-02); ALE event category
(SA-13, now Section 12); record_id MUST on
DENY/ESCALATE/SUSPEND (SA-10);
HEM_LAYER_DISCREPANCY in Section 8.2 (cross-ref: HEM
Section 6.5)
C.2. Key Identifiers
SAR fields (new in -02): causal_parent_id, session_sequence_number,
governance_decision (ALLOW|DENY|ESCALATE|SUSPEND), ale_events[]
Cedar-evaluation fields (new in -05): subject_digest
ALE event chain: ALE-001 -> ALE-003 -> ALE-004 -> ALE-005 ->
ALE-006/007 -> ALE-008 (single agent)
Multi-agent ALE: ALE-009, ALE-010, ALE-011, ALE-012
Resource governance ALE: ALE-018, ALE-019, ALE-020
Constitutional/Catalog ALE (Class CA): ALE-NEW-01 through
ALE-NEW-04 (Sections 12.15-12.18)
New alert trigger: CAP_TRANSPARENCY_VIOLATION (CRITICAL)
C.3. Canonical Reference
Specification: https://soosproject.ai/drafts/gar
Datatracker: https://datatracker.ietf.org/doc/draft-sato-soos-gar/
Stack overview: https://soosproject.ai/stack
Appendix B. Changes from Previous Versions
Sato Expires 7 March 2027 [Page 71]
Internet-Draft GAR for Agentic AI Systems September 2026
D.1. Changes from draft-sato-soos-gar-05
Substantive changes, surfaced by a WIMSE-style security review pass
against -05's own text and reference sample code:
o Section 6.1: new JWKS trust-anchor bootstrap requirement -- the
JWKS endpoint URL MUST be bound to the operator via the same out-
of-band channel used for the deployment's broader trust chain, not
discovered from session-supplied metadata.
o Section 15 (GEC signing key integrity): corrected. -05's key-
compromise remediation required "re-signing all affected audit
artifacts," which is a Direct Conflict with the Event Log append-
only property this document requires elsewhere (Section 8, Section
14.4) -- an already-committed artifact cannot be re-signed without
rewriting it. -06 replaces this with: immediate key rotation, a
new GEC_KEY_COMPROMISE_DISCLOSED Event Log entry naming the
compromised key and compromise window, and treatment of artifacts
signed during that window as suspect-but-not-invalidated
historical record. A routine (non-incident) key-rotation
requirement is also added: operators MUST publish a rotation
policy, and the JWKS endpoint MUST retain superseded-but-not-
compromised keys for at least the Section 6.4 SAR retention
period.
o Section 15: new "Compromised-but-signing GEC" entry disclosing
that Level 1/2 non-suppressibility is probabilistic, not
guaranteed, against a GEC compromised without key extraction --
the R-8 (Section 12.1) carve-out addressed only one event type;
this generalizes the disclosure.
o Section 14.3 (CONF-GAR-BLOCK-01): new "Signer failure at close"
paragraph defining GEC behavior when the KIA signer cannot produce
a signature (FROST quorum failure) -- session close blocks and
retries rather than proceeding unsigned, and a
KERNEL_AUDIT_ANOMALY Audit Alert is required, satisfying KIA-05's
own CONF-KIA-19.
o Section 6.2 (causal_parent_id): now MUST reference an existing
sar_id, verified by the GEC before SAR commitment, matching the
referential-integrity requirement this document already imposes on
ALE prior_event_id (Section 12.1). A dangling reference is now a
KERNEL_AUDIT_ANOMALY finding rather than silently accepted.
o Section 6.2 (session_sequence_number): new guidance distinguishing
a transient concurrent-session-race gap from a persistent one, and
recommending rate-limiting of gap-triggered alerts, to close an
alert-fatigue DoS-adjacent vector.
Sato Expires 7 March 2027 [Page 72]
Internet-Draft GAR for Agentic AI Systems September 2026
o Idnits repair: bracket citations removed from the Abstract; two
Informational-maturity references ([I-D.mih-sato-agent-
accountability-composition], [I-D.sokolov-rats-aep-composition])
moved from Normative to Informative; four missing inline citations
added ([GDPR], [EU-AI-ACT], [OPENTELEMETRY], [SCITT-SCRAPI]);
[RFC8936] dropped as genuinely unused; "NOT REQUIRED" de-
capitalized to "Not Required" (Table 6a, descriptive not an RFC
2119 keyword); non-ASCII characters (one em-dash, two section
signs) replaced with ASCII equivalents; four stale sibling-draft
reference versions updated (mjwt-02->04, kia-03->05, acd-00->01,
sokolov-rats-aep-composition-03->04).
D.2. Changes from draft-sato-soos-gar-04
This revision is fully self-contained: Sections 1 through 12 are
reproduced in full rather than carried forward unreproduced, as
-03 and -04 did. The following substantive changes are also
made:
o Section 14.3: the Merkle leaf and internal-node hash
construction is corrected. -04's construction combined child
hashes without domain separation (SHA-256(left || right)) and
duplicated the final node of an odd-length level to force a
balanced tree. This is structurally the same malleability
class as CVE-2012-2459. -05 replaces it with RFC 9162
[RFC9162] Section 2.1.1's Merkle Tree Hash construction verbatim:
leaves are SHA-256(0x00 || JCS(event_delta_record)), internal
nodes are SHA-256(0x01 || left || right), and odd-length
levels use the k-split recursive tree shape (split at k, the
largest power of two strictly less than n) rather than
duplicate-node padding. CONF-GAR-BLOCK-02 is updated
accordingly. New Security Considerations entry S.15.e names
this closure explicitly.
o Section 8.6: new field subject_digest, REQUIRED on every GAR
record produced by a Cedar policy evaluation. Uses the same
SHA-256(JCS(action)) construction as the shared cross-slot
join key of [I-D.mih-sato-agent-accountability-composition],
positioning a conforming GAR record as an AEP instance under
[I-D.sokolov-rats-aep-composition] Section 3. Normatively
prohibits independent re-serialization where an upstream
party (for example, the CAN slot) has already established the
action's canonical serialization; the corresponding OTel
attribute soos.cap.subject_digest and consistency rule
CONF-GAR-OTEL-02 are added to Section 13.3.
o Section 14.6: SCITT Alignment updated to state the domain-
separated construction explicitly, rather than the pre-fix
formula. OQ-OTEL-03's resolution is unaffected in substance.
Sato Expires 7 March 2027 [Page 73]
Internet-Draft GAR for Agentic AI Systems September 2026
o Two new normative references: [RFC9162] (Certificate
Transparency Version 2.0, for the Merkle Tree Hash
construction) and
[I-D.mih-sato-agent-accountability-composition] and
[I-D.sokolov-rats-aep-composition] (for the subject_digest
cross-slot join and AEP-instance positioning). One new
informative reference: [I-D.hillier-scitt-arp], for the
general statement of the re-serialization failure mode and
for the empty-tree rejection-at-the-verifier rationale
(Section 14.3), which is documented there for a different,
differently-valued empty-tree convention and is cited for the
shared underlying argument rather than as a shared value.
o Considered and explicitly declined: adding ARP-specific
"authority-reference digest" and "receipt-payload digest"
fields natively to GAR. Both are defined by
[I-D.hillier-scitt-arp] for its own reconciliation admission
process, not by [I-D.mih-sato-agent-accountability-composition];
a GAR record's existing KIA signature and event delta record
already supply what a consuming reconciliation process would
derive them from, without coupling GAR's own schema to one
specific consumer.
o Section 1: the companion-specifications sentence is corrected
to add [I-D.sato-soos-kia], [I-D.sato-soos-mad],
[I-D.sato-soos-cap-rrs], and [I-D.sato-soos-acd] -- all four
are used substantively throughout the document's normative
text (signing and attestation, session revocation semantics,
the Section 8.6 provenance fields, and acd_session_id
respectively) but were absent from this list since at least
-02. [I-D.sato-soos-acd] was also a dangling reference --
cited in Section 6.2 with no corresponding entry in Section
17 -- inherited from -03 and corrected here.
D.3. Changes from draft-sato-soos-gar-00
o Throughout: "governing kernel" and "kernel" renamed to "Governing
Enforcement Component (GEC)" and "GEC". The JSON field name
kernel_signature is preserved across all artifact types for wire-
format compatibility with -00 implementations. The label field
within kernel_signature MUST indicate the GEC conformance level
(L1, L2, or L3) per [I-D.sato-soos-idp] Section 9.
o Section 1: SCITT integration paragraph added. Reference to
[I-D.sato-soos-sov] and [I-D.sato-soos-mjwt] added.
o Section 2: GEC definition added. GEC-signed definition added.
Sovereign Object definition added.
Sato Expires 7 March 2027 [Page 74]
Internet-Draft GAR for Agentic AI Systems September 2026
o Section 3: Architecture diagram updated to reflect GEC rename.
o Section 5.4: "Kernel Self-Auditor" renamed to "GEC Self-Auditor".
o Section 6.2: so_id field added to SAR schema. mandate_id field
clarified to reference [I-D.sato-soos-mjwt] jti claim.
o Section 6.1: GEC signing key reference updated for conformance
level model.
o Section 10: SCITT Integration added (new section). Specifies SAR
as SCITT Signed Statement, SCRAPI Audit Package submission, and
per-conformance-level requirements.
o Section 11 (was 10): EU AI Act section renumbered.
o Section 12 (was 14a): Authority Lifecycle Events promoted to
sequential section number. Security and IANA sections renumbered
accordingly (Security: 13, IANA: 14, References: 15).
o Section 15 (was 13): References updated. IDP updated to -04.
HEM updated to -04. CAP promoted from informative to normative.
SOV-01, MJWT-01, and SCITT architecture draft added.
SCITT-SCRAPI moved to normative references.
o Sections 13 and 14 (Security, IANA) subsequently renumbered to
15 and 16 in -03, to make room for the SOOS Governance Semantic
Convention (Section 13) and the SOOS GAR Processor (Section
14) introduced in that revision; References moved to 17. See
D.1 above for the -04-to-05 delta against the resulting
structure.
Author's Address
Tom Sato
MyAuberge K.K.
Email: tomsato@myauberge.jp
Sato Expires 7 March 2027 [Page 75]