-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathindex.html
More file actions
1462 lines (1265 loc) · 71.9 KB
/
index.html
File metadata and controls
1462 lines (1265 loc) · 71.9 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>OATS — Open Agent Trust Stack</title>
<meta name="description" content="A System Specification for Zero-Trust AI Agent Execution. Open standard for securing autonomous AI agents through structural enforcement.">
<meta name="keywords" content="OATS, AI security, zero-trust, agent trust, tool contracts, ORGA loop, AI governance">
<meta property="og:title" content="OATS — Open Agent Trust Stack">
<meta property="og:description" content="A System Specification for Zero-Trust AI Agent Execution">
<meta property="og:type" content="website">
<meta property="og:url" content="https://openagenttruststack.org">
<link rel="preconnect" href="https://fonts.googleapis.com">
<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
<link href="https://fonts.googleapis.com/css2?family=DM+Serif+Display:ital@0;1&family=JetBrains+Mono:wght@400;500;600&family=Source+Serif+4:ital,opsz,wght@0,8..60,300;0,8..60,400;0,8..60,600;1,8..60,400&display=swap" rel="stylesheet">
<style>
:root {
--bg-deep: #0c0c0f;
--bg-surface: #131318;
--bg-elevated: #1a1a22;
--bg-sidebar: #101014;
--border: #2a2a35;
--border-subtle: #1e1e28;
--text-primary: #e8e6e1;
--text-secondary: #9a9790;
--text-tertiary: #6b6860;
--accent: #c8a44e;
--accent-dim: #a08030;
--accent-glow: rgba(200, 164, 78, 0.12);
--accent-glow-strong: rgba(200, 164, 78, 0.25);
--red: #c45050;
--green: #5a9a6a;
--blue: #5080b0;
--serif: 'DM Serif Display', Georgia, serif;
--body: 'Source Serif 4', Georgia, serif;
--mono: 'JetBrains Mono', 'Consolas', monospace;
--sidebar-w: 280px;
--content-max: 820px;
}
*, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }
html {
scroll-behavior: smooth;
scroll-padding-top: 2rem;
}
body {
font-family: var(--body);
font-size: 17px;
line-height: 1.72;
color: var(--text-primary);
background: var(--bg-deep);
-webkit-font-smoothing: antialiased;
-moz-osx-font-smoothing: grayscale;
}
/* ── Noise overlay ── */
body::before {
content: '';
position: fixed;
inset: 0;
z-index: 9999;
pointer-events: none;
opacity: 0.025;
background-image: url("data:image/svg+xml,%3Csvg viewBox='0 0 256 256' xmlns='http://www.w3.org/2000/svg'%3E%3Cfilter id='n'%3E%3CfeTurbulence type='fractalNoise' baseFrequency='0.9' numOctaves='4' stitchTiles='stitch'/%3E%3C/filter%3E%3Crect width='100%25' height='100%25' filter='url(%23n)'/%3E%3C/svg%3E");
background-size: 256px 256px;
}
/* ── Sidebar ── */
.sidebar {
position: fixed;
top: 0;
left: 0;
width: var(--sidebar-w);
height: 100vh;
background: var(--bg-sidebar);
border-right: 1px solid var(--border-subtle);
overflow-y: auto;
z-index: 100;
display: flex;
flex-direction: column;
scrollbar-width: thin;
scrollbar-color: var(--border) transparent;
}
.sidebar-header {
padding: 2rem 1.5rem 1.5rem;
border-bottom: 1px solid var(--border-subtle);
flex-shrink: 0;
}
.sidebar-logo {
font-family: var(--mono);
font-size: 0.7rem;
font-weight: 600;
letter-spacing: 0.2em;
text-transform: uppercase;
color: var(--accent);
margin-bottom: 0.25rem;
}
.sidebar-title {
font-family: var(--serif);
font-size: 1.15rem;
color: var(--text-primary);
line-height: 1.3;
}
.sidebar-meta {
font-family: var(--mono);
font-size: 0.65rem;
color: var(--text-tertiary);
margin-top: 0.75rem;
line-height: 1.7;
letter-spacing: 0.02em;
}
.sidebar-meta span {
display: block;
}
.sidebar-nav {
padding: 1rem 0;
flex: 1;
overflow-y: auto;
}
.sidebar-nav a {
display: block;
padding: 0.35rem 1.5rem;
font-family: var(--mono);
font-size: 0.68rem;
color: var(--text-tertiary);
text-decoration: none;
transition: all 0.2s ease;
letter-spacing: 0.01em;
line-height: 1.5;
border-left: 2px solid transparent;
}
.sidebar-nav a:hover {
color: var(--text-secondary);
background: var(--accent-glow);
}
.sidebar-nav a.active {
color: var(--accent);
border-left-color: var(--accent);
background: var(--accent-glow);
}
.sidebar-nav .nav-section {
padding: 0.6rem 1.5rem 0.25rem;
font-family: var(--mono);
font-size: 0.6rem;
font-weight: 600;
letter-spacing: 0.15em;
text-transform: uppercase;
color: var(--text-tertiary);
opacity: 0.6;
}
.sidebar-nav .nav-section:first-child {
padding-top: 0;
}
.sidebar-footer {
padding: 1rem 1.5rem;
border-top: 1px solid var(--border-subtle);
flex-shrink: 0;
}
.sidebar-footer a {
display: inline-block;
font-family: var(--mono);
font-size: 0.62rem;
color: var(--text-tertiary);
text-decoration: none;
letter-spacing: 0.05em;
transition: color 0.2s;
}
.sidebar-footer a:hover {
color: var(--accent);
}
.sidebar-footer a + a {
margin-left: 1rem;
}
/* ── Main content ── */
.main {
margin-left: var(--sidebar-w);
min-height: 100vh;
}
/* ── Hero ── */
.hero {
position: relative;
padding: 6rem 4rem 5rem;
border-bottom: 1px solid var(--border);
overflow: hidden;
}
.hero::before {
content: '';
position: absolute;
top: -60%;
right: -20%;
width: 700px;
height: 700px;
background: radial-gradient(ellipse, var(--accent-glow-strong) 0%, transparent 70%);
pointer-events: none;
}
.hero-badge {
display: inline-block;
font-family: var(--mono);
font-size: 0.65rem;
font-weight: 600;
letter-spacing: 0.2em;
text-transform: uppercase;
color: var(--accent);
padding: 0.35rem 0.8rem;
border: 1px solid var(--accent-dim);
border-radius: 2px;
margin-bottom: 2rem;
background: var(--accent-glow);
}
.hero h1 {
font-family: var(--serif);
font-size: clamp(2.4rem, 5vw, 3.6rem);
color: var(--text-primary);
line-height: 1.15;
margin-bottom: 0.75rem;
max-width: 700px;
}
.hero h1 em {
font-style: italic;
color: var(--accent);
}
.hero-subtitle {
font-family: var(--body);
font-size: 1.15rem;
color: var(--text-secondary);
max-width: 600px;
line-height: 1.7;
margin-bottom: 2.5rem;
}
.hero-details {
display: flex;
gap: 2.5rem;
flex-wrap: wrap;
}
.hero-detail {
font-family: var(--mono);
font-size: 0.7rem;
color: var(--text-tertiary);
letter-spacing: 0.02em;
}
.hero-detail strong {
display: block;
font-size: 0.6rem;
letter-spacing: 0.12em;
text-transform: uppercase;
color: var(--text-secondary);
margin-bottom: 0.15rem;
font-weight: 600;
}
/* ── Content area ── */
.content {
max-width: var(--content-max);
padding: 3rem 4rem 6rem;
}
/* ── Section styling ── */
.section {
margin-bottom: 4rem;
opacity: 0;
transform: translateY(12px);
animation: fadeUp 0.5s ease forwards;
}
@keyframes fadeUp {
to { opacity: 1; transform: translateY(0); }
}
.section-divider {
width: 40px;
height: 1px;
background: var(--accent-dim);
margin-bottom: 2rem;
}
.section-number {
font-family: var(--mono);
font-size: 0.62rem;
font-weight: 600;
letter-spacing: 0.15em;
text-transform: uppercase;
color: var(--accent-dim);
margin-bottom: 0.5rem;
}
h2 {
font-family: var(--serif);
font-size: 1.9rem;
color: var(--text-primary);
line-height: 1.2;
margin-bottom: 1.5rem;
}
h3 {
font-family: var(--serif);
font-size: 1.3rem;
color: var(--text-primary);
line-height: 1.3;
margin-top: 2.5rem;
margin-bottom: 1rem;
}
h4 {
font-family: var(--mono);
font-size: 0.78rem;
font-weight: 600;
letter-spacing: 0.08em;
text-transform: uppercase;
color: var(--accent);
margin-top: 2rem;
margin-bottom: 0.75rem;
}
p {
margin-bottom: 1.15rem;
color: var(--text-secondary);
}
p strong {
color: var(--text-primary);
font-weight: 600;
}
a {
color: var(--accent);
text-decoration: none;
transition: color 0.2s;
}
a:hover {
color: var(--text-primary);
}
/* ── Lists ── */
ul, ol {
margin-bottom: 1.15rem;
padding-left: 1.5rem;
color: var(--text-secondary);
}
li {
margin-bottom: 0.5rem;
}
li strong {
color: var(--text-primary);
}
/* ── Code blocks ── */
code {
font-family: var(--mono);
font-size: 0.85em;
color: var(--accent);
background: var(--bg-elevated);
padding: 0.15em 0.4em;
border-radius: 3px;
}
pre {
background: var(--bg-elevated);
border: 1px solid var(--border);
border-radius: 4px;
padding: 1.25rem 1.5rem;
margin-bottom: 1.5rem;
overflow-x: auto;
position: relative;
}
pre code {
background: none;
padding: 0;
font-size: 0.8rem;
line-height: 1.65;
color: var(--text-secondary);
}
pre::before {
content: '';
position: absolute;
top: 0;
left: 0;
width: 3px;
height: 100%;
background: var(--accent-dim);
border-radius: 4px 0 0 4px;
}
/* ── Tables ── */
table {
width: 100%;
border-collapse: collapse;
margin-bottom: 1.5rem;
font-size: 0.9rem;
}
thead th {
font-family: var(--mono);
font-size: 0.68rem;
font-weight: 600;
letter-spacing: 0.1em;
text-transform: uppercase;
color: var(--accent);
text-align: left;
padding: 0.75rem 1rem;
border-bottom: 2px solid var(--accent-dim);
background: var(--bg-elevated);
}
tbody td {
padding: 0.75rem 1rem;
border-bottom: 1px solid var(--border-subtle);
color: var(--text-secondary);
vertical-align: top;
}
tbody td strong {
color: var(--text-primary);
font-family: var(--mono);
font-size: 0.82rem;
}
tbody tr:hover {
background: var(--accent-glow);
}
/* ── Callout boxes ── */
.callout {
background: var(--bg-elevated);
border: 1px solid var(--border);
border-left: 3px solid var(--accent);
padding: 1.25rem 1.5rem;
margin-bottom: 1.5rem;
border-radius: 0 4px 4px 0;
}
.callout p:last-child {
margin-bottom: 0;
}
.callout-title {
font-family: var(--mono);
font-size: 0.68rem;
font-weight: 600;
letter-spacing: 0.1em;
text-transform: uppercase;
color: var(--accent);
margin-bottom: 0.5rem;
}
/* ── Conformance tags ── */
.req-tag {
display: inline-block;
font-family: var(--mono);
font-size: 0.62rem;
font-weight: 600;
letter-spacing: 0.08em;
padding: 0.2rem 0.5rem;
border-radius: 2px;
margin-right: 0.5rem;
vertical-align: middle;
}
.req-must {
color: var(--red);
border: 1px solid var(--red);
background: rgba(196, 80, 80, 0.08);
}
.req-should {
color: var(--blue);
border: 1px solid var(--blue);
background: rgba(80, 128, 176, 0.08);
}
/* ── Trust model boxes ── */
.trust-grid {
display: grid;
grid-template-columns: 1fr 1fr 1fr;
gap: 1rem;
margin-bottom: 1.5rem;
}
.trust-box {
background: var(--bg-elevated);
border: 1px solid var(--border);
border-radius: 4px;
padding: 1rem 1.25rem;
}
.trust-box h5 {
font-family: var(--mono);
font-size: 0.65rem;
font-weight: 600;
letter-spacing: 0.12em;
text-transform: uppercase;
margin-bottom: 0.75rem;
}
.trust-box.trusted h5 { color: var(--green); }
.trust-box.untrusted h5 { color: var(--red); }
.trust-box.partial h5 { color: var(--accent); }
.trust-box ul {
padding-left: 1rem;
margin-bottom: 0;
}
.trust-box li {
font-size: 0.82rem;
margin-bottom: 0.3rem;
}
/* ── Architecture pillars ── */
.pillars {
display: grid;
grid-template-columns: 1fr 1fr 1fr;
gap: 1.25rem;
margin: 2rem 0;
}
.pillar {
background: var(--bg-elevated);
border: 1px solid var(--border);
border-top: 2px solid var(--accent);
border-radius: 0 0 4px 4px;
padding: 1.5rem;
}
.pillar-number {
font-family: var(--mono);
font-size: 0.6rem;
color: var(--accent-dim);
letter-spacing: 0.1em;
margin-bottom: 0.5rem;
}
.pillar h4 {
font-family: var(--serif);
font-size: 1rem;
text-transform: none;
letter-spacing: 0;
color: var(--text-primary);
margin-top: 0;
margin-bottom: 0.5rem;
}
.pillar p {
font-size: 0.88rem;
margin-bottom: 0;
}
/* ── References ── */
.ref-list {
list-style: none;
padding-left: 0;
}
.ref-list li {
padding-left: 0;
font-size: 0.88rem;
margin-bottom: 0.65rem;
padding-left: 1.5rem;
text-indent: -1.5rem;
color: var(--text-tertiary);
}
/* ── Footer ── */
.footer {
border-top: 1px solid var(--border);
padding: 3rem 4rem;
max-width: var(--content-max);
}
.footer-links {
display: flex;
gap: 2rem;
flex-wrap: wrap;
margin-bottom: 1.5rem;
}
.footer-links a {
font-family: var(--mono);
font-size: 0.72rem;
color: var(--text-tertiary);
letter-spacing: 0.03em;
}
.footer-links a:hover {
color: var(--accent);
}
.footer-copy {
font-family: var(--mono);
font-size: 0.62rem;
color: var(--text-tertiary);
letter-spacing: 0.03em;
opacity: 0.6;
}
/* ── Mobile hamburger ── */
.menu-toggle {
display: none;
position: fixed;
top: 1rem;
left: 1rem;
z-index: 200;
width: 40px;
height: 40px;
background: var(--bg-surface);
border: 1px solid var(--border);
border-radius: 4px;
cursor: pointer;
align-items: center;
justify-content: center;
}
.menu-toggle span,
.menu-toggle span::before,
.menu-toggle span::after {
display: block;
width: 18px;
height: 1.5px;
background: var(--text-secondary);
transition: all 0.3s;
}
.menu-toggle span { position: relative; }
.menu-toggle span::before,
.menu-toggle span::after {
content: '';
position: absolute;
left: 0;
}
.menu-toggle span::before { top: -5px; }
.menu-toggle span::after { top: 5px; }
.menu-toggle.open span { background: transparent; }
.menu-toggle.open span::before { transform: rotate(45deg); top: 0; }
.menu-toggle.open span::after { transform: rotate(-45deg); top: 0; }
/* ── Responsive ── */
@media (max-width: 1024px) {
.content, .footer { padding-left: 2.5rem; padding-right: 2.5rem; }
.hero { padding-left: 2.5rem; padding-right: 2.5rem; }
}
@media (max-width: 768px) {
.sidebar {
transform: translateX(-100%);
transition: transform 0.3s ease;
}
.sidebar.open {
transform: translateX(0);
}
.menu-toggle {
display: flex;
}
.main {
margin-left: 0;
}
.hero { padding: 5rem 1.5rem 3rem; }
.hero h1 { font-size: 2rem; }
.content, .footer { padding-left: 1.5rem; padding-right: 1.5rem; }
.pillars, .trust-grid { grid-template-columns: 1fr; }
.hero-details { gap: 1.5rem; }
}
/* ── Staggered animations ── */
.section:nth-child(1) { animation-delay: 0.05s; }
.section:nth-child(2) { animation-delay: 0.1s; }
.section:nth-child(3) { animation-delay: 0.15s; }
</style>
</head>
<body>
<!-- Mobile menu button -->
<button class="menu-toggle" aria-label="Toggle navigation" onclick="toggleSidebar()">
<span></span>
</button>
<!-- Sidebar -->
<aside class="sidebar" id="sidebar">
<div class="sidebar-header">
<div class="sidebar-logo">Specification</div>
<div class="sidebar-title">Open Agent Trust Stack</div>
<div class="sidebar-meta">
<span>v0.1.0-draft</span>
<span>MIT License</span>
<span>ThirdKey AI</span>
</div>
</div>
<nav class="sidebar-nav" id="nav">
<div class="nav-section">Overview</div>
<a href="#abstract">Abstract</a>
<a href="#introduction">1. Introduction</a>
<a href="#related-work">2. Related Work</a>
<a href="#threat-model">3. Threat Model</a>
<div class="nav-section">Architecture</div>
<a href="#orga-loop">4. ORGA Loop</a>
<a href="#tool-contracts">5. Tool Contracts</a>
<a href="#identity">6. Identity Layer</a>
<a href="#policy">7. Policy Enforcement</a>
<a href="#audit">8. Audit Layer</a>
<div class="nav-section">Deployment</div>
<a href="#sandboxing">9. Sandboxing</a>
<a href="#inter-agent">10. Inter-Agent</a>
<a href="#conformance">11. Conformance</a>
<a href="#implementations">12. Implementations</a>
<div class="nav-section">Future</div>
<a href="#research">13. Research</a>
<a href="#conclusion">14. Conclusion</a>
<a href="#references">References</a>
</nav>
<div class="sidebar-footer">
<a href="https://thirdkey.ai">ThirdKey AI</a>
<a href="https://github.com/ThirdKeyAI/OpenAgentTrustStack">GitHub</a>
</div>
</aside>
<!-- Main content -->
<div class="main">
<!-- Hero -->
<header class="hero">
<div class="hero-badge">System Specification</div>
<h1>Open Agent <em>Trust Stack</em></h1>
<p class="hero-subtitle">A system specification for zero-trust AI agent execution. Define what is permitted and make everything else structurally inexpressible.</p>
<div class="hero-details">
<div class="hero-detail">
<strong>Version</strong>
0.1.0-draft
</div>
<div class="hero-detail">
<strong>Status</strong>
Draft
</div>
<div class="hero-detail">
<strong>Authors</strong>
Jascha Wanger / ThirdKey AI
</div>
<div class="hero-detail">
<strong>Date</strong>
2026-03-12
</div>
<div class="hero-detail">
<strong>License</strong>
MIT
</div>
</div>
</header>
<div class="content">
<!-- Abstract -->
<section class="section" id="abstract">
<div class="section-divider"></div>
<div class="section-number">Abstract</div>
<h2>Zero-Trust Agent Execution Through Structural Enforcement</h2>
<p>As AI systems evolve from assistants into autonomous agents executing consequential actions, the security boundary shifts from model outputs to tool execution. Traditional security paradigms — log aggregation, perimeter defense, post-hoc forensics, and even runtime interception of fully-formed actions — cannot adequately protect systems where AI-driven actions are irreversible, execute at machine speed, and originate from potentially compromised orchestration layers.</p>
<p>The fundamental problem is architectural: when the policy gate can be influenced by the LLM it governs, when enforcement correctness is verified only at runtime, and when identity is self-asserted rather than cryptographically verified, security guarantees degrade under adversarial pressure.</p>
<div class="pillars">
<div class="pillar">
<div class="pillar-number">Conviction 01</div>
<h4>Allow-List Enforcement</h4>
<p>Constrain what actions can be expressed through declarative tool contracts, making dangerous actions structurally inexpressible.</p>
</div>
<div class="pillar">
<div class="pillar-number">Conviction 02</div>
<h4>Compile-Time Enforcement</h4>
<p>The ORGA reasoning loop uses typestate programming so that skipping the policy gate is a type error, not a runtime bug.</p>
</div>
<div class="pillar">
<div class="pillar-number">Conviction 03</div>
<h4>Structural Independence</h4>
<p>The Gate phase operates outside LLM influence by construction, not by trust assumption.</p>
</div>
</div>
<p>OATS specifies five layers: <strong>(1)</strong> the ORGA reasoning loop with compile-time phase enforcement, <strong>(2)</strong> declarative tool contracts with typed parameter validation, <strong>(3)</strong> a cryptographic identity stack providing bidirectional trust between agents and tools, <strong>(4)</strong> a formally verifiable policy engine operating on structured inputs, and <strong>(5)</strong> hash-chained cryptographic audit journals with Ed25519 signatures for tamper-evident forensic reconstruction.</p>
<p>OATS is model-agnostic, framework-agnostic, and vendor-neutral. It defines what a compliant agent runtime must enforce, not how it must be implemented. The architecture specified here has been validated through approximately eight months of autonomous operation in a production runtime, moving beyond theoretical frameworks to specify requirements derived from operational experience.</p>
</section>
<!-- 1. Introduction -->
<section class="section" id="introduction">
<div class="section-divider"></div>
<div class="section-number">Section 01</div>
<h2>Introduction</h2>
<h3>1.1 The Problem</h3>
<p>AI agents now execute consequential actions across enterprise systems: querying databases, sending communications, modifying files, invoking cloud services, and managing credentials. These actions are irreversible, execute at machine speed, originate from potentially compromised orchestration layers, and compose into violation patterns invisible when evaluated in isolation.</p>
<p>The security community has correctly identified the action layer as the stable enforcement boundary. Regardless of how agent frameworks, model architectures, or orchestration patterns evolve, actions on tools and APIs remain the point where AI decisions materialize as real-world effects. Security must be enforced at this boundary.</p>
<p>However, identifying the right boundary is necessary but not sufficient. The critical question is <em>how</em> enforcement occurs at that boundary, and current approaches have structural weaknesses that undermine their guarantees.</p>
<h3>1.2 The Allow-List Thesis</h3>
<p>Existing runtime security approaches operate on a deny-list model: the agent formulates an action, the security system intercepts it, evaluates it against policy and context, and decides whether to allow or block it. This model has a fundamental problem: it requires enumerating dangerous behavior. Every deny-list is incomplete by definition. Novel attacks, unanticipated compositions, and edge cases slip through because the system only blocks what it has been told to block.</p>
<p>OATS inverts this model. Instead of intercepting arbitrary actions and deciding which to block, an OATS-compliant runtime constrains what actions can be expressed in the first place. The agent fills typed parameters defined by a declarative tool contract. The runtime validates those parameters against the contract, constructs the invocation from a template, and executes it. The agent never generates raw commands, never constructs API calls directly, never formulates unconstrained actions. Dangerous actions cannot be expressed because the interface does not permit them.</p>
<div class="callout">
<div class="callout-title">Core Thesis</div>
<p>Define what is permitted and make everything else structurally inexpressible, rather than trying to enumerate and block what is dangerous.</p>
</div>
<h3>1.3 Structural Enforcement</h3>
<p>A second structural weakness in existing approaches is that enforcement correctness is verified only at runtime. The policy gate is a software component that can be misconfigured, bypassed through bugs, or circumvented through unanticipated code paths. If the gate fails to execute, actions proceed unguarded.</p>
<p>OATS addresses this through compile-time enforcement of the reasoning loop. The Observe-Reason-Gate-Act (ORGA) cycle uses type-level programming (typestates) so that skipping the Gate phase, dispatching tools without reasoning first, or observing results without dispatching are compile-time errors, not runtime bugs. The type system guarantees that every action passes through policy evaluation.</p>
<h3>1.4 Gate Independence</h3>
<p>The third structural weakness is that existing approaches evaluate actions within systems that process untrusted LLM outputs. The policy engine shares context, memory, and execution environment with the orchestration layer it is supposed to govern. An LLM that has been compromised through prompt injection can potentially influence the evaluation of its own actions.</p>
<p>In OATS, the Gate phase operates outside LLM influence. The Gate receives a structured action proposal and evaluates it against policy using a formally verifiable policy engine. The LLM cannot modify, bypass, or influence the Gate's evaluation. Policy denial is fed back to the LLM as an observation, allowing it to adjust its approach, but the denial itself is not negotiable.</p>
<h3>1.5 Contributions</h3>
<ol>
<li><strong>Typestate-enforced reasoning loop.</strong> The ORGA (Observe-Reason-Gate-Act) cycle with compile-time phase enforcement, ensuring that policy evaluation cannot be skipped, circumvented, or reordered.</li>
<li><strong>Allow-list tool contracts.</strong> A declarative tool contract format that constrains agent-tool interaction to typed, validated parameters, making dangerous actions structurally inexpressible.</li>
<li><strong>Layered cryptographic identity.</strong> A bidirectional identity stack: tool integrity verification and agent identity verification, providing mutual authentication between agents and tools.</li>
<li><strong>Hash-chained audit journals.</strong> Cryptographically signed, hash-chained event journals that provide tamper-evident forensic reconstruction with offline verification.</li>
<li><strong>Conformance requirements.</strong> Minimum requirements for OATS-compliant systems, enabling objective evaluation of implementations and preventing category dilution.</li>
</ol>
</section>
<!-- 2. Related Work -->
<section class="section" id="related-work">
<div class="section-divider"></div>
<div class="section-number">Section 02</div>
<h2>Related Work</h2>
<h3>2.1 Agent Security Research</h3>
<p>The security risks of LLM-based agents have been catalogued by several surveys. Ruan et al. provide comprehensive threat taxonomies covering prompt injection, tool misuse, and data exfiltration in agentic systems. Wu et al. focus on security properties of AI agents, while Su et al. address autonomy-induced risks including memory poisoning and deferred decision hazards. Debenedetti et al. introduce AgentDojo for evaluating attacks and defenses against LLM agents, and Ye et al. propose ToolEmu for identifying risky agent failures. These works characterize the problem space and evaluate agent robustness but operate at the model or benchmark level, not at the runtime action boundary where OATS enforces policy.</p>
<p>Gaire et al. systematize security and safety risks in the Model Context Protocol ecosystem, providing a taxonomy of threats to MCP primitives. Their analysis of tool poisoning and indirect prompt injection directly informs OATS's threat model for tool supply chain attacks.</p>
<h3>2.2 Runtime Security Specifications</h3>
<p>Errico (2026) introduces Autonomous Action Runtime Management (AARM), a system specification for securing AI-driven actions at runtime. AARM formalizes the runtime security gap, proposes an action classification framework, and specifies conformance requirements. OATS shares AARM's identification of the action layer as the stable security boundary. OATS extends this foundation with compile-time enforcement of the reasoning loop, allow-list tool contracts, concrete cryptographic identity protocols, and multi-tier execution isolation.</p>
<h3>2.3 Industry Frameworks</h3>
<p>Google's Cloud CISO perspective advocates defense-in-depth and runtime controls for agents. AWS's Agentic AI Security Scoping Matrix provides a risk assessment framework. Microsoft's governance framework addresses organizational controls including identity management and approval workflows. Raza et al. present a TRiSM framework for agentic multi-agent systems. These frameworks provide lifecycle governance perspectives; OATS focuses specifically on the runtime enforcement layer.</p>
<h3>2.4 Policy Languages and Access Control</h3>
<p>OATS's policy enforcement layer builds on established access control research. RBAC and ABAC evaluate permissions against static attributes but lack session-level context accumulation. Capability-based security constrains authority propagation but does not address the compositional risks of non-deterministic agents. Policy languages such as OPA and Cedar provide expressive evaluation engines suitable as backends for OATS's policy evaluation component. AWS's independent choice of Cedar for their AgentCore runtime validates the architectural thesis that formal policy languages belong at the agent execution boundary.</p>
<h3>2.5 Complementary Standards</h3>
<p><strong>OWASP Top 10 for LLM Applications.</strong> OWASP catalogs vulnerabilities. OATS provides runtime enforcement that mitigates several categories, particularly tool misuse, excessive agency, and insecure output handling.</p>
<p><strong>NIST AI RMF.</strong> NIST provides a risk management framework. OATS provides technical enforcement mechanisms that implement portions of the NIST framework, particularly around governance, monitoring, and accountability.</p>
<p><strong>Model Context Protocol (MCP).</strong> MCP defines a protocol for agent-tool communication. OATS defines how to govern actions flowing through that protocol. The two are complementary: MCP defines the transport, OATS defines the trust.</p>
</section>
<!-- 3. Threat Model -->
<section class="section" id="threat-model">
<div class="section-divider"></div>
<div class="section-number">Section 03</div>
<h2>Threat Model</h2>
<div class="callout">
<div class="callout-title">Fundamental Assumption</div>
<p>The AI orchestration layer cannot be trusted as a security boundary. The model processes untrusted inputs through opaque reasoning, producing actions that may serve attacker goals rather than user intent.</p>
</div>
<h3>3.1 Threats Addressed</h3>
<h4>Prompt Injection (Direct and Indirect)</h4>
<p>Adversaries embed instructions in user input, documents, tool outputs, or multimedia that override the agent's intended behavior. OATS mitigates this at two layers. At the tool contract layer, injected instructions cannot produce arbitrary tool invocations because the contract does not expose parameters that accept raw commands. At the policy layer, actions are evaluated against accumulated session context regardless of how the agent was instructed.</p>
<h4>Confused Deputy</h4>
<p>A privileged agent is tricked into misusing its authority through ambiguous or deceptive instructions. OATS mitigates this through bidirectional identity verification: before an agent invokes a tool, the tool's integrity is verified cryptographically; before a tool accepts an invocation, the agent's identity is verified cryptographically.</p>
<h4>Action Composition / Data Exfiltration</h4>
<p>Individual actions may each satisfy policy while their composition constitutes a breach. OATS tracks data classification across actions within a session through context accumulation. When sensitive data is accessed, subsequent external communications are evaluated against this context.</p>
<h4>Intent Drift</h4>
<p>The agent's actions gradually diverge from the user's original request through its own reasoning process. OATS tracks the chain of intent from original request through each action via context accumulation and semantic distance measurement. When cumulative drift exceeds configured thresholds, the Gate triggers deferral, step-up authorization, or denial.</p>
<h4>Malicious Tool Outputs</h4>
<p>Compromised or adversarial tools return outputs designed to manipulate subsequent agent behavior. OATS tracks tool outputs as part of session state and restricts what actions are permissible after specific tool calls.</p>
<h4>Over-Privileged Credentials</h4>
<p>Agents provisioned with credentials exceeding operational requirements. OATS supports least-privilege enforcement through just-in-time credential issuance and operation-specific token scoping.</p>
<h4>Goal Hijacking and Memory Poisoning</h4>
<p>Adversaries alter the agent's objectives or corrupt persistent memory. OATS operates at the action level: regardless of what objective the agent believes it is pursuing, each action must satisfy policy and align with accumulated context.</p>
<h3>3.2 Tool Supply Chain Attacks</h3>
<p>When agents use tools provided by third parties (MCP servers, API integrations, plugin ecosystems), those tools may be tampered with, impersonated, or silently modified. OATS mitigates tool supply chain attacks through cryptographic tool integrity verification. Tool contracts are signed by their publishers. The runtime verifies signatures before registering tools, rejecting any contract that fails verification.</p>
<h3>3.3 Trust Assumptions</h3>
<div class="trust-grid">
<div class="trust-box trusted">
<h5>Trusted</h5>
<ul>
<li>The OATS runtime (ORGA loop, policy engine, tool contract executor, journal, identity verifier)</li>
<li>Cryptographic primitives and key management infrastructure</li>
<li>The policy store and policy authoring process</li>
<li>The underlying infrastructure (OS, network, hardware)</li>
<li>The compiler and type system</li>
</ul>
</div>
<div class="trust-box untrusted">
<h5>Untrusted</h5>
<ul>
<li>The AI model and its outputs</li>
<li>The orchestration layer</li>
<li>User inputs and prompts</li>
<li>Tool outputs and retrieved data</li>
<li>External documents, emails, web content</li>
<li>Agent memory and conversation history</li>
<li>Tool contracts from unverified publishers</li>
</ul>
</div>
<div class="trust-box partial">
<h5>Partially Trusted</h5>
<ul>
<li>Tool implementations (OATS constrains invocation but cannot prevent bugs within tools)</li>
<li>Human approvers (OATS routes step-up authorization but cannot prevent social engineering)</li>
<li>Verified tool contracts (verified as untampered, but the tool itself may have vulnerabilities)</li>
</ul>
</div>
</div>
</section>
<!-- 4. ORGA Loop -->
<section class="section" id="orga-loop">
<div class="section-divider"></div>
<div class="section-number">Section 04</div>
<h2>Core Architecture: The ORGA Loop</h2>
<p>The ORGA (Observe-Reason-Gate-Act) loop is the core execution engine for OATS-compliant agent runtimes. It drives a multi-turn cycle between an LLM, a policy gate, and external tools through four mandatory phases.</p>
<h3>4.1 Phase Definitions</h3>
<h4>Observe</h4>
<p>Collect results from previous tool executions. Incorporate tool outputs, error messages, policy denial feedback, and environmental signals into the agent's context. This phase also integrates knowledge retrieval (RAG-enhanced context) when available.</p>
<h4>Reason</h4>
<p>The LLM processes accumulated context and produces proposed actions (tool calls or text responses). The LLM sees tool definitions but never sees raw invocation details. The LLM's output is a structured proposal, not an executable action.</p>
<h4>Gate</h4>
<p>The policy engine evaluates each proposed action. This phase operates entirely outside LLM influence. The Gate receives the proposed action, the accumulated session context, and the agent's identity, and evaluates them against organizational policy. The Gate produces one of five decisions: <strong>Allow</strong>, <strong>Deny</strong>, <strong>Modify</strong>, <strong>Step-Up</strong> (pause for human approval), or <strong>Defer</strong> (temporarily suspend pending additional context).</p>
<h4>Act</h4>
<p>Approved actions are dispatched to tool executors. The tool contract executor validates parameters against the contract's type system, constructs the invocation from the contract's template, executes with timeout enforcement, captures output in a structured evidence envelope, and records the execution in the audit journal.</p>
<h3>4.2 Typestate Enforcement</h3>
<p>Phase transitions <span class="req-tag req-must">MUST</span> be enforced at compile time using type-level programming (typestates). Each phase is a distinct type. The transition from Reason to Act without passing through Gate <span class="req-tag req-must">MUST</span> be a type error, not a runtime check.</p>
<pre><code>AgentLoop<Reasoning> -- produce_output() --> AgentLoop<PolicyCheck>
AgentLoop<PolicyCheck> -- check_policy() --> AgentLoop<ToolDispatching>
AgentLoop<ToolDispatching> -- dispatch() --> AgentLoop<Observing>
AgentLoop<Observing> -- observe() --> AgentLoop<Reasoning> | LoopResult</code></pre>
<p>The following are compile-time errors:</p>
<ul>
<li>Skipping the policy check (Reasoning to ToolDispatching)</li>
<li>Dispatching tools without reasoning (PolicyCheck to Observing)</li>
<li>Observing results without dispatching (Reasoning to Observing)</li>
</ul>
<p>Implementations in languages without native typestate support <span class="req-tag req-must">MUST</span> provide equivalent guarantees through runtime enforcement with 100% path coverage testing and formal verification that all tool dispatch paths pass through the Gate.</p>
<h3>4.3 Dynamic Branching</h3>
<p>The only point where the ORGA loop branches dynamically is after the Observe phase: the loop either continues (returning to Reason for another iteration) or completes (producing a final result). This branching is a standard pattern match on a concrete type, not dynamic dispatch. All other phase transitions are strictly linear.</p>
<h3>4.4 Loop Termination</h3>
<p>The loop terminates when:</p>
<ul>
<li>The LLM produces a final text response (no tool calls proposed)</li>
<li>Iteration limits are reached (configurable per deployment)</li>
<li>Token budget is exhausted</li>
<li>Time budget is exhausted</li>
<li>A circuit breaker trips (configurable failure thresholds on tool calls)</li>
</ul>
<h3>4.5 Policy Denial Feedback</h3>
<p>When the Gate denies an action, the denial reason <span class="req-tag req-must">MUST</span> be fed back to the LLM as an observation in the next Observe phase. The LLM may propose alternative actions that satisfy policy, but the Gate evaluates each proposal independently. The denial is not negotiable; only the LLM's subsequent proposals can change.</p>
</section>
<!-- 5. Tool Contracts -->