#442 closed R4 (five decision types) and R8 (telemetry export). Recording what is left from the AARM v1.0 assessment so it is not re-derived.
One decision unlocks three requirements
R2, R3 and R7 all need the same thing: a declared-intent input.
- R2 wants context on the agent's intent, prior actions and thread. cMCP tracks prior actions and thread well (
SessionState monotonic sensitivity, injection events, suspicious sequences, catalog drift). It has no notion of declared intent.
- R3 wants the action evaluated against its alignment with stated intent. The action half is solid via Cedar; the alignment half has no input.
- R7 wants semantic distance from original intent. There is drift detection, but it is tool-catalog rug-pull detection and injection detection, which is a different thing and easy to mistake for this.
Adding a declared-intent input changes the MCP-facing surface, so this is one product decision rather than three tasks. Claiming Core with a documented deviation on R2 and R3 is a legitimate alternative and should be an explicit choice rather than a default.
Two smaller items
R6, identity binding. Passes today, but STATUS.md marks Agent Manifest binding optional, and R6 says every receipt MUST be bound. A named conformance profile that makes it mandatory, leaving the developer default alone, closes this cleanly.
R9, least privilege. Partial. There is resource-scoped Cedar policy plus credential and PII redaction, and ephemeral gateway keys. What is absent is issuing short-lived minimal-scope credentials to the agent, so enforcement is deny-based rather than scope-based.
Worth stating in any eventual listing
The differentiator is not the badge. On the reference listing, R5 is satisfied by Merkle-chained SHA-256, which is software integrity. cMCP satisfies R5 and R6 with a TEE-sealed signing key and an attestation report a verifier checks without trusting the operator. That would make it the only AARM listing whose receipts are hardware-attested.
Related: agentrust-io/trace-spec#114 covers getting step_up and defer into TRACE Claims, which is the remaining visibility gap on R4.
#442 closed R4 (five decision types) and R8 (telemetry export). Recording what is left from the AARM v1.0 assessment so it is not re-derived.
One decision unlocks three requirements
R2, R3 and R7 all need the same thing: a declared-intent input.
SessionStatemonotonic sensitivity, injection events, suspicious sequences, catalog drift). It has no notion of declared intent.Adding a declared-intent input changes the MCP-facing surface, so this is one product decision rather than three tasks. Claiming Core with a documented deviation on R2 and R3 is a legitimate alternative and should be an explicit choice rather than a default.
Two smaller items
R6, identity binding. Passes today, but
STATUS.mdmarks Agent Manifest binding optional, and R6 says every receipt MUST be bound. A named conformance profile that makes it mandatory, leaving the developer default alone, closes this cleanly.R9, least privilege. Partial. There is resource-scoped Cedar policy plus credential and PII redaction, and ephemeral gateway keys. What is absent is issuing short-lived minimal-scope credentials to the agent, so enforcement is deny-based rather than scope-based.
Worth stating in any eventual listing
The differentiator is not the badge. On the reference listing, R5 is satisfied by Merkle-chained SHA-256, which is software integrity. cMCP satisfies R5 and R6 with a TEE-sealed signing key and an attestation report a verifier checks without trusting the operator. That would make it the only AARM listing whose receipts are hardware-attested.
Related:
agentrust-io/trace-spec#114covers gettingstep_upanddeferinto TRACE Claims, which is the remaining visibility gap on R4.