CAVA: Canonical Action Verification and Attestation for Runtime Governance of Agentic AI Systems¶
🕒 Published (v1): 2026-07-15 11:34 UTC · Source: Arxiv · link
Why this paper was selected
Cross-runtime action attestation; governance layer for heterogeneous agentic deployments
Ask a follow-up
Open an assistant pre-loaded with this paper's context.
💬 Ask ChatGPT✦ Ask Claude
TL;DR¶
CAVA (Canonical Action Verification and Attestation) is a runtime-semantics layer that converts heterogeneous agent activity—shell hooks, SDK tool calls, browser automation, API gateways—into canonical, hashable action objects so governance decisions bind to action semantics rather than raw display text. A 96-seed, 384-variant benchmark shows CAVA achieves 1.000 across all nine governance metrics while raw-text and first-token baselines fail on equivalence, wrapper bypass, approval binding, and attestation. The contribution is a systems formalization of action-level canonicalization as a necessary substrate for deployer-side AI governance.
Problem¶
Agentic AI systems act through many incompatible runtime surfaces: the same high-impact operation (e.g., a git push, a payment trigger, a role-assignment change) may appear as a shell command, an SDK method, an MCP tool call, a browser event, or a CI/CD API request. Raw-text and first-token policies cannot achieve stable governance because: (1) semantically equivalent rewrites (e.g., env GIT_SSH_COMMAND=... git push vs. git push origin main) produce different strings that evade literal policy matches; (2) wrappers (sudo, bash -c, aliases) change the surface without changing the consequence; (3) approval drift occurs when an operator approves one surface form while a different—or rewritten—semantic action executes. No existing observability, telemetry, or tracing standard treats the canonical action object as the governance primitive.
Method¶
CAVA defines a six-stage protocol over raw runtime events:
- Capture: collect raw event and execution context.
- Normalize: map to a canonical runtime action \(C(a) = (v, r, e, o, k, S, \tau, u, m)\) — schema version, runtime family, executable identity, normalized operation, risk category, systems touched, reversibility, target context, adapter metadata.
- Interpret: run a Semantic Pattern Layer \(P(C(a), B(a), D(a)) \rightarrow \{p_1, \ldots, p_n\}\) that combines canonical action \(C(a)\), boundary context \(B(a)\) (destination visibility, account provenance), and data context \(D(a)\) (sensitivity, minimization posture) into versioned, evidence-bearing policy-addressable patterns (hidden externality, public persistent egress, security-control weakening, credential exposure, delegated authority mismatch, workflow sink risk, prompt/rule tampering).
- Fingerprint: compute \(F(a) = H(\text{canon}(C(a)))\) — a deterministic, collision-resistant hash over selected canonical fields.
- Bind: attach policy outcomes, approvals, or denials to \(F(a)\), not to the raw string.
- Close / Attest: attach outcome evidence; optionally extend receipts with workspace signatures, verifiable credentials, in-toto/Sigstore attestations, or ledger anchoring.
CAVA is explicitly positioned as the lower substrate beneath Proof-Carrying Agent Actions (PCAA): PCAA owns route-review-prove authority; CAVA supplies the stable action object that authority loop governs.
Key Contributions¶
- Formalization of canonical runtime action identity across heterogeneous agent runtimes
- CAVA protocol binding policy outcomes, approvals, receipts, and attestations to canonical fingerprints \(F(a)\) rather than raw text
- Semantic Pattern Layer mapping canonical actions and context to policy-addressable agentic risk patterns, decoupling reusable risk semantics from customer-specific rules
- Threat model covering semantic bypass, wrapper bypass, approval drift, evidence laundering, and parser capture
- Open-core reference implementation separating portable schema/receipt verification from managed parser packs and enterprise policy routing
- 96-seed, 384-variant reproducible benchmark harness with ablation study and red-team casebook (24 attacker-style narratives)
Results¶
Aggregate results on the 96-seed, 384-variant corpus (Table 5):
| Metric | Raw text | First-token | CAVA |
|---|---|---|---|
| Semantic equivalence recall | 0.000 | 0.000 | 1.000 |
| Semantic separation precision | 1.000 | 0.750 | 1.000 |
| Wrapper-bypass catch rate | 0.000 | 0.000 | 1.000 |
| False-positive control | 0.500 | 0.500 | 1.000 |
| Approval binding correctness | 0.000 | 0.000 | 1.000 |
| Receipt reproducibility | 0.000 | 0.000 | 1.000 |
| Attestation tamper detection | 0.000 | 0.000 | 1.000 |
| Runtime portability convergence | 0.000 | 0.000 | 1.000 |
| Semantic pattern detection | 0.000 | 0.333 | 1.000 |
- Ablation: removing canonical fingerprint collapses approval binding and portability to 0.00; removing receipt verifier collapses tamper detection to 0.00; removing PCAA binding retains only 0.25 on policy-degradation and drift suites.
- Benchmark covers 8 structured policy-degradation cases, 6 Azure deployment drill cases, and 24 red-team casebook narratives (qualitative).
Limitations¶
- Benchmark corpus (96 seeds, 384 variants) is small relative to enterprise production diversity; results are "regression evidence for the representative corpus, not a universal claim over all future enterprise runtimes."
- Production parser packs, PCAA policy routing, enterprise evidence graph, and managed connector rules are withheld under the open-core boundary — the core claim cannot be fully reproduced without the commercial OSuite layer.
- CAVA assumes runtime events can be captured; when a runtime is observe-only (no inline interception), enforcement depth is limited and the system explicitly discloses rather than overstates coverage.
- Semantic pattern detection and wrapper normalization depend on adapter quality; removing profile aliases degrades domain-specific action confidence to 0.50.
- The paper is single-author and industry-originated (Ond Holdings); independent replication of benchmark results on enterprise-scale traces is not reported.
Relevance to Agentic AI / LLM Agents¶
CAVA directly addresses the deployer-side governance gap that arises when LLM agents operate autonomously across multi-runtime environments: the very heterogeneity that makes modern agentic systems powerful (tool use, browser automation, API composition) also makes action identity unstable for oversight. By formalizing a canonical action object and fingerprint as the governance primitive, CAVA provides infrastructure for runtime-level human oversight that complements model-level alignment — specifically relevant to the open problem of how to give human principals meaningful approval authority over high-stakes agentic actions without being trivially bypassed by surface rewrites. The Semantic Pattern Layer connects to emerging agentic risk taxonomies (OWASP agentic AI, NIST GenAI risk profile) and to the broader line of work on safe deployment of tool-using agents, offering a concrete substrate for concepts like "minimal footprint," "corrigibility," and "approval-gated action" to be operationalized at runtime rather than only in model training.