The Linux Foundation has introduced an open standard designed to create verifiable records of what AI agents actually do during operation, addressing a core security problem as organizations deploy autonomous systems in production environments. The specification, called Trust, Runtime Attestation and Compliance Evidence (TRACE), was developed by confidential computing vendor OPAQUE with backing from AMD, Intel, Microsoft and the Technology Innovation Institute. It aims to make AI activity more transparent, auditable and trustworthy by generating hardware-backed, cryptographically verifiable records that link the runtime environment, software executed, policies applied, data classifications and tools used by an AI agent.
TRACE combines existing Internet Engineering Task Force and Internet Research Task Force standards into what's designed to function as a tamper-resistant receipt for an AI agent's activity. The specification bundles RFC 9711 for the claim envelope, RFC 9334 for the attester, verifier and relying-party roles, and the SCITT draft for transparency-ledger anchoring. It relies on AMD's Secure Encrypted Virtualization, a hardware-based security technology that encrypts virtual machine memory so host hypervisors and cloud administrators can't access sensitive data. The resulting evidence is built to be portable across cloud providers, confidential computing environments and sovereign infrastructure, giving organizations a way to independently verify how an AI workload operated. The reference library recorded nearly 135,000 PyPI downloads within 10 weeks of its initial introduction at the Confidential Computing Summit in June 2026.
According to OPAQUE, the recent cyber incident in which OpenAI agents compromised Hugging Face infrastructure while AI models were undergoing a cybersecurity evaluation "underscored a fundamental challenge for autonomous AI: documented policies and sandbox configurations do not, by themselves, prove which controls remained in force or what a system actually did during execution." The company noted that the same evidence gap applies to open-weight models, where possessing the weights and controlling the infrastructure "provides greater deployment control, but it does not prove that an approved model ran unmodified or that required policies governed its use." OPAQUE CEO Aaron Fulkerson said that while rapid advances mean "we may not always be able to predict how AI models and agents reason," with general adoption of TRACE, "we can control what they're allowed to do and prove what they actually did."
The push for a common standard reflects the shift of AI agents from isolated experiments into production environments that handle sensitive data and interact with multiple systems. The Linux Foundation will provide vendor-neutral governance for the specification, with CEO Jim Zemlin stating in an August 25 public statement that this vendor-neutral governance should "make trust in AI open, portable and verifiable" across different infrastructure. The specification, technical documentation and reference implementations are available through TRACE's project resources and GitHub repository, giving developers the tools to integrate hardware-attested governance records into their AI deployments. The standard's portability across cloud providers means organizations won't be locked into a single vendor's verification approach.
With AI agents increasingly granted access to live systems and real-world actions, the ability to cryptographically prove what happened during execution becomes critical for compliance, incident response and accountability. TRACE offers a way to close the gap between what organizations document as policy and what actually runs in production, creating an auditable trail that survives even if the AI operator or cloud provider disputes what occurred. Organizations evaluating autonomous AI deployments now have a framework that treats verification as infrastructure, not documentation. The broader question facing enterprise decision-makers is whether to adopt attestation standards proactively or wait until regulatory mandates force the issue, potentially at higher integration cost and with fewer vendor options.