Agentic Trust FrameworkOne Stack. Four Modes.
The open-source components that implement ATF — and the configuration that moves an agent from Intern to Principal without changing a line of its code.
The same agent runs unchanged code at every level. Promotion is a configuration event — a new identity attribute, a tighter policy, a stricter anomaly mode — not a re-architecture. So ATF recommends one stack, plus a per-level configuration matrix. Not a "Phase 1 vs Phase 2" tool swap.
The Recommended Stack
Five ATF elements, the open-source primitives the lab validated, and why each was chosen. Every tool is present at every level — what changes is configuration, not the toolset.
| Element | Open-source tools | Why this, over the toy |
|---|---|---|
| IdentityATF-ID · who is acting | SPIFFE / SPIREX.509 SVIDAgent registry | Workload-attested, auto-rotating, short-TTL identity — no shared secrets. The maturity level lives in the signed SVID attribute, immutable for the cert's life. PyJWT only proves someone holds a key; it's a SPIRE-less fallback at best. |
| BehaviorATF-BEH · what it does | OpenInferenceOpenTelemetryJaegerPrometheusPyOD | All open-source, self-hosted, standards-based. Jaeger gives the per-request trace tree, Prometheus the metrics, PyOD the behavioral baseline. LangSmith is proprietary SaaS — your traces leave your boundary. PyOD's mode changes per level; the tool doesn't. |
| Data GovernanceATF-DAT · in and out | Microsoft PresidioPydanticdetect-secretsGuardrails AI | Layered input→output governance: schema in, PII and secrets scanned, schema out. The strictness escalates per level — detect-and-block, then redaction, then cross-domain provenance — not the tools. |
| SegmentationATF-SEG · where it can go | OpenZitiCasbin | OpenZiti is network-layer zero trust: an agent literally cannot reach a service its SPIFFE identity isn't authorized for, with mTLS and an identity-revocation kill switch. Casbin is real policy-as-code (verbs × data domains × attributes). "Config allowlists" have no network story at all. |
| Incident ResponseATF-RES · if it goes rogue | OpenZiti revocationpy-breakerAlertmanager | The kill switch revokes the SVID / Ziti identity — cutting network, data, and tools at once, in seconds. py-breaker trips per-tool circuits; Alertmanager routes the alert. Retries and notifications aren't containment. |
The Per-Level Configuration Matrix
The same stack, throughout. Every cell below is a configuration value — a TTL, a PyOD mode, a Casbin rule, an approval toggle. Never "install a new tool." This is what "promotion = config event" looks like.
| Element | L1Intern | L2Junior | L3Senior | L4Principal |
|---|---|---|---|---|
| IdentitySPIRE | SVID TTL 8h, attr intern | TTL 1h, attr junior | TTL 15m, mTLS enforced, JIT scope, attr senior | SVID in Secure Enclave, request-scoped, attr principal |
| BehaviorPyOD / OTel | Full trace capture; PyOD learning(no enforcement) | PyOD flag(surfaced, not auto-acted); acceptance tracked | PyOD enforce real-time; intent-drift; auto-pause | Continuous scoring; autonomous escalation |
| Data Gov.Presidio… | Detect-and-block PII; single domain, no cross-domain | + injection detection | Cross-domain per Casbin policy; full provenance | Source-trust scoring; lineage graph; real-time compliance |
| SegmentationCasbin / Ziti | Read-only verbs (read/search/summarize); no writes | + write verbs via approval queue | Policy-as-code; temporal boundaries; cascade prevention | Dynamic boundary negotiation; L7 gateway |
| Incidentpy-breaker / Ziti | Kill switch ready; breakers inert | Auto-pause on anomaly cluster | Breakers active everywhere; containment in seconds; checkpoint/resume | Auto detect→contain→degrade; daily self-diagnosis |
Two Honest Tiers
The reference stack needs real primitives, and they're heavier to stand up than a toy. So there's a labeled on-ramp — a stepping stone, not a "Phase 1 you'll outgrow."
The stack above, configured per level
Attested identity, network-layer segmentation, policy-as-code, OSS observability. This is ATF done right — the version the lab proves.
- SPIFFE/SPIRE · OpenZiti · Casbin
- Presidio · Pydantic · detect-secrets · Guardrails
- OpenInference · OTel · Jaeger · Prometheus · PyOD
A lighter on-ramp
Lighter substitutes for teams that can't yet run SPIRE or Ziti. Clearly reduced-assurance — a way in, not an equivalent.
- JWT in place of SPIFFE SVIDs
- Config allowlists in place of OpenZiti
- Casbin + Presidio + PyOD still present
What the Lab Proves
Same agents, same playbook, four config modes. Steps 0–3 are built and observable — different configuration, different outcome, every decision logged.
Casbin write-verb deny at Intern. Same agent, read-only config.Casbin cross-domain deny — the data domain is the policy object, not a hardcoded refusal.Honest Status
The architecture is the claim. Not every cell is battle-tested. Here's the line between what the lab runs today and what's still rolling out.
Reference-validated
- Steps 0–3 built and observable; same agents, different config, different outcomes
- Casbin ALLOW/DENY on verbs and data domains, with audit lines
- Per-call Jaeger trace trees; single-domain enforcement is real policy
- Kill switch (in-process today)
Rolling out / aspirational
- Guardrails AI — specified, not yet wired
- PyOD
enforcemode at Senior - OpenZiti per-agent identities & revocation kill switch
- SVID in Apple Secure Enclave at Principal