TRACE
An open specification and Python library for generating hardware-attested, tamper-evident records of what an AI agent actually did — for audits and compliance.
🔗 Visit TRACE
Description
As companies hand more real decisions to AI agents, a basic question becomes surprisingly hard to answer with certainty: can you prove what an agent actually did, under which rules, and that the log wasn't altered afterward? Software-only logs can be edited or spoofed, which is a problem the moment an auditor, regulator, or customer needs real proof rather than your word for it. TRACE addresses that by rooting the proof in hardware: each record of an agent's action is cryptographically signed inside a secure hardware environment, making it tamper-evident rather than just a claim in a database.
It's an open specification plus a free Python package (pip install agentrust-trace) that documents what model and weights ran, on what runtime, under which policy, touching which data, and calling which tools — all wrapped in a signed artifact anchored to an independent transparency ledger (SCITT) so records can be verified by a third party. It includes a conformance test suite with defined compliance levels, aimed at organizations that need to demonstrate AI governance rather than just assert it.
💬 Our review
The short version: a narrow but forward-looking project — as AI agent governance and compliance requirements tighten, hardware-rooted, verifiable action records are a meaningfully stronger foundation than a plain application log, and it costs nothing to adopt since it's a free, open specification.
Its real advantage is the hardware attestation itself: rooting the proof in silicon (via a trusted execution environment) rather than trusting the same software stack that ran the agent to also faithfully log its own behavior is the correct way to build tamper-evidence, and anchoring to an independent transparency ledger (SCITT) adds outside verifiability instead of just self-reported logs. The honest limitation is that this is a young, narrow spec rather than a full governance platform — it gives you the attested record, not policy authoring, dashboards, or alerting, and it depends on hardware attestation support being available on the runtime you're using, which not every environment offers today.
💰 Pricing
📊 Global score
🤖 AI-enriched data
Spécification ouverte, package Python gratuit (pip install agentrust-trace), pas de plan payant.
Pros
Preuve ancrée matériellement (attestation dans un environnement d'exécution sécurisé), pas juste un log logiciel
Ancrage à un registre de transparence indépendant (SCITT) vérifiable par un tiers
Spécification ouverte et package gratuit
Suite de tests de conformité avec niveaux définis
Cons
Spécification étroite, pas une plateforme de gouvernance complète (pas de dashboard/alerting)
Dépend du support d'attestation matérielle sur l'environnement d'exécution
Projet jeune, adoption encore limitée