-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathindex.html
More file actions
2189 lines (1912 loc) · 140 KB
/
index.html
File metadata and controls
2189 lines (1912 loc) · 140 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>OATS — Open Agent Trust Stack</title>
<meta name="description" content="A System Specification for Zero-Trust AI Agent Execution. Open standard for securing autonomous AI agents through structural enforcement.">
<meta name="keywords" content="OATS, AI security, zero-trust, agent trust, tool contracts, ORGA loop, AI governance">
<meta property="og:title" content="OATS — Open Agent Trust Stack">
<meta property="og:description" content="A System Specification for Zero-Trust AI Agent Execution">
<meta property="og:type" content="website">
<meta property="og:url" content="https://openagenttruststack.org">
<meta property="og:image" content="https://openagenttruststack.org/og-image.png">
<meta property="og:image:secure_url" content="https://openagenttruststack.org/og-image.png">
<meta property="og:image:type" content="image/png">
<meta property="og:image:width" content="1200">
<meta property="og:image:height" content="630">
<meta property="og:image:alt" content="Open Agent Trust Stack — A System Specification for Zero-Trust AI Agent Execution">
<meta property="og:site_name" content="Open Agent Trust Stack">
<meta name="twitter:card" content="summary_large_image">
<meta name="twitter:title" content="OATS — Open Agent Trust Stack">
<meta name="twitter:description" content="A System Specification for Zero-Trust AI Agent Execution">
<meta name="twitter:image" content="https://openagenttruststack.org/og-image.png">
<meta name="twitter:image:alt" content="Open Agent Trust Stack — A System Specification for Zero-Trust AI Agent Execution">
<link rel="icon" type="image/svg+xml" href="favicon.svg">
<link rel="icon" type="image/png" sizes="32x32" href="favicon-32.png">
<link rel="icon" type="image/png" sizes="16x16" href="favicon-16.png">
<link rel="shortcut icon" href="favicon.ico">
<link rel="apple-touch-icon" sizes="180x180" href="favicon-180.png">
<link rel="preconnect" href="https://fonts.googleapis.com">
<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
<link href="https://fonts.googleapis.com/css2?family=DM+Serif+Display:ital@0;1&family=JetBrains+Mono:wght@400;500;600&family=Source+Serif+4:ital,opsz,wght@0,8..60,300;0,8..60,400;0,8..60,600;1,8..60,400&display=swap" rel="stylesheet">
<style>
:root {
--bg-deep: #0c0c0f;
--bg-surface: #131318;
--bg-elevated: #1a1a22;
--bg-sidebar: #101014;
--border: #2a2a35;
--border-subtle: #1e1e28;
--text-primary: #e8e6e1;
--text-secondary: #9a9790;
--text-tertiary: #6b6860;
--accent: #c8a44e;
--accent-dim: #a08030;
--accent-glow: rgba(200, 164, 78, 0.12);
--accent-glow-strong: rgba(200, 164, 78, 0.25);
--red: #c45050;
--green: #5a9a6a;
--blue: #5080b0;
--serif: 'DM Serif Display', Georgia, serif;
--body: 'Source Serif 4', Georgia, serif;
--mono: 'JetBrains Mono', 'Consolas', monospace;
--sidebar-w: 280px;
--content-max: 820px;
}
*, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }
html {
scroll-behavior: smooth;
scroll-padding-top: 2rem;
}
body {
font-family: var(--body);
font-size: 17px;
line-height: 1.72;
color: var(--text-primary);
background: var(--bg-deep);
-webkit-font-smoothing: antialiased;
-moz-osx-font-smoothing: grayscale;
}
/* ── Noise overlay ── */
body::before {
content: '';
position: fixed;
inset: 0;
z-index: 9999;
pointer-events: none;
opacity: 0.025;
background-image: url("data:image/svg+xml,%3Csvg viewBox='0 0 256 256' xmlns='http://www.w3.org/2000/svg'%3E%3Cfilter id='n'%3E%3CfeTurbulence type='fractalNoise' baseFrequency='0.9' numOctaves='4' stitchTiles='stitch'/%3E%3C/filter%3E%3Crect width='100%25' height='100%25' filter='url(%23n)'/%3E%3C/svg%3E");
background-size: 256px 256px;
}
/* ── Sidebar ── */
.sidebar {
position: fixed;
top: 0;
left: 0;
width: var(--sidebar-w);
height: 100vh;
background: var(--bg-sidebar);
border-right: 1px solid var(--border-subtle);
overflow-y: auto;
z-index: 100;
display: flex;
flex-direction: column;
scrollbar-width: thin;
scrollbar-color: var(--border) transparent;
}
.sidebar-header {
padding: 2rem 1.5rem 1.5rem;
border-bottom: 1px solid var(--border-subtle);
flex-shrink: 0;
}
.sidebar-logo {
font-family: var(--mono);
font-size: 0.7rem;
font-weight: 600;
letter-spacing: 0.2em;
text-transform: uppercase;
color: var(--accent);
margin-bottom: 0.25rem;
}
.sidebar-title {
font-family: var(--serif);
font-size: 1.15rem;
color: var(--text-primary);
line-height: 1.3;
}
.sidebar-meta {
font-family: var(--mono);
font-size: 0.65rem;
color: var(--text-tertiary);
margin-top: 0.75rem;
line-height: 1.7;
letter-spacing: 0.02em;
}
.sidebar-meta span {
display: block;
}
.sidebar-nav {
padding: 1rem 0;
flex: 1;
overflow-y: auto;
}
.sidebar-nav a {
display: block;
padding: 0.35rem 1.5rem;
font-family: var(--mono);
font-size: 0.68rem;
color: var(--text-tertiary);
text-decoration: none;
transition: all 0.2s ease;
letter-spacing: 0.01em;
line-height: 1.5;
border-left: 2px solid transparent;
}
.sidebar-nav a:hover {
color: var(--text-secondary);
background: var(--accent-glow);
}
.sidebar-nav a.active {
color: var(--accent);
border-left-color: var(--accent);
background: var(--accent-glow);
}
.sidebar-nav .nav-section {
padding: 0.6rem 1.5rem 0.25rem;
font-family: var(--mono);
font-size: 0.6rem;
font-weight: 600;
letter-spacing: 0.15em;
text-transform: uppercase;
color: var(--text-tertiary);
opacity: 0.6;
}
.sidebar-nav .nav-section:first-child {
padding-top: 0;
}
.sidebar-footer {
padding: 1rem 1.5rem;
border-top: 1px solid var(--border-subtle);
flex-shrink: 0;
}
.sidebar-footer a {
display: inline-block;
font-family: var(--mono);
font-size: 0.62rem;
color: var(--text-tertiary);
text-decoration: none;
letter-spacing: 0.05em;
transition: color 0.2s;
}
.sidebar-footer a:hover {
color: var(--accent);
}
.sidebar-footer a + a {
margin-left: 1rem;
}
/* ── Main content ── */
.main {
margin-left: var(--sidebar-w);
min-height: 100vh;
}
/* ── Hero ── */
.hero {
position: relative;
padding: 6rem 4rem 5rem;
border-bottom: 1px solid var(--border);
overflow: hidden;
}
.hero::before {
content: '';
position: absolute;
top: -60%;
right: -20%;
width: 700px;
height: 700px;
background: radial-gradient(ellipse, var(--accent-glow-strong) 0%, transparent 70%);
pointer-events: none;
}
.hero-badge {
display: inline-block;
font-family: var(--mono);
font-size: 0.65rem;
font-weight: 600;
letter-spacing: 0.2em;
text-transform: uppercase;
color: var(--accent);
padding: 0.35rem 0.8rem;
border: 1px solid var(--accent-dim);
border-radius: 2px;
margin-bottom: 2rem;
background: var(--accent-glow);
}
.hero h1 {
font-family: var(--serif);
font-size: clamp(2.4rem, 5vw, 3.6rem);
color: var(--text-primary);
line-height: 1.15;
margin-bottom: 0.75rem;
max-width: 700px;
}
.hero h1 em {
font-style: italic;
color: var(--accent);
}
.hero-subtitle {
font-family: var(--body);
font-size: 1.15rem;
color: var(--text-secondary);
max-width: 600px;
line-height: 1.7;
margin-bottom: 2.5rem;
}
.hero-details {
display: flex;
gap: 2.5rem;
flex-wrap: wrap;
}
.hero-detail {
font-family: var(--mono);
font-size: 0.7rem;
color: var(--text-tertiary);
letter-spacing: 0.02em;
}
.hero-detail strong {
display: block;
font-size: 0.6rem;
letter-spacing: 0.12em;
text-transform: uppercase;
color: var(--text-secondary);
margin-bottom: 0.15rem;
font-weight: 600;
}
.hero-doi {
display: inline-block;
line-height: 0;
}
.hero-doi img {
height: 20px;
display: block;
vertical-align: middle;
}
/* ── Content area ── */
.content {
max-width: var(--content-max);
padding: 3rem 4rem 6rem;
}
/* ── Section styling ── */
.section {
margin-bottom: 4rem;
opacity: 0;
transform: translateY(12px);
animation: fadeUp 0.5s ease forwards;
}
@keyframes fadeUp {
to { opacity: 1; transform: translateY(0); }
}
.section-divider {
width: 40px;
height: 1px;
background: var(--accent-dim);
margin-bottom: 2rem;
}
.section-number {
font-family: var(--mono);
font-size: 0.62rem;
font-weight: 600;
letter-spacing: 0.15em;
text-transform: uppercase;
color: var(--accent-dim);
margin-bottom: 0.5rem;
}
h2 {
font-family: var(--serif);
font-size: 1.9rem;
color: var(--text-primary);
line-height: 1.2;
margin-bottom: 1.5rem;
}
h3 {
font-family: var(--serif);
font-size: 1.3rem;
color: var(--text-primary);
line-height: 1.3;
margin-top: 2.5rem;
margin-bottom: 1rem;
}
h4 {
font-family: var(--mono);
font-size: 0.78rem;
font-weight: 600;
letter-spacing: 0.08em;
text-transform: uppercase;
color: var(--accent);
margin-top: 2rem;
margin-bottom: 0.75rem;
}
p {
margin-bottom: 1.15rem;
color: var(--text-secondary);
}
p strong {
color: var(--text-primary);
font-weight: 600;
}
a {
color: var(--accent);
text-decoration: none;
transition: color 0.2s;
}
a:hover {
color: var(--text-primary);
}
/* ── Lists ── */
ul, ol {
margin-bottom: 1.15rem;
padding-left: 1.5rem;
color: var(--text-secondary);
}
li {
margin-bottom: 0.5rem;
}
li strong {
color: var(--text-primary);
}
/* ── Code blocks ── */
code {
font-family: var(--mono);
font-size: 0.85em;
color: var(--accent);
background: var(--bg-elevated);
padding: 0.15em 0.4em;
border-radius: 3px;
}
pre {
background: var(--bg-elevated);
border: 1px solid var(--border);
border-radius: 4px;
padding: 1.25rem 1.5rem;
margin-bottom: 1.5rem;
overflow-x: auto;
position: relative;
}
.katex { font-size: 1.05em; color: var(--text-primary); }
.katex-display {
margin: 1.5rem 0;
padding: 1rem 1.25rem;
background: var(--bg-elevated);
border: 1px solid var(--border);
border-radius: 4px;
overflow-x: auto;
overflow-y: hidden;
}
.katex-display > .katex { color: var(--text-primary); }
pre code {
background: none;
padding: 0;
font-size: 0.8rem;
line-height: 1.65;
color: var(--text-secondary);
}
pre::before {
content: '';
position: absolute;
top: 0;
left: 0;
width: 3px;
height: 100%;
background: var(--accent-dim);
border-radius: 4px 0 0 4px;
}
/* ── Tables ── */
table {
width: 100%;
border-collapse: collapse;
margin-bottom: 1.5rem;
font-size: 0.9rem;
}
thead th {
font-family: var(--mono);
font-size: 0.68rem;
font-weight: 600;
letter-spacing: 0.1em;
text-transform: uppercase;
color: var(--accent);
text-align: left;
padding: 0.75rem 1rem;
border-bottom: 2px solid var(--accent-dim);
background: var(--bg-elevated);
}
tbody td {
padding: 0.75rem 1rem;
border-bottom: 1px solid var(--border-subtle);
color: var(--text-secondary);
vertical-align: top;
}
tbody td strong {
color: var(--text-primary);
font-family: var(--mono);
font-size: 0.82rem;
}
tbody tr:hover {
background: var(--accent-glow);
}
/* ── Callout boxes ── */
.callout {
background: var(--bg-elevated);
border: 1px solid var(--border);
border-left: 3px solid var(--accent);
padding: 1.25rem 1.5rem;
margin-bottom: 1.5rem;
border-radius: 0 4px 4px 0;
}
.callout p:last-child {
margin-bottom: 0;
}
.callout-title {
font-family: var(--mono);
font-size: 0.68rem;
font-weight: 600;
letter-spacing: 0.1em;
text-transform: uppercase;
color: var(--accent);
margin-bottom: 0.5rem;
}
/* ── Conformance tags ── */
.req-tag {
display: inline-block;
font-family: var(--mono);
font-size: 0.62rem;
font-weight: 600;
letter-spacing: 0.08em;
padding: 0.2rem 0.5rem;
border-radius: 2px;
margin-right: 0.5rem;
vertical-align: middle;
}
.req-must {
color: var(--red);
border: 1px solid var(--red);
background: rgba(196, 80, 80, 0.08);
}
.req-should {
color: var(--blue);
border: 1px solid var(--blue);
background: rgba(80, 128, 176, 0.08);
}
/* ── Trust model boxes ── */
.trust-grid {
display: grid;
grid-template-columns: 1fr 1fr 1fr;
gap: 1rem;
margin-bottom: 1.5rem;
}
.trust-box {
background: var(--bg-elevated);
border: 1px solid var(--border);
border-radius: 4px;
padding: 1rem 1.25rem;
}
.trust-box h5 {
font-family: var(--mono);
font-size: 0.65rem;
font-weight: 600;
letter-spacing: 0.12em;
text-transform: uppercase;
margin-bottom: 0.75rem;
}
.trust-box.trusted h5 { color: var(--green); }
.trust-box.untrusted h5 { color: var(--red); }
.trust-box.partial h5 { color: var(--accent); }
.trust-box ul {
padding-left: 1rem;
margin-bottom: 0;
}
.trust-box li {
font-size: 0.82rem;
margin-bottom: 0.3rem;
}
/* ── Architecture pillars ── */
.pillars {
display: grid;
grid-template-columns: 1fr 1fr 1fr;
gap: 1.25rem;
margin: 2rem 0;
}
.pillar {
background: var(--bg-elevated);
border: 1px solid var(--border);
border-top: 2px solid var(--accent);
border-radius: 0 0 4px 4px;
padding: 1.5rem;
}
.pillar-number {
font-family: var(--mono);
font-size: 0.6rem;
color: var(--accent-dim);
letter-spacing: 0.1em;
margin-bottom: 0.5rem;
}
.pillar h4 {
font-family: var(--serif);
font-size: 1rem;
text-transform: none;
letter-spacing: 0;
color: var(--text-primary);
margin-top: 0;
margin-bottom: 0.5rem;
}
.pillar p {
font-size: 0.88rem;
margin-bottom: 0;
}
/* ── References ── */
.ref-list {
list-style: none;
padding-left: 0;
}
.ref-list li {
padding-left: 0;
font-size: 0.88rem;
margin-bottom: 0.65rem;
padding-left: 1.5rem;
text-indent: -1.5rem;
color: var(--text-tertiary);
}
/* ── Footer ── */
.footer {
border-top: 1px solid var(--border);
padding: 3rem 4rem;
max-width: var(--content-max);
}
.footer-links {
display: flex;
gap: 2rem;
flex-wrap: wrap;
margin-bottom: 1.5rem;
}
.footer-links a {
font-family: var(--mono);
font-size: 0.72rem;
color: var(--text-tertiary);
letter-spacing: 0.03em;
}
.footer-links a:hover {
color: var(--accent);
}
.footer-copy {
font-family: var(--mono);
font-size: 0.62rem;
color: var(--text-tertiary);
letter-spacing: 0.03em;
opacity: 0.6;
}
/* ── Sidebar AI summary ── */
.sidebar-ai-summary {
padding: 1rem 1.5rem 1.1rem;
border-top: 1px solid var(--border-subtle);
flex-shrink: 0;
}
.sidebar-ai-summary h4 {
font-family: var(--mono);
font-size: 0.6rem;
font-weight: 600;
letter-spacing: 0.15em;
text-transform: uppercase;
color: var(--text-tertiary);
opacity: 0.6;
margin: 0 0 0.75rem;
}
.ai-logos {
display: flex;
gap: 0.5rem;
flex-wrap: wrap;
}
.ai-logo-btn {
display: inline-flex;
align-items: center;
justify-content: center;
width: 34px;
height: 34px;
background: var(--bg-elevated);
border: 1px solid var(--border);
border-radius: 4px;
color: var(--text-secondary);
transition: all 0.2s ease;
}
.ai-logo-btn:hover {
border-color: var(--accent);
background: var(--accent-glow);
color: var(--accent);
}
.ai-logo-btn svg {
width: 15px;
height: 15px;
fill: currentColor;
}
/* ── Mobile hamburger ── */
.menu-toggle {
display: none;
position: fixed;
top: 1rem;
left: 1rem;
z-index: 200;
width: 40px;
height: 40px;
background: var(--bg-surface);
border: 1px solid var(--border);
border-radius: 4px;
cursor: pointer;
align-items: center;
justify-content: center;
}
.menu-toggle span,
.menu-toggle span::before,
.menu-toggle span::after {
display: block;
width: 18px;
height: 1.5px;
background: var(--text-secondary);
transition: all 0.3s;
}
.menu-toggle span { position: relative; }
.menu-toggle span::before,
.menu-toggle span::after {
content: '';
position: absolute;
left: 0;
}
.menu-toggle span::before { top: -5px; }
.menu-toggle span::after { top: 5px; }
.menu-toggle.open span { background: transparent; }
.menu-toggle.open span::before { transform: rotate(45deg); top: 0; }
.menu-toggle.open span::after { transform: rotate(-45deg); top: 0; }
/* ── Responsive ── */
@media (max-width: 1024px) {
.content, .footer { padding-left: 2.5rem; padding-right: 2.5rem; }
.hero { padding-left: 2.5rem; padding-right: 2.5rem; }
}
@media (max-width: 768px) {
.sidebar {
transform: translateX(-100%);
transition: transform 0.3s ease;
}
.sidebar.open {
transform: translateX(0);
}
.menu-toggle {
display: flex;
}
.main {
margin-left: 0;
}
.hero { padding: 5rem 1.5rem 3rem; }
.hero h1 { font-size: 2rem; }
.content, .footer { padding-left: 1.5rem; padding-right: 1.5rem; }
.pillars, .trust-grid { grid-template-columns: 1fr; }
.hero-details { gap: 1.5rem; }
}
/* ── Staggered animations ── */
.section:nth-child(1) { animation-delay: 0.05s; }
.section:nth-child(2) { animation-delay: 0.1s; }
.section:nth-child(3) { animation-delay: 0.15s; }
</style>
<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/katex@0.16.11/dist/katex.min.css" integrity="sha384-nB0miv6/jRmo5UMMR1wu3Gz6NLsoTkbqJghGIsx//Rlm+ZU03BU6SQNC66uf4l5+" crossorigin="anonymous">
<script defer src="https://cdn.jsdelivr.net/npm/katex@0.16.11/dist/katex.min.js" integrity="sha384-7zkQWkzuo3B5mTepMUcHkMB5jZaolc2xDwL6VFqjFALcbeS9Ggm/Yr2r3Dy4lfFg" crossorigin="anonymous"></script>
<script defer src="https://cdn.jsdelivr.net/npm/katex@0.16.11/dist/contrib/auto-render.min.js" integrity="sha384-43gviWU0YVjaDtb/GhzOouOXtZMP/7XUzwPTstBeZFe/+rCMvRwr4yROQP43s0Xk" crossorigin="anonymous" onload="renderMathInElement(document.body,{delimiters:[{left:'$$',right:'$$',display:true},{left:'$',right:'$',display:false},{left:'\\(',right:'\\)',display:false},{left:'\\[',right:'\\]',display:true}],throwOnError:false});"></script>
<link rel="stylesheet" href="diagrams.css">
</head>
<body>
<!-- Mobile menu button -->
<button class="menu-toggle" aria-label="Toggle navigation" onclick="toggleSidebar()">
<span></span>
</button>
<!-- Sidebar -->
<aside class="sidebar" id="sidebar">
<div class="sidebar-header">
<div class="sidebar-logo">Specification</div>
<div class="sidebar-title">Open Agent Trust Stack</div>
<div class="sidebar-meta">
<span>v1.1.0 · Release</span>
<span>CC BY 4.0 License</span>
<span>ThirdKey AI</span>
</div>
</div>
<nav class="sidebar-nav" id="nav">
<div class="nav-section">Overview</div>
<a href="#abstract">Abstract</a>
<a href="#introduction">1. Introduction</a>
<a href="#related-work">2. Related Work</a>
<a href="#problem">3. Problem Formalization</a>
<a href="#threat-model">4. Threat Model</a>
<div class="nav-section">Architecture</div>
<a href="#orga-loop">5. ORGA Loop</a>
<a href="#tool-contracts">6. Tool Contracts</a>
<a href="#identity">7. Identity Layer</a>
<a href="#policy">8. Policy Enforcement</a>
<a href="#audit">9. Audit Layer</a>
<div class="nav-section">Deployment</div>
<a href="#sandboxing">10. Sandboxing</a>
<a href="#inter-agent">11. Inter-Agent</a>
<a href="#conformance">12. Conformance</a>
<a href="#implementations">13. Implementations</a>
<div class="nav-section">Evaluation</div>
<a href="#evaluation">14. Evaluation Framework</a>
<a href="#limitations">15. Limitations</a>
<div class="nav-section">Future</div>
<a href="#research">16. Research</a>
<a href="#conclusion">17. Conclusion</a>
<a href="#references">References</a>
</nav>
<div class="sidebar-ai-summary">
<h4>AI Summary</h4>
<div class="ai-logos">
<a href="https://chatgpt.com/?prompt=Give+me+an+overview+of+the+Open+Agent+Trust+Stack+%28OATS%29%2C+an+open+specification+for+zero-trust+AI+agent+execution.+Cover+its+five+architectural+layers+%28ORGA+reasoning+loop%2C+tool+contracts%2C+identity+stack%2C+policy+engine%2C+audit+journal%29%2C+the+three+design+principles+%28allow-list+over+deny-list%2C+compile-time+over+runtime+enforcement%2C+structural+independence%29%2C+and+the+conformance+requirements+%28C1%E2%80%93C7+and+E1%E2%80%93E8%29.+Use+openagenttruststack.org+as+the+primary+source+and+consult+the+v1.1.0+specification+at+openagenttruststack.org%2FOATS-v1.1.0.pdf+and+related+material+at+thirdkey.ai%2C+symbiont.dev%2C+schemapin.org%2C+and+agentpin.org." target="_blank" rel="noopener" aria-label="Summarize with ChatGPT" class="ai-logo-btn">
<svg viewBox="0 0 24 24" role="img" aria-hidden="true"><title>OpenAI icon</title><path d="M22.2819 9.8211a5.9847 5.9847 0 00-.5157-4.9108 6.0462 6.0462 0 00-6.5098-2.9A6.0651 6.0651 0 004.9807 4.1818a5.9847 5.9847 0 00-3.9977 2.9 6.0462 6.0462 0 00.7427 7.0966 5.98 5.98 0 00.511 4.9107 6.051 6.051 0 006.5146 2.9001A5.9847 5.9847 0 0013.2599 24a6.0557 6.0557 0 005.7718-4.2058 5.9894 5.9894 0 003.9977-2.9001 6.0557 6.0557 0 00-.7475-7.0729zm-9.022 12.6081a4.4755 4.4755 0 01-2.8764-1.0408l.1419-.0804 4.7783-2.7582a.7948.7948 0 00.3927-.6813v-6.7369l2.02 1.1686a.071.071 0 01.038.052v5.5826a4.504 4.504 0 01-4.4945 4.4944zm-9.6607-4.1254a4.4708 4.4708 0 01-.5346-3.0137l.142.0852 4.783 2.7582a.7712.7712 0 00.7806 0l5.8428-3.3685v2.3324a.0804.0804 0 01-.0332.0615L9.74 19.9502a4.4992 4.4992 0 01-6.1408-1.6464zM2.3408 7.8956a4.485 4.485 0 012.3655-1.9728V11.6a.7664.7664 0 00.3879.6765l5.8144 3.3543-2.0201 1.1685a.0757.0757 0 01-.071 0l-4.8303-2.7865A4.504 4.504 0 012.3408 7.872zm16.5963 3.8558L13.1038 8.364 15.1192 7.2a.0757.0757 0 01.071 0l4.8303 2.7913a4.4944 4.4944 0 01-.6765 8.1042v-5.6772a.79.79 0 00-.407-.667zm2.0107-3.0231-.142-.0852-4.7735-2.7818a.7759.7759 0 00-.7854 0L9.409 9.2297V6.8974a.0662.0662 0 01.0284-.0615l4.8303-2.7866a4.4992 4.4992 0 016.6802 4.66zM8.3065 12.863l-2.02-1.1638a.0804.0804 0 01-.038-.0567V6.0742a4.4992 4.4992 0 017.3757-3.4537l-.142.0805L8.704 5.459a.7948.7948 0 00-.3927.6813zm1.0976-2.3654 2.602-1.4998 2.6069 1.4998v2.9994l-2.5974 1.4997-2.6067-1.4997z"/></svg>
</a>
<a href="https://claude.ai/new?q=Give%20me%20an%20overview%20of%20the%20Open%20Agent%20Trust%20Stack%20%28OATS%29%2C%20an%20open%20specification%20for%20zero-trust%20AI%20agent%20execution.%20Cover%20its%20five%20architectural%20layers%20%28ORGA%20reasoning%20loop%2C%20tool%20contracts%2C%20identity%20stack%2C%20policy%20engine%2C%20audit%20journal%29%2C%20the%20three%20design%20principles%20%28allow-list%20over%20deny-list%2C%20compile-time%20over%20runtime%20enforcement%2C%20structural%20independence%29%2C%20and%20the%20conformance%20requirements%20%28C1%E2%80%93C7%20and%20E1%E2%80%93E8%29.%20Use%20openagenttruststack.org%20as%20the%20primary%20source%20and%20consult%20the%20v1.1.0%20specification%20at%20openagenttruststack.org%2FOATS-v1.1.0.pdf%20and%20related%20material%20at%20thirdkey.ai%2C%20symbiont.dev%2C%20schemapin.org%2C%20and%20agentpin.org." target="_blank" rel="noopener" aria-label="Summarize with Claude" class="ai-logo-btn">
<svg viewBox="0 6.603 1192.672 1193.397" role="img" aria-hidden="true"><title>Claude icon</title><path d="m233.96 800.215 234.684-131.678 3.947-11.436-3.947-6.363h-11.436l-39.221-2.416-134.094-3.624-116.296-4.832-112.67-6.04-28.35-6.04-26.577-35.035 2.738-17.477 23.84-16.027 34.147 2.98 75.463 5.155 113.235 7.812 82.147 4.832 121.692 12.644h19.329l2.738-7.812-6.604-4.832-5.154-4.832-117.182-79.41-126.845-83.92-66.443-48.321-35.92-24.484-18.12-22.953-7.813-50.093 32.618-35.92 43.812 2.98 11.195 2.98 44.375 34.147 94.792 73.37 123.786 91.167 18.12 15.06 7.249-5.154.886-3.624-8.135-13.61-67.329-121.692-71.838-123.785-31.974-51.302-8.456-30.765c-2.98-12.645-5.154-23.275-5.154-36.242l37.127-50.416 20.537-6.604 49.53 6.604 20.86 18.121 30.765 70.39 49.852 110.818 77.315 150.684 22.631 44.698 12.08 41.396 4.51 12.645h7.813v-7.248l6.362-84.886 11.759-104.215 11.436-134.094 3.946-37.772 18.685-45.262 37.127-24.482 28.994 13.852 23.839 34.148-3.303 22.067-14.174 92.134-27.785 144.323-18.121 96.644h10.55l12.08-12.08 48.887-64.913 82.147-102.685 36.242-40.752 42.282-45.02 27.14-21.423h51.303l37.772 56.135-16.913 57.986-52.832 67.007-43.812 56.779-62.82 84.563-39.22 67.651 3.623 5.396 9.343-.886 141.906-30.201 76.671-13.852 91.49-15.705 41.396 19.329 4.51 19.65-16.269 40.189-97.852 24.16L959.84 601.45l-170.9 40.43-2.093 1.53 2.416 2.98 76.993 7.248 32.94 1.771h80.617l150.12 11.195 39.222 25.933 23.517 31.732-3.946 24.16-60.403 30.766-81.503-19.33-190.228-45.26-65.235-16.27h-9.02v5.397l54.362 53.154 99.624 89.96 124.752 115.973 6.362 28.671-16.027 22.63-16.912-2.415-109.611-82.47-42.282-37.127-95.758-80.618h-6.363v8.456l22.067 32.296 116.537 175.167 6.04 53.719-8.456 17.476-30.201 10.55-33.181-6.04-68.215-95.758-70.39-107.84-56.778-96.644-6.926 3.947-33.503 360.886-15.705 18.443L565.53 1200l-30.201-22.953-16.027-37.127 16.027-73.37 19.329-95.758 15.704-76.107 14.175-94.55 8.456-31.41-.563-2.094-6.927.886-71.275 97.852-108.402 146.497-85.772 91.812-20.537 8.134-35.597-18.443 3.301-32.94 19.893-29.315 118.712-151.007 71.597-93.583 46.228-54.04-.322-7.813h-2.738l-315.302 204.725-56.135 7.248-24.16-22.63 2.98-37.128 11.435-12.08 94.792-65.236-.322.323z"/></svg>
</a>
<a href="https://www.perplexity.ai/?q=Give%20me%20an%20overview%20of%20the%20Open%20Agent%20Trust%20Stack%20%28OATS%29%2C%20an%20open%20specification%20for%20zero-trust%20AI%20agent%20execution.%20Cover%20its%20five%20architectural%20layers%20%28ORGA%20reasoning%20loop%2C%20tool%20contracts%2C%20identity%20stack%2C%20policy%20engine%2C%20audit%20journal%29%2C%20the%20three%20design%20principles%20%28allow-list%20over%20deny-list%2C%20compile-time%20over%20runtime%20enforcement%2C%20structural%20independence%29%2C%20and%20the%20conformance%20requirements%20%28C1%E2%80%93C7%20and%20E1%E2%80%93E8%29.%20Use%20openagenttruststack.org%20as%20the%20primary%20source%20and%20consult%20the%20v1.1.0%20specification%20at%20openagenttruststack.org%2FOATS-v1.1.0.pdf%20and%20related%20material%20at%20thirdkey.ai%2C%20symbiont.dev%2C%20schemapin.org%2C%20and%20agentpin.org." target="_blank" rel="noopener" aria-label="Summarize with Perplexity" class="ai-logo-btn">
<svg viewBox="0 0 24 24" role="img" aria-hidden="true"><title>Perplexity icon</title><path d="M22.3977 7.0896h-2.3106V.0676l-7.5094 6.3542V.1577h-1.1554v6.1966L4.4904 0v7.0896H1.6023v10.3976h2.8882V24l6.932-6.3591v6.2005h1.1554v-6.0469l6.9318 6.1807v-6.4879h2.8882V7.0896zm-3.4657-4.531v4.531h-5.355l5.355-4.531zm-13.2862.0676 4.8691 4.4634H5.6458V2.6262zM2.7576 16.332V8.245h7.8476l-6.1149 6.1147v1.9723H2.7576zm2.8882 5.0404v-3.8852h1e-4v-2.6488l5.7763-5.7764v7.0111l-5.7764 5.2993zm12.7086.0248-5.7766-5.1509V9.0618l5.7766 5.7766v6.5588zm2.8882-5.0652h-1.733v-1.9723L13.3948 8.245h7.8478v8.087z"/></svg>
</a>
</div>
</div>
<div class="sidebar-footer">
<a href="https://thirdkey.ai">ThirdKey AI</a>
<a href="https://github.com/ThirdKeyAI/OpenAgentTrustStack">GitHub</a>
</div>
</aside>
<!-- Main content -->
<div class="main">
<!-- Hero -->
<header class="hero">
<div class="hero-badge">System Specification</div>
<h1>Open Agent <em>Trust Stack</em></h1>
<p class="hero-subtitle">A system specification for zero-trust AI agent execution. Define what is permitted and make everything else structurally inexpressible.</p>
<div class="hero-details">
<div class="hero-detail">
<strong>Version</strong>
1.1.0
</div>
<div class="hero-detail">
<strong>Status</strong>
Release
</div>
<div class="hero-detail">
<strong>Authors</strong>
Jascha Wanger / ThirdKey AI
</div>
<div class="hero-detail">
<strong>Date</strong>
2026-04-17
</div>
<div class="hero-detail">
<strong>License</strong>
CC BY 4.0
</div>
<div class="hero-detail">
<strong>PDF</strong>
<a href="OATS-v1.1.0.pdf" style="color: var(--accent);">OATS-v1.1.0.pdf</a>
</div>
<div class="hero-detail">
<strong>DOI</strong>
<a href="https://doi.org/10.5281/zenodo.19636534" target="_blank" rel="noopener" class="hero-doi">
<img src="https://zenodo.org/badge/DOI/10.5281/zenodo.19636534.svg" alt="DOI 10.5281/zenodo.19636534">
</a>
</div>
</div>
</header>
<div class="content">
<!-- Abstract -->
<section class="section" id="abstract">
<div class="section-divider"></div>
<div class="section-number">Abstract</div>
<h2>Zero-Trust Agent Execution Through Structural Enforcement</h2>
<p>As AI systems evolve from assistants into autonomous agents executing consequential actions, the security boundary shifts from model outputs to tool execution. Traditional security paradigms — log aggregation, perimeter defense, post-hoc forensics, and runtime interception of fully-formed actions — cannot adequately protect systems where AI-driven actions are irreversible, execute at machine speed, and originate from potentially compromised orchestration layers.</p>
<p>This paper introduces the Open Agent Trust Stack (OATS), an open specification for zero-trust AI agent execution. OATS is built on three architectural convictions.</p>
<div class="pillars">
<div class="pillar">
<div class="pillar-number">Conviction 01</div>
<h4>Allow-list enforcement</h4>
<p>Rather than intercepting arbitrary actions and deciding which to block, OATS constrains what actions can be expressed through declarative tool contracts, making dangerous actions structurally inexpressible.</p>
</div>
<div class="pillar">
<div class="pillar-number">Conviction 02</div>
<h4>Compile-time enforcement</h4>
<p>The Observe-Reason-Gate-Act (ORGA) reasoning loop uses typestate programming so that skipping the policy gate is a type error, not a runtime bug.</p>
</div>
<div class="pillar">
<div class="pillar-number">Conviction 03</div>
<h4>Structural independence</h4>
<p>The Gate phase is architecturally isolated from LLM influence.</p>
</div>
</div>
<p>OATS specifies five layers: <strong>(1)</strong> the ORGA reasoning loop with compile-time phase enforcement, <strong>(2)</strong> declarative tool contracts with typed parameter validation, <strong>(3)</strong> a cryptographic identity stack providing bidirectional trust between agents and tools, <strong>(4)</strong> a formally verifiable policy engine operating on structured inputs, and <strong>(5)</strong> hash-chained cryptographic audit journals with Ed25519 signatures for tamper-evident forensic reconstruction.</p>
<p>OATS is model-agnostic, framework-agnostic, and vendor-neutral. The architecture is informed by operational experience with a production runtime (Symbiont) that has operated autonomously for approximately eight months; however, rigorous empirical evaluation remains ongoing and this version of the specification should be read as an architectural contribution with an accompanying evaluation framework rather than a fully validated system.</p>
<figure class="diagram" id="fig-0" data-diagram="fig0">
<span class="diagram-eyebrow">Figure 0 · Trust stack</span>
<div class="fig0-stack"></div>
<div class="fig0-detail"></div>
<figcaption class="diagram-caption">
<strong>The trust stack.</strong> Five layers, each addressing a distinct security question. The ORGA loop (Layer 1) enforces that the Gate runs; tool contracts (Layer 2) constrain expressible actions; the identity stack (Layer 3) provides mutual authentication; the policy engine (Layer 4) evaluates authorization; the audit journal (Layer 5) records decisions. Click a layer for its conformance tie.
</figcaption>
</figure>
</section>
<!-- 1. Introduction -->
<section class="section" id="introduction">
<div class="section-divider"></div>
<div class="section-number">Section 01</div>
<h2>Introduction</h2>
<h3>1.1 The Runtime Security Gap</h3>
<p>AI agents now execute consequential actions across enterprise systems: querying databases, sending communications, modifying files, invoking cloud services, and managing credentials. Through function calling, plugins, external APIs, and protocol-based tool servers such as the Model Context Protocol (MCP), these agents perform multi-step tasks without human intervention.</p>
<p>These actions exhibit five characteristics that existing security paradigms cannot adequately address:</p>
<ol>
<li><strong>Irreversibility.</strong> Tool executions produce immediate and often permanent effects: database mutations, financial transactions, credential changes, or data exfiltration. Once executed, the damage is done.</li>
<li><strong>Speed.</strong> Agents execute hundreds of tool calls per minute, far exceeding human capacity for real-time review. Multi-step attack chains complete within seconds.</li>
<li><strong>Compositional risk.</strong> Individual actions may each satisfy policy while their composition constitutes a violation. Reading a confidential file is permitted; sending email is permitted; doing both in sequence may constitute exfiltration.</li>
<li><strong>Untrusted orchestration.</strong> Prompt injection and indirect instruction attacks mean the model's apparent intent cannot be trusted. Adversarial prompts can be embedded in documents, emails, and images that agents process.</li>
<li><strong>Privilege amplification.</strong> Agents routinely operate under static, high-privilege identities misaligned with the principle of least privilege.</li>
</ol>
<p>The gap in the current security landscape lies at the intersection of prevention and context-awareness: no existing system can block actions before execution based on both static policy and accumulated session context while simultaneously constraining what actions can be expressed in the first place. This is the gap that OATS addresses.</p>
<p>This paper makes two contributions: a normative system specification defining the runtime enforcement boundary for autonomous agent execution, and an implementation-grounded evaluation methodology derived from operational experience with a production runtime. The specification is the primary artifact; the evaluation framework (Section 14) is included to make the claims falsifiable and to enable comparable evaluation of future implementations. The contribution is a new runtime security abstraction with testable conformance properties, not a benchmark of one particular system.</p>
<h3>1.2 Design Principles</h3>
<p>OATS is built on three architectural convictions, each addressing a structural weakness in current approaches.</p>
<div class="callout">
<div class="callout-title">Core Thesis</div>
<p>Define what is permitted and make everything else structurally inexpressible, rather than trying to enumerate and block what is dangerous.</p>
</div>
<h4>Allow-list over deny-list</h4>
<p>Current runtime security approaches operate on a deny-list model: the agent formulates an action, a security system intercepts it, evaluates it, and decides whether to allow or block. This requires enumerating dangerous behavior — an enumeration that is incomplete by definition. OATS inverts this model. The agent fills typed parameters defined by a declarative tool contract. The runtime validates parameters against the contract, constructs the invocation from a template, and executes. The agent never generates raw commands or constructs unconstrained API calls. Within the scope of contracted tools, dangerous actions cannot be expressed because the interface does not permit them. Actions that bypass the contract layer entirely (e.g., direct network calls from compromised agent code) require complementary controls such as sandboxing (Section 10).</p>
<h4>Compile-time over runtime enforcement</h4>
<p>When enforcement correctness is verified only at runtime, a code change that introduces a path bypassing the policy engine goes undetected until that path is exercised. OATS addresses this through the Observe-Reason-Gate-Act (ORGA) cycle, which uses type-level programming (typestates) so that skipping the Gate phase, dispatching tools without reasoning first, or observing results without dispatching are compile-time errors. In a correctly implemented typestate, the type system enforces that every action passes through policy evaluation. This property holds for code paths within the typestate-governed loop; it does not extend to code that circumvents the loop entirely, which is why sandboxing and network isolation provide complementary enforcement.</p>
<h4>Structural independence over trust assumptions</h4>
<p>When the policy engine shares context, memory, and execution environment with the orchestration layer it governs, an LLM compromised through prompt injection can potentially influence the evaluation of its own actions. In OATS, the Gate phase receives a structured action proposal and evaluates it against policy using a formally verifiable policy engine. The LLM cannot modify, bypass, or influence the Gate's evaluation.</p>
<h3>1.3 Contributions</h3>
<p>This specification makes five contributions:</p>
<ol>
<li><strong>Typestate-enforced reasoning loop.</strong> The ORGA cycle with compile-time phase enforcement, designed to prevent policy evaluation from being skipped, circumvented, or reordered within the loop (Section 5).</li>
<li><strong>Allow-list tool contracts.</strong> A declarative tool contract format that constrains agent-tool interaction to typed, validated parameters, making dangerous actions structurally inexpressible (Section 6).</li>
<li><strong>Layered cryptographic identity.</strong> A bidirectional identity stack providing mutual authentication between agents and tools via domain-anchored cryptographic verification (Section 7).</li>
<li><strong>Hash-chained audit journals.</strong> Cryptographically signed, hash-chained event journals for tamper-evident forensic reconstruction (Section 9).</li>
<li><strong>Conformance requirements.</strong> Minimum requirements for OATS-compliant systems, enabling objective evaluation of implementations (Section 12).</li>
</ol>
<p>OATS's novelty is not any single component in isolation — typestates, policy engines, cryptographic signatures, audit logs, and sandboxing each have extensive prior art. The contribution is the integration of five layers into a unified runtime security model centered on consequential action execution, with three properties not found in prior work in combination: (a) expressibility constraints that eliminate action categories before policy evaluation, (b) compile-time enforcement that the policy gate executes on every dispatch path within the loop, and (c) bidirectional cryptographic identity binding actions to verified agents and verified tools. The conformance requirements formalize these properties into testable criteria, enabling objective comparison across implementations.</p>
</section>
<!-- 2. Related Work -->
<section class="section" id="related-work">
<div class="section-divider"></div>
<div class="section-number">Section 02</div>
<h2>Related Work</h2>
<h3>2.1 Agent Security Research</h3>
<p>The security risks of LLM-based agents have been catalogued by several surveys. Ruan et al. and Wu et al. provide comprehensive threat taxonomies covering prompt injection, tool misuse, and data exfiltration. Su et al. focus on autonomy-induced risks including memory poisoning and deferred decision hazards. Debenedetti et al. introduce AgentDojo for evaluating attacks and defenses against LLM agents, while Ye et al. propose ToolEmu for identifying risky agent failures. These works characterize the problem space but do not propose runtime enforcement architectures. OATS builds on their threat models and contributes a system specification for constraining and evaluating actions before execution.</p>
<p>Gaire et al. systematize security and safety risks in the Model Context Protocol ecosystem, providing a taxonomy of threats to MCP primitives. Their analysis of tool poisoning and indirect prompt injection directly informs OATS's threat model for tool supply chain attacks.</p>
<h3>2.2 Runtime Security Specifications</h3>
<p>Errico introduces Autonomous Action Runtime Management (AARM), a system specification for securing AI-driven actions at runtime. AARM formalizes the runtime security gap, proposes an action classification framework distinguishing forbidden, context-dependent deny, context-dependent allow, and context-dependent defer actions, and specifies conformance requirements for pre-execution interception, context accumulation, policy evaluation, and tamper-evident receipts. OATS shares AARM's identification of the action layer as the stable security boundary and incorporates its context-dependent action classification. OATS extends this foundation with compile-time enforcement of the reasoning loop, allow-list tool contracts, concrete cryptographic identity protocols, and multi-tier execution isolation.</p>