PCAA: Proof-Carrying Agent Actions
A deployer-side governance primitive for binding human or policy approval to the action an agent will actually execute, rather than to a mutable prompt, wrapper call, or after-the-fact log.
Research at Ond
A public record for governing agents before they act.
Ond publishes the governance research behind OSuite. PCAA assigns final governance authority. CAVA supplies canonical action identity. BAF checks bounded authorization at mediated execution boundaries. AREG connects runtime exposure evidence and uncertainty within the available record.
Final authority
PCAA
PCAA decides who holds final governance authority for an action.
Read → Action identityCAVA
CAVA gives policy a canonical action identity to evaluate.
Read → Bounded authorizationBAF
BAF checks action leases against bound context and effects at mediated execution boundaries.
Read → Exposure evidenceAREG
AREG maps supplied runtime relationships, evidence gaps, and uncertainty.
Read →Featured
Featured research
CAVA: Canonical Action Verification and Attestation
A runtime-semantics layer for turning shell commands, MCP calls, SDK calls, workflow steps, and gateway requests into canonical action objects that OSuite can score, route, approve, attest, and prove.
Index
Publications
Papers, frameworks, benchmarks and field notes, newest first.
- Oct 15, 2026 Matoi: Selective Revalidation of Consequence Evidence for Agent Authorization Paper
- Sep 21, 2026 ZeroGate: Trust-Preserving Fast Paths for Governed AI Agent Runtimes Paper
- Jul 16, 2026 CAVA: Canonical Action Verification and Attestation Framework
- Jul 16, 2026 Final Authority in AI Governance Governance thesis
- Jul 3, 2026 Runtime Exposure Management Research direction
- Jun 27, 2026 Agent Runtime Exposure Graph Framework
- Jun 26, 2026 Bounded Action Firewall and Action Gate Leases Framework
- Jun 24, 2026 PCAA: Proof-Carrying Agent Actions Paper
- Jun 16, 2026 Decision Score v2.1 Benchmark note
- Jun 12, 2026 From AI Policy to Runtime Control Field guide
Research update: 5 October 2026
When does an approval remain valid as a workflow changes?
An approval binds to an action, its execution context, and current authority, not just a command string. Today, strict BAF matches supplied context and effect tuples. AREG's research-only bounds describe evidence and uncertainty within finite supplied occurrences and declared worlds; they do not enumerate every future effect.
The proposed connection would use state-dependent reachable consequences to inform lease validation as a workflow evolves. Prediction never grants permission: safe narrowing still depends on action identity, lifecycle, authority, and freshness. Every covered side effect needs mediation before commitment; an unrelated graph change is not automatically an authorization violation.
This working research direction is unpublished and not peer-reviewed. The June dates are unchanged; the entries below explain the enforcement limits and related work.
BAF scope and enforcement · AREG evidence and limits · The architecture path
Published research / September 2026
ZeroGate: prepare earlier, verify at the boundary.
A shorter dispatch boundary, not less governance. Explore the Action Pass design, its relationship to PCAA and CAVA, and the measured costs and limits of prepared approval.
Read the research and access the paper, whitebook, and evidence →
Selected independent citations · September 2026
Our research is entering the conversation.
Two independent papers cite CAVA and PCAA while investigating different gaps between an approved action and its execution. Here are the sources, in context.
01 / KAIST
When Valid Tool Calls Change Meaning: Formation-Consistent Dispatch for LLM Agents
“Isolation and provenance systems mediate components or bind runtime actions [56, 57, 58, 59, 60, 61]. FCD retains the interpreters authorized to give that action meaning.”
CAVA is reference [60] within this grouped citation in Section VIII-B. The paper examines how a valid tool call can change meaning when its interpreter changes between formation and dispatch.
02 / CAS · UCAS · Beihang · BUPT
Agent Approval Laundering: Transitive Effects Beyond the Approved Invocation
Author affiliations: Institute of Information Engineering, Chinese Academy of Sciences; School of Cyber Security, University of Chinese Academy of Sciences; Beihang University; State Key Laboratory of Networking and Switching Technology, Beijing University of Posts and Telecommunications.
“Proof-Carrying Agent Actions and CAVA bind action identity, receipts, canonicalization, and attestation [16, 17]”
In Related Work, the authors distinguish that binding from their closure-bound approval approach: checking the transitive effects an approved invocation can activate.
Research is only useful when it changes runtime behavior.
OSuite connects authority, action identity, bounded authorization and exposure evidence, so teams can inspect what was approved and what the runtime record does and does not establish.