TRACE gives AI agents a portable, hardware-attested runtime evidence format

On August 25, 2026, the Linux Foundation announced that it had accepted TRACE — Trust, Runtime Attestation and Compliance Evidence — from OPAQUE into vendor-neutral governance. TRACE defines a portable signed 'Trust Record' for AI agents and confidential workloads. A record can bind the model and weights digest, measured hardware/runtime environment, policy bundle and enforcement mode, data classification, tool-call transcript hashes and supply-chain provenance into evidence rooted in hardware attestation. The project is supported by AMD, Intel, Microsoft, OPAQUE and TII and builds on existing standards including RATS, EAT, SLSA, SCITT and SPIFFE. The current TRACE v0.2 specification is a developer-preview, pre-ratification draft rather than a stable production standard.

Agent governance is usually expressed as configuration or logs controlled by the same operator that ran the workload. TRACE is trying to make selected runtime facts portable and independently verifiable: a customer, auditor or another service could check cryptographic evidence about what model ran, where it ran, what policy was bound to it and which tools were invoked without simply trusting a provider's dashboard. That could matter for regulated agent workflows, cross-cloud deployments and confidential computing where buyers need evidence rather than a policy assertion. The practical caveat is equally important: v0.2 is immature, not every claim proves the semantic correctness of the underlying action, and hardware attestation does not by itself prove that an agent behaved safely.

TRACE's record schema covers workload identity, model identity and weights digest, runtime platform measurements, a policy hash and enforcement mode, data classification, tool-call transcript metadata, build provenance and evidence appraisal. The intent is to produce one signed artifact that travels with the workload and can be checked later by a relying party.

The reference design targets confidential-computing environments such as Intel TDX, AMD SEV-SNP and confidential GPUs. By anchoring runtime measurements in hardware attestation, TRACE aims to let a verifier establish that particular code and policy artifacts ran in a measured environment rather than accepting a self-reported compliance log. The specification composes existing attestation and supply-chain standards instead of inventing an entirely separate trust stack.

TRACE includes a tool-transcript claim that can bind a transcript hash and call count into the signed record. That is particularly relevant to agent systems because consequential behavior often occurs through MCP, A2A or other tools rather than the model's text output. A verifier can establish that the evidence record refers to a specific execution trace, although TRACE does not magically prove that every tool call was appropriate or harmless.

The August contribution moves TRACE from a vendor-originated specification into Linux Foundation governance with named support from several major hardware and software companies. That does not guarantee adoption, but it gives implementers a neutral venue to evolve the schema and conformance requirements across clouds and hardware vendors.

The project labels TRACE v0.2 a developer preview and request-for-comments draft and tells implementers to read its limitations before production reliance. The schema, wire format and conformance requirements can change before v1.0. Builders should therefore experiment with TRACE as an interoperability layer or audit artifact, not represent current v0.2 records as universally recognized compliance certification.