Open standards · Apache 2.0
The Governed Runtime Standards
Three open specifications that turn accountability for AI agents into documents you can store, export and verify. They grew out of Renly's work on evidence and approval for AI agents, and are published so that any runtime can produce them and any auditor can check them.
The three specifications
One question each.
When an AI agent stops answering and starts acting, the question changes from "is this output good" to "can we account for what happened." Each standard answers one part of that.
Action Provenance Record
What did the agent do, for whom, with which model, and what happened?
One sealed record per action: who asked, which agent and model acted, what policy decided, who approved, what changed in which system, and the outcome. Digests instead of payloads. Optional per-tenant hash chain.
Read the specification →Action Approval Attestation
What exactly did a human permit, for how long, and can we prove it?
A human's approval bound to a digest of the exact proposal they saw, with single, session or standing scope and an expiry. Makes "approve X, execute Y" and approval creep detectable.
Read the specification →Governed Runtime Profile
What must a runtime guarantee before it may call itself governed?
Twelve testable guarantees: attribution, effect classification, approval gates, versioned policy, fail-closed, kill switch, autonomy levels, tenant isolation, model control, integrity and least privilege. Plus a conformance review procedure.
Read the specification →Why we published them
Accountability should not depend on which vendor you bought.
The part of Renly that mattered most to the people accountable for AI was never the agents. It was the evidence: for every action, who asked, which model, what the policy said, who approved, what changed, and a chain so it holds up in an audit. Nobody had standardised that record, so we wrote it down. An organisation should be able to put these formats in a procurement questionnaire and hold any runtime to them, including ours.
Adopt incrementally
Three levels in every specification.
An implementation can start at Level 1 and progress one level at a time. The reference implementation reports the level a document reaches and every issue between it and the next.
| Level | Action Provenance Record | Action Approval Attestation | Governed Runtime Profile |
|---|---|---|---|
| 1 | Attributable. Who, which agent and model, what, and what happened. | Bound. The decision is tied to a digest of the exact proposal. | Attributable runtime. Attribution, provenance, effect classification, tenant isolation, model control. |
| 2 | Governed. A policy verdict on every action; approval on every write that reached execution. | Scoped. Humans decide; auto decisions cite a policy; broad grants state what they match and carry a bound. | Governed runtime. Approval gates, versioned policy, fail-closed, kill switch, autonomy cap, least privilege. |
| 3 | Verifiable. Sealed with a content digest and a MAC or signature; chained per tenant. | Verifiable. Sealed. | Verifiable runtime. Records sealed, chained and exportable for offline verification. |
Renly's implementation status
Implementing the standards we publish.
The standards grew out of Renly's work on evidence records and human approval, and Renly is implementing all three specifications in its runtime. Renly does not yet claim a conformance level. When it meets a level for every tenant and every agent, as the Governed Runtime Profile requires, it will publish a conformance report with the evidence a reviewer needs to test it, in the same format any implementer uses.
Relationship to other work
Complementary, not competing.
C2PA
Content provenance authenticates artefacts: where a file came from, whether a model made it. Action provenance accounts for behaviour. A C2PA manifest for a generated image; an Action Provenance Record for the action that generated it.
W3C PROV and PROV-AGENT
Activity graphs for scientific and agentic workflows. The record maps to PROV-DM (activity, agents, entities by digest) and adds what PROV does not carry: approval and policy verdict.
Agent Action Capsule (SCITT Internet-Draft)
An individual Internet-Draft that anchors what an agent executed in a SCITT transparency log with COSE signatures, and carries the permitting authority as an opaque reference. The Action Approval Attestation supplies that authority. The capsule anchors; the record explains.
OpenTelemetry GenAI conventions
Telemetry records model and token usage in time. The record's model and cost members map to the same attributes. A trace tells you what a system did; a record tells you what an organisation is accountable for.
Common questions
Straight answers.
Are the standards free to use?
Yes. Specifications, schemas and the reference implementation are Apache 2.0. Any runtime can implement them and any organisation can require them, with no fee and no permission needed.
Is conformance a certification?
No. Conformance is self-declared per specification. The reference test suite and test vectors show how the structural rules apply, and the profile includes a conformance review procedure a reviewer can use to test a runtime's claim rather than accept it.
Does Renly conform to these standards?
Renly is implementing all three specifications in its runtime and does not yet claim a conformance level. It will publish a conformance report, with the evidence a reviewer needs to test it, when it meets a level for every tenant and every agent. Any report Renly publishes is held to the same rules as anyone else's.
Can I contribute or object?
Please do. Version 1.0 is a working draft with a frozen field set. Clarifications and proposals go through issues in the repository; disagreements are recorded there.
Own it.
Renly is the governed runtime for AI agents. Every action carries its provenance. These are the open standards Renly is building to.