Open standards · Apache 2.0
The Governed Runtime Standards
Three open specifications that turn accountability for AI agents into documents you can store, export and verify. They are the formats Renly's runtime produces in production, published so that any runtime can produce them and any auditor can check them.
The three specifications
One question each.
When an AI agent stops answering and starts acting, the question changes from "is this output good" to "can we account for what happened." Each standard answers one part of that.
Action Provenance Record
What did the agent do, for whom, with which model, and what happened?
One sealed record per action: who asked, which agent and model acted, what policy decided, who approved, what changed in which system, and the outcome. Digests instead of payloads. Optional per-tenant hash chain.
Read the specification →Action Approval Attestation
What exactly did a human permit, for how long, and can we prove it?
A human's approval bound to a digest of the exact proposal they saw, with single, session or standing scope and an expiry. Makes "approve X, execute Y" and approval creep detectable.
Read the specification →Governed Runtime Profile
What must a runtime guarantee before it may call itself governed?
Twelve testable guarantees: attribution, effect classification, approval gates, versioned policy, fail-closed, kill switch, autonomy levels, tenant isolation, model control, integrity and least privilege. Plus an afternoon-long audit procedure.
Read the specification →Why we published them
Accountability should not depend on which vendor you bought.
The part of Renly that mattered most to the people accountable for AI was never the agents. It was the evidence: for every action, who asked, which model, what the policy said, who approved, what changed, and a chain so it holds up in an audit. Nobody had standardised that record, so we wrote it down. An organisation should be able to put these formats in a procurement questionnaire and hold any runtime to them, including ours.
Adopt incrementally
Three levels in every specification.
A team can start at Level 1 in a day and climb. The reference implementation reports the level a document reaches and every issue between it and the next.
| Level | Action Provenance Record | Action Approval Attestation | Governed Runtime Profile |
|---|---|---|---|
| 1 | Attributable. Who, which agent and model, what, and what happened. | Bound. The decision is tied to a digest of the exact proposal. | Attributable runtime. Attribution, provenance, effect classification, tenant isolation, model control. |
| 2 | Governed. A policy verdict on every action; approval on every write that reached execution. | Scoped. Humans decide; auto decisions cite a policy; broad grants state what they match and carry a bound. | Governed runtime. Approval gates, versioned policy, fail-closed, kill switch, autonomy cap, least privilege. |
| 3 | Verifiable. Sealed with a content digest and a MAC or signature; chained per tenant. | Verifiable. Sealed. | Verifiable runtime. Records sealed, chained and exportable for offline verification. |
Renly's conformance statement
Held to the same rules as anyone else.
Renly conforms to all three specifications at Level 3. Every record carries a policy verdict, approval gates on side-effecting actions, a SHA-256 content digest, an HMAC-SHA256 seal under a dedicated evidence key, and per-tenant chaining verified against frozen snapshots. One stated exception: fail-closed semantic policy evaluation is an Enterprise plan capability; structural policy gates fail closed on every plan.
{
"spec": "governed-runtime/1.0",
"runtime": { "name": "Renly", "vendor": "XiPlatform Pty Ltd" },
"level": 3,
"guarantees": {
"GR-1": "yes", "GR-2": "yes", "GR-3": "yes", "GR-4": "yes",
"GR-5": "yes", "GR-6": "yes, semantic evaluation on Enterprise",
"GR-7": "yes", "GR-8": "yes", "GR-9": "yes", "GR-10": "yes",
"GR-11": "yes", "GR-12": "yes"
},
"records": {
"provenance": "action-provenance/1.0 Level 3",
"approval": "action-approval/1.0 Level 3"
},
"statedAt": "2026-09-03"
}
Relationship to other work
Complementary, not competing.
C2PA
Content provenance authenticates artefacts: where a file came from, whether a model made it. Action provenance accounts for behaviour. A C2PA manifest for a generated image; an Action Provenance Record for the action that generated it.
W3C PROV and PROV-AGENT
Activity graphs for scientific and agentic workflows. The record maps to PROV-DM (activity, agents, entities by digest) and adds what PROV does not carry: approval and policy verdict.
IETF Agent Action Capsule (SCITT)
Anchors what an agent executed in a transparency log with COSE signatures, and deliberately leaves the permitting authority as an opaque reference. The Action Approval Attestation supplies that authority. The capsule anchors; the record explains.
OpenTelemetry GenAI conventions
Telemetry records model and token usage in time. The record's model and cost members map to the same attributes. A trace tells you what a system did; a record tells you what an organisation is accountable for.
Common questions
Straight answers.
Are the standards free to use?
Yes. Specifications, schemas and the reference implementation are Apache 2.0. Any runtime can implement them and any organisation can require them, with no fee and no permission needed.
Is conformance a certification?
No. Conformance is self-declared per specification. The reference test suite is the authority for the structural rules, and the profile includes a procedure a reviewer can use to test a runtime's claim in an afternoon rather than accept it.
Does Renly use these itself?
Yes. They are the formats Renly's runtime already produces. Renly's conformance statement is above and inside each specification, held to the same rules as anyone else's.
Can I contribute or object?
Please do. Version 1.0 is a working draft with a frozen field set. Clarifications and proposals go through issues in the repository; disagreements are recorded there.
Own it.
Renly is the governed runtime for AI agents. Every action carries its provenance. These are the standards that say what that means.