An audit log is written by the system being audited. That sentence is not a critic's jab. It is in the specification the Linux Foundation took under its governance today.
On August 25, 2026 the Linux Foundation announced it had welcomed TRACE, which stands for Trust, Runtime Attestation and Compliance Evidence. The specification was contributed by OPAQUE and is supported by AMD, Intel, Microsoft and the Technology Innovation Institute. It defines a record format for proving what an AI agent did. Jim Zemlin, chief executive of the Linux Foundation, framed the need in one line: "The widespread adoption of autonomous systems requires independent, cross-platform proof of operational integrity" (Linux Foundation, August 25, 2026).
Today is a governance transfer, not a launch. TRACE was introduced at the Confidential Computing Summit on June 23, 2026. What changed is who holds it. The specification now sits under neutral foundation governance rather than with the vendor that wrote it, which is the point Imran Siddique of OPAQUE made explicitly: "Runtime evidence only works as a standard if it is portable, independently verifiable and not controlled by the vendor producing it."
What a Trust Record actually binds
The record is a set of signed claims a third party can check without trusting the operator. The published fields name the model identity and a digest of its weights, the runtime platform and its measurement, a hash of the policy bundle and its enforcement mode, the data classification touched, a hash of the tool transcript and the number of tool calls, and a receipt pointing at an independent anchor. The supported hardware environments are AMD SEV-SNP, Intel TDX and NVIDIA H100 (TRACE specification, v0.2).
The anchoring matters more than it looks. TRACE composes over standards that already exist rather than inventing a stack: RFC 9711 for the claim envelope, RFC 9334 for the attester and verifier roles, and SCITT for transparency-ledger anchoring. SCITT itself reached Proposed Standard status as RFC 9943 in June 2026, weeks before today's transfer. The load-bearing parts of this design are ratified work that predates the agent record built on top of them. That is worth knowing before treating TRACE as a novel dependency: the novelty is the record format, not the trust machinery underneath it.
The part of the specification nobody quotes
TRACE ships a limitations file and tells implementers to read it before relying on the specification in production. It is the most useful document in the repository, because it disarms the claim the press coverage leads with.
TRACE defines conformance levels. At Level 0, the software-only level, the guarantee largely evaporates. The limitations file states that a privileged operator with root access can produce a valid-looking Level 0 record for a run that never happened, or that violated policy. It further states that Level 0 does not provide hardware-rooted trust and does not satisfy EU AI Act tamper-evident logging requirements or DORA information and communication technology risk management standards. Level 0 is the level most teams will implement first, because it needs no confidential computing estate.
The file is candid about four other boundaries. TRACE does not prove recency, so a verifier can be shown a valid record from an earlier run unless timestamps, nonces or ledger anchoring are added on top. It does not record the model's internal reasoning or context window contents. It maps tool call graphs by temporal adjacency, so it cannot prove which data from one tool response drove the next call. And it attests which policy was enforced, not whether that policy achieves anything.
Attestation proves which policy ran. It does not prove the policy was right. The second question is still yours. Hikari Blue · operator note
This arrives while the US supervisor is still writing
American bank regulators are not ahead of this. On April 17, 2026 the Office of the Comptroller of the Currency, the Federal Reserve Board and the Federal Deposit Insurance Corporation issued revised model risk management guidance as OCC Bulletin 2026-13, rescinding the 2011 framework. On scope, the guidance is unambiguous: "Generative AI and agentic AI models are novel and rapidly evolving. As such, they are not within the scope of this guidance."
Two qualifications keep that fact honest. The guidance was never binding in the first place. It states that it "does not set forth enforceable standards or prescriptive requirements" and that non-compliance "will not result in supervisory criticism". And the agencies said they plan to issue a request for information covering banks' use of generative and agentic AI. As of today that request has not been issued, four months on.
So the position is this. The frame of reference examiners use for model validation excludes the models banks are deploying, the replacement is unwritten, and in the interval the evidentiary format is being fixed by a consortium of chip and cloud vendors. A firm that waits for the rule will inherit a definition of evidence it had no part in setting. Regulated firms appear to have read the situation the same way: on August 13, 2026 the Agentic AI Foundation, a separate Linux Foundation body that hosts the Model Context Protocol, reported 247 member organizations after adding 57, with Visa and Wells Fargo joining as Gold members.
What to examine before an attestation claim reaches a board
Four questions separate a governance record from a slide. Which conformance level does the implementation reach, and is it above Level 0. Who verifies the record, and is that party independent of the operator that produced it. What is bound into the record beyond the model name, specifically the policy hash and the tool transcript. And is the policy itself testable, since attestation certifies enforcement and says nothing about adequacy.
Two cautions on maturity. The specification is at v0.2 and labelled a developer preview by its own authors. Adoption so far is a distribution number rather than a deployment number: the reference library was first published to PyPI on June 5, 2026 and recorded 238,026 downloads excluding mirrors over the 81 days to August 24, 2026. That count includes continuous integration runs and package caches, and no part of it evidences a production deployment. Neither fact argues against reading the specification now. Both argue against citing it as a control that exists today.
The metric worth tracking is narrow: the share of agent executions in scope for AI governance that produce a record a party outside your operations team can verify. Not the share that produce a log. Almost every stack produces logs. That is the distinction the whole specification exists to draw, and Anand Pashupathy of Intel put it plainly: "Evidence that cannot be independently verified is not evidence."
If a regulator asked tomorrow for proof of what your agents did last quarter, who wrote the proof?
The answer is almost always the same team that ran the agents. That was tolerable while agents drafted documents. It stops being tolerable the moment they move money, deny a claim, or touch a patient record. Building the layer that answers differently is ordinary engineering work, and it is the work an AI operating layer exists to do.
- The Linux Foundation (August 25, 2026). Linux Foundation Welcomes TRACE to Advance Verifiable Runtime Evidence for AI Workloads. Source for the date of the governance transfer, the expansion of the TRACE acronym, the contribution by OPAQUE, the supporting organizations AMD, Intel, Microsoft and the Technology Innovation Institute, the quotations from Jim Zemlin, Imran Siddique and Anand Pashupathy, and the statement that the open specification, technical documentation and reference implementations are available. linuxfoundation.org, Linux Foundation welcomes TRACE
- AgenTrust (2026). TRACE specification v0.2 and LIMITATIONS. Primary source for the Trust Record claim set (model identity and weights digest, runtime platform and measurement, policy bundle hash and enforcement mode, data class, tool transcript hash and call count, anchoring receipt), the supported hardware environments AMD SEV-SNP, Intel TDX and NVIDIA H100, the developer preview status and June 23, 2026 launch date, the composition over RFC 9711, RFC 9334 and SCITT, and every stated limitation cited here, including that a privileged operator can produce a valid-looking Level 0 record for a run that never happened and that Level 0 does not satisfy EU AI Act tamper-evident logging or DORA. github.com/agentrust-io/trace-spec
- Internet Engineering Task Force (June 2026). RFC 9943, An Architecture for Trustworthy and Transparent Digital Supply Chains. Source for the SCITT architecture reaching Proposed Standard status in June 2026, which is the anchoring layer TRACE relies on for independent transparency-ledger receipts. datatracker.ietf.org, RFC 9943
- Office of the Comptroller of the Currency (April 17, 2026). OCC Bulletin 2026-13, Model Risk Management: Revised Guidance. Primary source for the exclusion of generative AI and agentic AI models from the scope of the revised interagency guidance, for the statement that the guidance does not set forth enforceable standards and that non-compliance will not result in supervisory criticism, for the $30 billion asset relevance threshold, and for the agencies' stated plan to issue a request for information on banks' use of AI. occ.gov, Bulletin 2026-13
- The Linux Foundation (August 13, 2026). Agentic AI Foundation Welcomes 57 New Members, Gaining Major Financial Services Players and APAC Leaders. Source for the total of 247 member organizations and for Visa and Wells Fargo joining as Gold members. Cited to show regulated firms taking positions in the standards bodies, and distinct from TRACE, which the Linux Foundation hosts separately. linuxfoundation.org, Agentic AI Foundation welcomes 57 new members
- Python Package Index, statistics API (retrieved August 25, 2026). Package agentrust-trace, the TRACE reference library. Source for the first release on June 5, 2026 and for 238,026 downloads excluding mirrors across the 81 days from June 5 to August 24, 2026. The figure is reproducible by summing the without_mirrors series returned by the overall endpoint for this package. Download counts include continuous integration runs and caches and do not evidence production deployment. pypi.org/project/agentrust-trace
The Hikari Blue team · Austin, August 2026