RFC 001 — The Conformance Layer

The doctrine says what must be governed and where. It has never said what must be true for a single agent action to be governed. This proposes twenty-nine statements that answer that, and that an implementation can fail.

Revision history

Revision 1 was published on 31 July 2026 and reviewed adversarially the same day. That review found three places where criteria in the proposal could not all hold at once, and identified several requirements that were missing entirely. Revision 2 is the result. The changes are recorded here rather than applied silently, because a proposal that cannot show what review did to it is not really open for comment.

What revision 1 got wrong

• Delegation contradicted Least Agency. Revision 1 required delegated authority to be a strict subset of the delegator's. Combined with role separation, that forces an orchestrating agent to hold the union of every subagent's authority purely as a pass-through, which then exceeds what its own mission requires. Three criteria could not all hold in any non-trivial multi-agent deployment. Revision 2 constrains inherited authority only, and permits independently granted, mission-scoped authority at a subagent.
• Reproducible policy decisions forbade anomaly detection. Revision 1 required that the same action in the same context always yield the same decision, while separately requiring the governing system to act on detection of anomalous behavior. Anomaly detection is a moving baseline by definition, so the two requirements excluded each other. Revision 2 replaces reproducibility with two separable properties: the basis of a decision must be stateable, and a decision must be replayable from its recorded inputs and the policy version in force.
• The Simultaneity Requirement was never operationalized. Revision 1 named it as the idea that separates a conformance layer from a checklist, then left it as prose with no identifier and no verification question, including in the maturity table where it appeared as a requirement nobody could assess. More seriously, nothing bound the action that was evaluated to the action that was committed. That gap is the mechanism by which Intent Hijacking actually executes. Revision 2 makes it a criterion with both bindings, temporal and semantic.

What revision 2 adds

Seven requirements were missing. Two of them are, on reflection, more important than most of what revision 1 contained:

• Fail-closed on governing-system unavailability. Revision 1 said an action no policy addresses is denied. It said nothing about what happens when the policy engine is unreachable or saturated. Real enforcement architectures fail open under load, because failing closed means the agent stops and someone is paged. In that window the entire conformance layer is void, and it is exactly the window an adversary will manufacture. The requirement derives from this proposal's own premise: a criterion that cannot be evaluated does not hold, so an action whose criteria cannot be evaluated must not proceed.
• Authorization fidelity. A human authorizes a Tier 3 action. What does the human see? In most implementations, a description generated by the agent. If that description is inaccurate, through error or through optimization pressure toward approval, the authorization is a laundering step and the record shows a clean approval for an action the approver never understood.

The others are model binding and provenance, governance of persistent cross-session state, a design-time declaration of evidentiary obligations, and the Simultaneity criterion itself.

What revision 2 removes

Revision 1 fixed six criteria per Plane. That number was allocated rather than derived, and the consequence was filler: several criteria restated their neighbours to fill the quota. Ten criteria have been merged into four, and two have been cut outright, one because it was entailed by two others and one because it prescribed a specific architecture, which this proposal's own rules forbid. Plane counts are unequal by design in revision 2.

Two ideas from revision 1 are gone entirely, and their removal matters more than their replacement. Revision 1 asked whether a record was sufficient to reconstruct why an action was taken, and whether intent could be established from records alone. Neither is answerable. For a language-model agent, the available artifact is generated narration, which carries no guaranteed causal relationship to the computation that produced the action. Treating that narration as evidence of intent in an audit would be actively harmful, because it invites a regulator or an opposing party to read a plausible story as an admission. Revision 2 replaces both with replayability, which is a determinate test.

Why this, and why not a control catalogue

Since v3 the doctrine has had three layers: the 5 Laws say why, the 5 Architectural Planes say where, and the 6 Framework Pillars say how to build. Government and industry standards have since become considerably more specific at the control layer, naming mechanisms, protocols and prohibitions. See the CISA mapping for the clearest example.

The obvious response would be for this doctrine to publish its own control catalogue. That would be a mistake, for three reasons. It would compete with government guidance at the layer where government guidance is strongest and carries a mandate. Control specifics decay fastest, so a doctrine that names mechanisms is dated within two revisions of the technology. And it would collapse the distinction that makes standards mapping possible at all: if the doctrine becomes a catalogue, there is nothing left to map with.

This proposes the opposite move. A Conformance Criterion is a statement that must hold for an agent action to be governed, written so that it can be tested, and so that any mechanism satisfying it qualifies, today's or a successor's. Three properties are mandatory:

• Testable. Every criterion carries a verification question with a determinate answer. A criterion that cannot fail an assessment is a restatement of a Law and does not belong here.
• Mechanism-agnostic. No criterion names a protocol, product or algorithm.
• Mappable. Each criterion is a target that external standards can be mapped onto, which is what makes those standards comparable to one another.

A catalogue tells you which controls to implement. A conformance layer tells you what must be true when you are done, and lets you check.

Revision 1 claimed its verification questions were adversarial by design, and offered as its example a question asking an assessor to name an authority an agent held beyond its mission. Review was right to reject that reasoning. Adversarial and determinate are different properties, and only the second is required here. A question whose answer depends on how sharp the assessor is has not been specified; it has been delegated.

Plane 1 — Agent Identity & Lifecycle

C1.5 is new. Revision 1 required provenance and a bound version for every tool, while saying nothing about the most privileged component in the system. An organization was required to know who published a calendar connector, but not what was deciding to use it, nor whether it changed last Tuesday. C1.5 is also a precondition for C3.4 and C4.5: nothing can be replayed against a model that has been swapped underneath it.

Plane 2 — Execution & Tool Governance

C2.3 replaces revision 1's requirement that retrieved content be "treated as data, never as instruction." That formulation was incoherent. A language model's context is one undifferentiated token sequence with no type system, so the distinction is semantic rather than structural and cannot be enforced by the substrate. Read strictly, nothing conformed. Read loosely, everything did. C2.3 states the property that can actually be tested at the boundary where enforcement lives, and it concedes openly that the containment is empirical rather than absolute. Prompt Injection is defended at the action, not inside the cognition.

C2.4 is new, and it closes the channel that defeats mission-scoped authority. Authority expires with the mission under C1.3, but influence does not. Anything an agent writes to memory, notes, caches or a vector store outlives the mission that wrote it. That is the durable form of prompt injection: inject once, persist indefinitely.

Plane 3 — Policy & Compliance Engine

C3.3 and C3.4 are the two halves of what revision 1 tried to say with a single requirement for reproducible decisions. Splitting them resolves the contradiction with C5.4: anomaly-based, rate-based and time-based controls all return different results for the same nominal action, and are now conformant, because what is required is that the basis be stateable and the decision replayable from its recorded inputs, which include the score or counter the engine consulted.

C3.5 is the most consequential criterion in this proposal, and revision 1 hid it behind an ambiguous word. Denial by default at tool granularity is nearly vacuous, since an allowlist is already an allowlist. At effect granularity it is a large claim, because a single enumerated tool can span an unbounded effect space. A general shell, a browser, an arbitrary HTTP client: one tool, infinitely many effects. Revision 2 states the granularity and accepts the consequence:

Generality is itself a governance decision. A tool whose effect space cannot be enumerated is not a conformant tool, and an agent that requires one is not operating under this layer.

C3.8 is new, and it is the most valuable addition in revision 2. It is derived rather than invented: if an action is governed only when every applicable criterion holds, and a criterion that cannot be evaluated does not hold, then an action whose criteria cannot be evaluated must not proceed. Without it, the availability of the governing system is an attack surface with no criterion attached.

Plane 4 — Human Oversight, Audit & Traceability

This Plane depends on a construct the doctrine does not yet have. Humans Retain the Right to Intervene asserts the right without saying at what threshold it is exercised. That is the second gap recorded as an open revision item in v3.2.

Action Tiering

Guidance elsewhere tiers agent actions by stakes, often with a monetary threshold as the example axis. Stakes are a poor primary axis. They are subjective, they argue badly under assessment, and in regulated environments they mislead, because the disclosure of a single record is unrecoverable and costs nothing. Revision 2 tiers by reversibility, with two qualifiers that revision 1 lacked.

Reversibility decays with time. A transfer is reversible for minutes, a message for seconds, a configuration change until the first consumer reads it. Revision 1 asserted that reversibility is determinable in advance, which is false for most actions. The comparison that can actually be made is whether an action's recovery window exceeds the organization's own measured detection latency. That makes tier assignment deployment-specific rather than universal, which is uncomfortable and correct: an organization that cannot detect quickly has fewer Tier 2 actions available to it.

Magnitude is a second axis, not a competitor. Reversibility says whether an action can be undone; magnitude says whether anyone should care. Revision 1's own justification for abandoning stakes proves they are orthogonal rather than alternatives. Tier assignment records both, and magnitude may raise a tier but never lower one.

Reads. Revision 1 left the most common action type undefined, and both readings were wrong. Under Law 1 the agent is a principal, so a read discloses to a principal; taken literally, every read of sensitive data becomes Tier 3 and every retrieval-based agent becomes unusable. Taken loosely, an agent may traverse an entire protected store autonomously and trip a gate only on egress, which is backwards from how access to protected records is actually regulated. Revision 2 resolves it explicitly: a read is tiered by the boundary it crosses, not by the act of reading. A read within the mission's declared data boundary is Tier 1. A read that brings data across that boundary into the agent's context is Tier 2, because it is unrecoverable but bounded. A read that places data beyond the declared boundary is Tier 3.

C4.4 is new, and without it C4.3 is theatre. A human authorization that rests on an agent-authored description of the action is not oversight; it is a signature on a document the signer did not write and cannot verify. Approval fatigue is the best-documented failure mode of human-in-the-loop systems in every prior domain, and revision 1 had no defence against it.

C4.6 is new and states an obligation at design time rather than discovering it after an incident. Declaring what must be provable, and demonstrating that the runtime can produce it before deployment, makes auditability falsifiable while it is still cheap to fix. This mirrors long-standing assurance-case practice, in which the claim and the evidence required to sustain it are stated before the system is built rather than assembled afterwards.

Plane 5 — Multi-Agent Trust & Delegation

C5.2 is the correction to revision 1's contradiction. Requiring delegated authority to be a strict subset of the delegator's seems obviously right and is not, because it forces an orchestrating agent to accumulate every authority its subagents need purely in order to pass them down, which then violates Least Agency at the orchestrator. Independent grant is the resolution: an orchestrator that decides needs no authority to act, and a subagent that acts needs no authority to decide.

C5.4 also closes a way revision 1 could be satisfied vacuously. It governed what happens on detection of anomalous behavior without requiring that any detection capability exist, so an organization with none conformed trivially. Cascading Failure is not contained by halting one agent while its consumers continue on what it already produced.

Cross-plane — the Simultaneity Criterion

Of the four threats named on the Declaration, Intent Hijacking, a valid action taken for an invalid reason, has never had a clean architectural home. That is not an untidiness in the model. It is the reason this layer is necessary.

An intent-hijacked action passes every individual control it encounters, because each one returns permitted. The identity is real. The tool is allowlisted. The policy rule matches. The action is in tier. No single criterion catches it, and no catalogue of controls can, because a catalogue is evaluated one control at a time.

Revision 1 stated that much and stopped, which left the criterion unassessable and, worse, left the actual gap open. Two things can diverge between the action that was governed and the action that occurred. It can change in time: policy evaluates an action, and something else commits. It can change in meaning: policy evaluates an action interpreting a term one way, and enforcement applies it interpreting the same term another way. The action never changed; the definition did. Both divergences produce a governed record for an ungoverned act.

The action that was governed and the action that occurred must be the same action, in both time and interpretation. Conformance is a property of the action, not of the control set.

The semantic half is not theoretical. In regulated environments the terms that policy depends on carry defined meanings, and systems that resolve them independently will disagree. Where the policy engine and the tooling hold separate definitions of what qualifies as a protected record, or as sufficiently de-identified, every criterion can pass and the disclosure still occurs. Semantic interoperability has been treated as a first-class engineering problem in health and defence information exchange for decades. It becomes a governance problem the moment two components must agree on what an agent is doing.

The Maturity Model becomes an instrument

The AI Harness Maturity Model currently states that an organization should never deploy agents beyond its governance maturity, while providing nothing with which to measure that maturity. Revision 1 assigned each criterion a level and stopped there, which left two problems review was right to name.

A level must license something. Revision 1's Level 1 was entirely observability, and no level said what it permitted an organization to deploy. A level number that licenses nothing is a badge. Revision 2 binds the levels to the tiers:

Level 1 licenses Tier 1 actions only. Level 2 licenses Tier 2. Level 3 licenses Tier 3.

Levels are sorted by implementation cost, not by conceptual sophistication. Revision 1 placed the requirement for a single reconstructable cross-system record at Level 1, as though it were part of a basic inventory. It is unified cross-system tracing with a correlated identity spine, and organizations that have not achieved it for their own services in a decade will not achieve it for agents as a first step. Meanwhile Level 2 held genuinely cheap items. Sequencing by cost is the only function a maturity model performs, so revision 2 re-sorts accordingly.

Gating criteria and the conformance profile

Revision 1 made each level all or nothing. That produces misreporting rather than rigor: an organization at twenty-eight of twenty-nine does not report Level 0, it reports Level 2 and hopes. An instrument that makes honest reporting maximally costly selects for dishonest reporting.

Percentage credit is worse, because it would let an organization buy a level while missing the criterion that mattered. Revision 2 uses the structure that assessment regimes converge on for exactly this reason:

• Gating criteria are strictly binary and cannot be compensated: C1.4 (an agent cannot reach its own authority), C3.8 (the system fails closed), and C4.3 (irreversible actions require human authorization). Failing any one of these means the level is not held, whatever else is true.
• All other criteria report as a conformance profile: X of Y at the claimed level, with each exception named, its compensating measure documented, and a remediation date attached. A claim without its profile is not a claim.

What this does not change

The proposal is additive. The 5 Laws keep their names and their count. The 5 Architectural Planes and 6 Framework Pillars are unchanged. The three non-negotiables and the bumper sticker are unchanged. A revision that renamed the doctrine's spine would invalidate every citation the doctrine has earned, and no gain at the conformance layer would justify that.

Two things do change if this lands: the Maturity Model is rebuilt rather than amended, and Law 5 gains Action Tiering.

Open questions

Revision 1 published five. Three are now answered and are recorded here as closed, since a proposal that never closes a question is not converging. Two remain, and two are new.

• Closed: how many criteria. Twenty-nine, because the per-Plane quota is gone and the count now follows the content. Plane counts are unequal by design.
• Closed: is reproducibility of policy decisions too strong. It was not too strong, it was unstable, and one of this proposal's own criteria fell in its excluded set. Replaced by C3.3 and C3.4.
• Closed: scope of the supply chain. Training-data integrity and general software supply chain remain out of scope, because they are not properties of an agent action and are not assessable by the organization conformance is assessed against. Model binding, which revision 1 also excluded, was wrong to exclude and is now C1.5.
• Open: does tiering survive contact with practice? C4.2 now requires recording the recovery window and comparing it to measured detection latency. Whether organizations can measure their own detection latency honestly is untested.
• Open: is partial conformance meaningful or corrosive? The gating-plus-profile structure is a judgement, not a demonstrated result. The failure mode to watch is gates that quietly widen under commercial pressure.
• New: is C3.5 too expensive to be adopted? Enumerating effects rather than tools excludes general-purpose agents from conformance. That is deliberate. It may also be a line the market simply refuses, in which case the criterion is correct and irrelevant, which is the worst outcome available to a standard.
• New: who holds the definitions CX.1 depends on? Semantic binding requires a single definitional authority per term. In a regulated environment that authority may sit outside the deploying organization entirely, and nothing here says what happens when two external authorities disagree.

Mapping from revision 1

Status

Revision 2, published 1 August 2026. Open for comment through 31 October 2026. The version-lock target has moved out of Q4 2026: locking a set with known internal contradictions would produce a standard that the first serious implementer disproves, and the date is worth less than the correctness. Until this lands in a numbered release recorded in the changelog, nothing on this page is doctrine.

Substantive disagreement remains more useful than endorsement. Revision 1 was improved most by the reader who tried hardest to break it. Comments to rfc@aiharnessdoctrine.org.