Agentic Trust Framework
SpecificationMaturity ModelComponentsCompareGetting StartedEcosystemExecutive SummaryFAQTake the Assessment
Components · The Recommended Stack

One Stack. Four Modes.

The open-source components that implement ATF, and the configuration that moves an agent from Intern to Principal without changing a line of its code.

The thesis
Maturity is not a property of the model. It is an operating mode of the whole stack, gated by evidence.

The same agent runs unchanged code at every level. Promotion is a configuration event (a new identity attribute, a tighter policy, a stricter anomaly mode), not a re-architecture. So ATF recommends one stack, plus a per-level configuration matrix. The toolset never changes. Only its configuration does.

§ 1

The Recommended Stack

Five ATF elements, the open-source primitives the lab validated, and why each was chosen. Every tool is present at every level. What changes is configuration, not the toolset.

ElementOpen-source toolsWhy this
IdentityATF-ID · who is acting
SPIFFE / SPIREX.509 SVIDAgent registry
Workload-attested, auto-rotating, short-TTL identity. No shared secrets. The maturity level lives in the signed SVID attribute, immutable for the cert's life. A JWT alone only proves the holder has a key.
BehaviorATF-BEH · what it does
OpenInferenceOpenTelemetryJaegerPrometheusPyOD
All open-source, self-hosted, standards-based. Jaeger gives the per-request trace tree, Prometheus the metrics, PyOD the behavioral baseline. LangSmith is proprietary SaaS: your traces leave your boundary. PyOD's mode changes per level; the tool doesn't.
Data GovernanceATF-DAT · in and out
Microsoft PresidioPydanticdetect-secretsGuardrails AI
Layered input→output governance: schema in, PII and secrets scanned, schema out. The strictness escalates per level (detect-and-block, then redaction, then cross-domain provenance), not the tools.
SegmentationATF-SEG · where it can go
OpenZitiCasbin
OpenZiti is network-layer zero trust: an agent literally cannot reach a service its SPIFFE identity isn't authorized for, with mTLS and an identity-revocation kill switch. Casbin is real policy-as-code (verbs × data domains × attributes). Config allowlists have no network story at all.
Incident ResponseATF-RES · if it goes rogue
OpenZiti revocationpy-breakerAlertmanager
The kill switch revokes the SVID / Ziti identity, cutting network, data, and tools at once, in seconds. py-breaker trips per-tool circuits; Alertmanager routes the alert. Retries and notifications aren't containment.
Identity in practice:In production the issuer is usually whatever your platform already provides: cloud workload identity in-cloud, directory-native agent identity where the directory supports it. SPIFFE/SPIRE is the vendor-neutral reference and the multi-cloud and on-prem answer. What changes by level is the strength of the issuer and the governance around it, not whether the agent has an identity.
§ 2

The Per-Level Configuration Matrix

The same stack, throughout. Every cell below is a configuration value: a TTL, a PyOD mode, a Casbin rule, an approval toggle. Never "install a new tool." This is what "promotion = config event" looks like.

ElementL1InternL2JuniorL3SeniorL4Principal
IdentitySPIRESVID TTL 8h, attr internTTL 1h, attr juniorTTL 15m, mTLS enforced, JIT scope, attr seniorSVID in Secure Enclave, request-scoped, attr principal
BehaviorPyOD / OTelFull trace capture; PyOD learning(no enforcement)PyOD flag(surfaced, not auto-acted); acceptance trackedPyOD enforce real-time; intent-drift; auto-pauseContinuous scoring; autonomous escalation
Data Gov.Presidio…Detect-and-block PII; single domain, no cross-domain+ injection detectionCross-domain per Casbin policy; full provenanceSource-trust scoring; lineage graph; real-time compliance
SegmentationCasbin / ZitiRead-only verbs (read/search/summarize); no writes+ write verbs via approval queuePolicy-as-code; temporal boundaries; cascade preventionDynamic boundary negotiation; L7 gateway
Incidentpy-breaker / ZitiKill switch ready; breakers inertAuto-pause on anomaly clusterBreakers active everywhere; containment in seconds; checkpoint/resumeAuto detect→contain→degrade; daily self-diagnosis
The patternRead any row left to right: a TTL tightens, a PyOD mode flips, a Casbin rule set widens, an approval toggle turns off. The agent's code never changes. That is the whole point.
§ 3

Two Honest Tiers

The reference stack needs real primitives, and they take real work to stand up. So there's an on-ramp: lighter substitutes for teams that can't run the reference stack yet, with less assurance and a label that says so.

Reference ATF · the architecture

The stack above, configured per level

Attested identity, network-layer segmentation, policy-as-code, OSS observability. This is ATF done right: the version the lab proves.

  • SPIFFE/SPIRE · OpenZiti · Casbin
  • Presidio · Pydantic · detect-secrets · Guardrails
  • OpenInference · OTel · Jaeger · Prometheus · PyOD
Minimal viable ATF · reduced assurance

A lighter on-ramp

Lighter substitutes for teams that can't yet run SPIRE or Ziti. Clearly reduced-assurance: a way in, not an equivalent.

  • JWT in place of SPIFFE SVIDs
  • Config allowlists in place of OpenZiti
  • Casbin + Presidio + PyOD still present
The minimal path is a stepping stone. The reference stack is the destination.
§ 4

What the Lab Proves

Same agents, same playbook, four config modes. Steps 0–3 are built and observable: different configuration, different outcome, every decision logged.

Step 0
Attestation
Workload presents its SVID; SPIRE attests identity and maturity attribute.
Pass
Step 1
Write to firm memory
Blocked by Casbin write-verb deny at Intern. Same agent, read-only config.
Block
Step 2
Search the public web
Allowed: the verb and the network endpoint are both in policy.
Pass
Step 3
Cross-domain read
Blocked by Casbin cross-domain deny. The data domain is the policy object, not a hardcoded refusal.
Block
Every control decision emits a greppable audit line (Casbin ALLOW/DENY, Presidio, secrets, identity, PyOD score). Each call produces a Jaeger trace tree: root span plus a child per control step, with the failing step visible. Kill switch revokes in ~0ms in-process today; Ziti identity-revocation is the target mechanism.
§ 5

Honest Status

The architecture is the claim. Not every cell is battle-tested. Here's the line between what the lab runs today and what's still rolling out.

Reference-validated

  • Steps 0–3 built and observable; same agents, different config, different outcomes
  • Casbin ALLOW/DENY on verbs and data domains, with audit lines
  • Per-call Jaeger trace trees; single-domain enforcement is real policy
  • Kill switch (in-process today)

Rolling out / aspirational

  • Guardrails AI — specified, not yet wired
  • PyOD enforce mode at Senior
  • OpenZiti per-agent identities & revocation kill switch
  • SVID in Apple Secure Enclave at Principal