proof-carrying-agent-actions

name	proof-carrying-agent-actions
version	v1.0.0
last_updated	2026-06-12T00:00:00.000Z
description	Runtime governance framework for heterogeneous agent systems using action certificates. Model-agnostic governance centered on action proofs rather than vendor-native session records. From Anthropic research (arXiv:2606.04104).

Proof-Carrying Agent Actions

Framework for runtime-neutral governance of heterogeneous agent systems through action certificates.

Purpose

Agent systems execute through runtimes with different control points (local coding tools, SDKs, managed platforms, API gateways). This makes it difficult to answer governance questions consistently: what action was authorized, under whose authority, and with what evidence after execution? PCAA solves this by centering on an action certificate rather than vendor-native session records.

Core Framework

Action Certificate Structure

Each agent action carries a proof that includes:

Field	Description
Action Identity	What action was performed (canonical representation)
Authority Chain	Who authorized it (user, system policy, delegation)
Approval Semantics	Under what conditions (explicit, implicit, scoped)
Execution Evidence	Proof that the action matched authorization
Runtime Context	Where it was executed (agnostic of specific platform)

Governance Model

1. Authorization Layer: Define what actions are permitted under which conditions
2. Proof Generation: Each action produces a certificate at execution time
3. Proof Verification: Independent verification that execution matched authorization
4. Audit Trail: Certificates form an immutable governance log

Cross-Runtime Compatibility

The key insight is that a "publish data externally" action looks different in every runtime:

• Local coding tool: shell command
• Framework SDK: tool call
• Managed platform: hosted session transition
• API gateway: HTTP request

PCAA provides a canonical representation that works across all runtimes.

Implementation Patterns

Pattern 1: Action Canonicalization

1. Parse runtime-specific action representation
2. Map to canonical action type (read, write, execute, network)
3. Extract parameters and targets
4. Generate action fingerprint

Pattern 2: Certificate Generation

1. Capture authorization context at decision time
2. Record action identity with parameters
3. Attach authority chain (who approved)
4. Compute execution evidence hash
5. Sign certificate with runtime key

Pattern 3: Certificate Verification

1. Verify signature integrity
2. Check authorization chain validity
3. Compare execution evidence against authorization
4. Flag any deviations for review
5. Log verification result

Activation Keywords

• proof-carrying agent actions
• agent governance framework
• runtime governance
• agent action certificate
• heterogeneous agent systems
• agent authorization proof
• 智能体治理
• 运行时治理
• agent audit trail

Resources

• Paper: https://arxiv.org/abs/2606.04104
• Related: security-guardrails, spec-driven-agent-architecture, agent-integration-testing

Notes

• Model-agnostic: works with any LLM or agent framework
• Designed for multi-runtime environments
• Certificates should be independently verifiable
• Authority chains support delegation and scoped permissions