Adnan KhanAdnanProduct & AI
San Francisco Bay Area
Get in touch

Source note2 min read

CAVA: Canonical Action Verification and Attestation for Runtime Governance of Agentic AI Systems

Source

arXiv

arxiv.org/abs/2607.13716v1

Read the source

Source

Plain-Language Brief

The paper introduces Canonical Action Verification and Attestation (CAVA), a system designed to convert diverse agent activities into standardized action objects, addressing the challenge of governing heterogeneous AI systems across various runtimes. The system is positioned below Proof-Carrying Agent Actions (PCAA) and provides a foundation for policy-addressable semantic patterns, aiding in deployer-side AI governance.

What the Document Says

  • CAVA is a runtime-semantics layer that converts heterogeneous agent activities into standardized action objects.
  • It aims to answer governance questions about action approval and execution.
  • The paper discusses canonical action identity, semantic pattern detection, approval binding, receipt integrity, runtime-portable projection, and optional attestation substrates.
  • CAVA is positioned below Proof-Carrying Agent Actions (PCAA).
  • The system defines the stable action object that PCAA's governance process manages.
  • The paper provides a 96-seed, 384-variant benchmark to study a reference implementation.

Key Concepts Mentioned

  • Canonical Action Verification and Attestation (CAVA)
  • Proof-Carrying Agent Actions (PCAA)
  • Runtime governance
  • Action objects
  • Semantic pattern detection
  • Approval binding
  • Receipt integrity
  • Runtime-portable projection
  • Attestation substrates

Claims Made by the Document

  • CAVA provides a solution for governing heterogeneous AI systems across various runtimes.
  • The system defines a stable action object that can be governed by PCAA.

Evidence Used

  • The paper explains the features and functionalities of CAVA, including canonical action identity, semantic pattern detection, etc.
  • The benchmark provided for studying the reference implementation is detailed.

Methods / Approach

  • Formalization of concepts related to CAVA
  • Study using a benchmark

Limitations Stated by the Authors

  • The paper does not provide an actual implementation or testing beyond the presented benchmark.

Limitations Noted by the Agent

Agent interpretation — not from the source.

  • The agent does not have the ability to run the provided benchmark or test the actual implementation of CAVA.

Open Questions

  • What are the specific details of the reference implementation?
  • How effective is the actual implementation in governing heterogeneous AI systems?

Notes for Future Q&A

May include interpretation. Labeled where it does.

  • The paper provides a detailed explanation, but the focus is more on theory than practical implementation.

Raw Abstract / Excerpt

Agentic AI systems increasingly act through heterogeneous runtimes: local coding hooks, SDK tools, browser automation, managed-agent traces, API gateways, and workflow engines. A single operational act such as publishing code, changing identity state, moving money, or exporting data may therefore be represented by many incompatible runtime records. This makes a basic governance question difficult to answer: what action was actually approved, what evidence binds the approval to execution, and can an independent verifier reproduce the same action identity later? This paper presents Canonical Action Verification and Attestation (CAVA), a runtime-semantics layer for converting heterogeneous agent activity into canonical runtime action objects. CAVA is positioned below Proof-Carrying Agent Actions (PCAA): PCAA defines the deployer-owned route-review-prove governance process, while CAVA defines the stable action object that process governs. The paper formalizes canonical action identity, semantic pattern detection, approval binding, receipt integrity, runtime-portable projection, and optional attestation substrates. We study a reference implementation through a 96-seed, 384-variant benchmark covering semantic equivalence, semantic separation, wrapper bypass, false-positive control, approval binding, receipt reproducibility, attestation tamper detection, runtime portability, semantic pattern detection, policy degradation, and Azure deployment drills. The contribution is a systems formulation of action-level canonicalization and policy-addressable semantic patterns as a necessary substrate for deployer-side AI governance.