{
  "policy": "https://commonagent.net/attestation/checks-0.1.json",
  "version": "0.1.0",
  "about": "The checks an agent attestation (https://commonagent.net/attestation.html) is held to: every attribute of the Managed Agent Framework (https://agentmesh.ai/articles/managed-agents.html), 59 checks in 11 areas. An attestation names this file by address and digest, so what passed meant cannot change afterwards. Each check: its area, its id, when it passes, and where the evidence comes from. Where evidence_from says the network, only the party that carries the agent's traffic sees it. Where it names a role, it names the kind of party that produced the evidence, using the open role names at https://agentroles.ai; a team that did not use that lifecycle still has a reviewer and a monitoring tool, and their records count the same way. An attester reports passed, failed or not_attested for each check it has a rule for, and not_attested for the rest; an area passes only when every check it reports in that area passed.",
  "results": ["passed", "failed", "not_attested"],
  "kinds": {
    "artifact": "A fact about the version itself, true or false at the moment it was checked. The check carries a bare result.",
    "conduct": "A fact about how the agent behaved over a period. The check carries its result and the period the evidence spans, as covers: { from, to }, so a reader never has to guess what passed spanned."
  },
  "conduct_checks": [
    "identity.acts-for", "authority.mandates", "authority.delegation-narrows", "spend.who-pays", "spend.cost-per-job", "spend.over-limit-refused",
    "provenance.known-flaws", "inside.personal-data-guarded", "inside.step-tracing", "people.owners-ok", "people.decision-kept",
    "records.who-asked", "records.what-it-did", "records.errors-kept", "records.readable-by-others",
    "watching.working-now", "watching.alerts-with-owner", "watching.quality-over-time", "watching.incidents",
    "stopping.pause", "stopping.credentials-revoked", "stopping.stop-holds"
  ],
  "areas": [
    { "id": "identity", "name": "Identity", "question": "who it is, and who answers for it" },
    { "id": "authority", "name": "Authority", "question": "what it may do, and for whom" },
    { "id": "spend", "name": "Spend", "question": "what it may cost" },
    { "id": "reach", "name": "Reach", "question": "what it can touch" },
    { "id": "provenance", "name": "Provenance", "question": "how it was made" },
    { "id": "inside", "name": "Inside the agent", "question": "how it behaves while it works" },
    { "id": "people", "name": "People in the loop", "question": "when a person decides" },
    { "id": "records", "name": "Records", "question": "what it has done" },
    { "id": "watching", "name": "Watching", "question": "whether it is working" },
    { "id": "stopping", "name": "Stopping", "question": "who can halt it" },
    { "id": "change", "name": "Change", "question": "how it changes, and how it ends" }
  ],
  "checks": [
    { "area": "identity", "id": "unique-name", "passes_when": "The name is bound to this agent and was never held by another.", "evidence_from": "the registrar" },
    { "area": "identity", "id": "bound-to-key", "passes_when": "The registered descriptor is signed by the agent's own key.", "evidence_from": "the registration" },
    { "area": "identity", "id": "named-owner", "passes_when": "A person or organization is named as answering for it.", "evidence_from": "the deployment record" },
    { "area": "identity", "id": "acts-for", "passes_when": "Every request it made traced back to the person it acted for.", "evidence_from": "the network" },
    { "area": "identity", "id": "exact-version", "passes_when": "The running digest equals the digest in the signed build record.", "evidence_from": "the build and deployment records" },

    { "area": "authority", "id": "declared-offerings", "passes_when": "What it does and refuses is written down and signed.", "evidence_from": "the registration" },
    { "area": "authority", "id": "mandates", "passes_when": "Each piece of work carried a signed statement of what it may do and for whom.", "evidence_from": "the network" },
    { "area": "authority", "id": "delegation-narrows", "passes_when": "No authority it passed on was larger than what it held.", "evidence_from": "the network" },
    { "area": "authority", "id": "access-while-working", "passes_when": "Its rights are held per task, expire and can be revoked.", "evidence_from": "the identity provider" },
    { "area": "authority", "id": "enforced-outside", "passes_when": "Something other than the agent decides what it may do.", "evidence_from": "the network, or the deployment record" },

    { "area": "spend", "id": "ceilings", "passes_when": "A limit per task and per period, set by the owner, was in place before it started.", "evidence_from": "the deployment record" },
    { "area": "spend", "id": "who-pays", "passes_when": "Every cost landed on a named account.", "evidence_from": "the network, or the billing records" },
    { "area": "spend", "id": "cost-per-job", "passes_when": "Every spend traces to a job, and the total reconciles.", "evidence_from": "the watcher's cost records" },
    { "area": "spend", "id": "over-limit-refused", "passes_when": "Work that would pass a ceiling was stopped before it spent.", "evidence_from": "the network, or a conformance case" },

    { "area": "reach", "id": "declared-systems", "passes_when": "Every system it uses is named, and the package's runtime requirements match.", "evidence_from": "the architecture record and the package" },
    { "area": "reach", "id": "network-fence", "passes_when": "It can reach only those systems.", "evidence_from": "the network, or the deployment record" },
    { "area": "reach", "id": "own-secrets", "passes_when": "Its credentials are its own, placed by name, shared with nobody.", "evidence_from": "the deployment record" },
    { "area": "reach", "id": "data-kept", "passes_when": "What it stores, where and for how long is stated.", "evidence_from": "the operator's data-use declaration" },

    { "area": "provenance", "id": "built-in-stages", "passes_when": "The statement of the job, the tests and the code were made in that order, and the tests failed before the code existed.", "evidence_from": "the spec writer's, test writer's and code writer's records" },
    { "area": "provenance", "id": "reviewed", "passes_when": "Review and security review were held by someone other than the code's author, with every finding answered.", "evidence_from": "the code critic and security reviewer (records or SARIF)" },
    { "area": "provenance", "id": "signed-build", "passes_when": "The build record is signed, verifies, and matches the package.", "evidence_from": "the package maker" },
    { "area": "provenance", "id": "runs-as-approved", "passes_when": "What runs is exactly what was approved and released.", "evidence_from": "the network, or the deployment record" },
    { "area": "provenance", "id": "conforms", "passes_when": "A signed verdict says it does what it declared and nothing it refused.", "evidence_from": "the conformance checker" },
    { "area": "provenance", "id": "bill-of-materials", "passes_when": "Every library, model and outside tool is listed with its version.", "evidence_from": "CycloneDX or SPDX" },
    { "area": "provenance", "id": "trusted-sources", "passes_when": "Every dependency is pinned and verified by checksum or signature.", "evidence_from": "the bill of materials, or SLSA provenance" },
    { "area": "provenance", "id": "known-flaws", "passes_when": "A scan found no unanswered critical vulnerabilities, within the last 30 days.", "evidence_from": "a vulnerability scan, and VEX for answered findings" },
    { "area": "provenance", "id": "model-and-prompts-pinned", "passes_when": "The model is named, and the prompts are inside the package the digest covers.", "evidence_from": "the descriptor and the package" },
    { "area": "provenance", "id": "reproducible", "passes_when": "Two independent builds give the same digest.", "evidence_from": "two SLSA provenance records" },

    { "area": "inside", "id": "no-endless-loops", "passes_when": "It stops when it repeats itself or stops making progress.", "evidence_from": "the agent's framework" },
    { "area": "inside", "id": "model-routing", "passes_when": "Each step goes to a model chosen for it.", "evidence_from": "the agent's framework" },
    { "area": "inside", "id": "personal-data-guarded", "passes_when": "Personal data is masked or kept out of prompts, replies and logs.", "evidence_from": "the agent's framework, or an eval" },
    { "area": "inside", "id": "injected-instructions-ignored", "passes_when": "Instructions hidden in what it reads are treated as content.", "evidence_from": "an eval or red-team run, graded by the agent critic" },
    { "area": "inside", "id": "tool-calls-checked", "passes_when": "Each tool call is checked against what the tool accepts.", "evidence_from": "the agent's framework" },
    { "area": "inside", "id": "replies-checked", "passes_when": "A reply is checked against its promised form before it leaves.", "evidence_from": "the agent's framework" },
    { "area": "inside", "id": "time-limits", "passes_when": "Slow calls give up after a set time and retry within a limit.", "evidence_from": "the agent's framework" },
    { "area": "inside", "id": "step-tracing", "passes_when": "Every step, model call and tool call is traced with timing, tokens and cost.", "evidence_from": "OpenTelemetry GenAI traces" },

    { "area": "people", "id": "approval-thresholds", "passes_when": "Which acts need a person is set in advance by risk, and those acts escalate.", "evidence_from": "the spec writer's record and the conformance checker" },
    { "area": "people", "id": "owners-ok", "passes_when": "Anything that committed the owner or moved money waited for the owner.", "evidence_from": "the network" },
    { "area": "people", "id": "enough-context", "passes_when": "The person deciding sees what the agent wants to do and why.", "evidence_from": "the operator's statement" },
    { "area": "people", "id": "decision-kept", "passes_when": "Every yes and no is recorded with who gave it.", "evidence_from": "the network" },

    { "area": "records", "id": "who-asked", "passes_when": "Every piece of work names who asked and for whom.", "evidence_from": "the network" },
    { "area": "records", "id": "what-it-did", "passes_when": "Each act is recorded with its inputs and result, and no promised record is missing.", "evidence_from": "the network and the conformance checker" },
    { "area": "records", "id": "errors-kept", "passes_when": "Failures are recorded, not dropped.", "evidence_from": "the network" },
    { "area": "records", "id": "immutable-evidence", "passes_when": "Records are only added to, and each is signed.", "evidence_from": "the network" },
    { "area": "records", "id": "readable-by-others", "passes_when": "Someone outside the team could read the evidence; the attester did.", "evidence_from": "the attester itself" },

    { "area": "watching", "id": "working-now", "passes_when": "There is a current answer to whether it is working, or an open alert.", "evidence_from": "the watcher" },
    { "area": "watching", "id": "alerts-with-owner", "passes_when": "A named person is told within a stated time when it fails.", "evidence_from": "the watcher" },
    { "area": "watching", "id": "quality-over-time", "passes_when": "Its answers are graded against a standard set beforehand.", "evidence_from": "the agent critic" },
    { "area": "watching", "id": "incidents", "passes_when": "Every alert that fired has a written timeline.", "evidence_from": "the incident recorder" },

    { "area": "stopping", "id": "pause", "passes_when": "A named person can pause it, and it resumes only when they say.", "evidence_from": "the network" },
    { "area": "stopping", "id": "end", "passes_when": "A named person can end it for good.", "evidence_from": "the network" },
    { "area": "stopping", "id": "credentials-revoked", "passes_when": "A stop revokes its credentials at once.", "evidence_from": "the network" },
    { "area": "stopping", "id": "stop-holds", "passes_when": "Every door checks the stop, so a stopped agent stays stopped.", "evidence_from": "the network" },
    { "area": "stopping", "id": "name-never-reused", "passes_when": "An ended agent's name is never given to another.", "evidence_from": "the registrar" },

    { "area": "change", "id": "versioned", "passes_when": "Every release has a version, and earlier ones stay on record.", "evidence_from": "the package maker" },
    { "area": "change", "id": "impact-on-others", "passes_when": "Every dependent was named and answered before the change.", "evidence_from": "the impact analyst" },
    { "area": "change", "id": "approved-with-reason", "passes_when": "The change has a reason and an approver.", "evidence_from": "the deployment manager's update record" },
    { "area": "change", "id": "rollback-on-purpose", "passes_when": "Any rollback was a recorded step, with what could not be undone.", "evidence_from": "the deployment manager" },
    { "area": "change", "id": "retired-cleanly", "passes_when": "When ended, its key was retired, its data handled as stated and its dependents told.", "evidence_from": "the deployment manager" }
  ]
}