Episode 220 - GluuFederation/identerati-office-hours GitHub Wiki

Title: Not Promises: Attesting What Your AI Agent Is

Host: Mike Schwartz, Founder/CEO Gluu
Guest: Imran Siddique, Chief Platform Officer, OPAQUE Systems

Channels

Linkedin Event
Youtube Video
Short: 30 days later: Prove the same agent is in prod?

Description

Identity infrastructure answers who called. Agentic systems must also answer what was actually running. Imran Siddique, Chief Platform Officer at OPAQUE, will show how hardware attestation can verify an agent’s runtime state beyond tokens and audit logs. He’ll cover agentrust-io projects including TRACE, Agent Manifest, and Confidential MCP, plus real failure modes and the work’s direction within the Agentic AI Foundation.

Homework

TRACE, the attestation record format. Start with the spec README and the conformance levels.
Confidential MCP — . The most mature running code, and the fastest way to see enforcement rather than description.
AgenTrust-IO Project Hub - home to incubate several projects
CSA Webinar: The Verifiable Agent Virtual Briefing
Imran's new book Architecting at Scale: A Practical Guide to Large-Scale System Design: From Monolith to AI-Native, Beyond Scaling Servers

Takeaways

⚡ Deployment intent is not proof of runtime state. Agent Manifest addresses the “day 1 versus day 30” problem: can you prove the model, policy, and other artifacts running now are what you approved?
⚡ Attestation comes in different assurance levels. TPMs, TEEs and Virtual Confidential Computing can provide much stronger guarantees because the governed workload cannot simply rewrite the evidence.
⚡ TRACE is evidence, not telemetry. Telemetry can be a firehose; TRACE is intended to preserve the durable facts an auditor or investigator needs to reconstruct what happened.
⚡ Proof should bind execution to policy. A TRACE record can identify the model, runtime measurement, policy bundle, data classification and tool activity so a third party can independently verify what actually ran.
⚡ Default deny fits agentic systems particularly well. Instead of trying to enumerate everything an unpredictable agent must not do, declare what it may do and deny everything else.