Episode 220: Not Promises: Attesting What Your AI Agent Is
September 1, 2026 · 1 min read
Identity infrastructure answers who called. Agentic systems must also answer what was actually running. Imran Siddique, Chief Platform Officer at OPAQUE, will show how hardware attestation can verify an agent’s runtime state beyond tokens and audit logs. He’ll cover agentrust-io projects including TRACE, Agent Manifest, and Confidential MCP, plus real failure modes and the work’s direction within the Agentic AI Foundation.
#Speakers
- Host: Mike Schwartz, Founder/CEO Gluu
- Guest: Imran Siddique, Chief Platform Officer, OPAQUE Systems
#Homework
- TRACE, the attestation record format. Start with the spec README and the conformance levels.
- Confidential MCP — . The most mature running code, and the fastest way to see enforcement rather than description.
- AgenTrust-IO Project Hub - home to incubate several projects
- CSA Webinar: The Verifiable Agent Virtual Briefing
- Imran's new book Architecting at Scale: A Practical Guide to Large-Scale System Design: From Monolith to AI-Native, Beyond Scaling Servers
#Takeaways
- Deployment intent is not proof of runtime state. Agent Manifest addresses the “day 1 versus day 30” problem: can you prove the model, policy, and other artifacts running now are what you approved?
- Attestation comes in different assurance levels. TPMs, TEEs and Virtual Confidential Computing can provide much stronger guarantees because the governed workload cannot simply rewrite the evidence.
- TRACE is evidence, not telemetry. Telemetry can be a firehose; TRACE is intended to preserve the durable facts an auditor or investigator needs to reconstruct what happened.
- Proof should bind execution to policy. A TRACE record can identify the model, runtime measurement, policy bundle, data classification and tool activity so a third party can independently verify what actually ran.
- Default deny fits agentic systems particularly well. Instead of trying to enumerate everything an unpredictable agent must not do, declare what it may do and deny everything else.