TRACE Gives AI Agents a Hardware-Backed Audit Trail

Ask most teams running AI agents in production to prove what an agent did last Tuesday and you get application logs — written by the same software stack whose behaviour is in question. That is fine for debugging and useless for assurance. On August 25, 2026, the Linux Foundation announced it will provide vendor-neutral governance for TRACE, an open specification for hardware-attested runtime and compliance evidence contributed by confidential computing vendor OPAQUE.

• TRACE stands for Trust, Runtime Attestation and Compliance Evidence
• It was developed by OPAQUE with support from AMD, Intel, Microsoft and the Technology Innovation Institute
• Records are anchored in silicon-level attestation from AMD SEV and Intel TDX, producing artifacts the project calls Trust Records
• The specification composes existing IETF and IRTF work rather than inventing new cryptography

What a Trust Record Contains

The design goal is a single verifiable artifact that ties together the things an auditor actually asks about. A TRACE record links the runtime environment an agent executed in, the software that was executed, the policies applied to it, the classifications of the data it touched, and the tools it invoked.

The important word is hardware-attested. Rather than the application asserting these facts about itself, the underlying confidential computing platform — AMD SEV or Intel TDX — attests to the measured state of the environment. That moves the root of trust below the software being audited, which is the only place it does any good.

The resulting artifact is designed to be portable across cloud providers, confidential computing platforms, and sovereign infrastructure. Portability is what separates a standard from a vendor feature: evidence produced on one platform has to be verifiable by a party running on another.

Which Existing Standards Does TRACE Build On?

This is the part that makes it credible. TRACE does not invent a new attestation format. It composes:

• RFC 9711 (Entity Attestation Token) for the claim envelope
• RFC 9334 (Remote ATtestation procedureS) for the attester, verifier and relying-party roles
• The SCITT draft for anchoring records to a transparency ledger

Each of those has been through IETF or IRTF review, which is a slower and more adversarial process than a vendor specification typically survives. Assembling reviewed primitives into a profile aimed at a specific problem is generally how durable standards happen — and it means implementations can reuse existing RATS tooling rather than starting from zero.

Why Vendor-Neutral Governance Is the Real News

An attestation format controlled by one vendor is a lock-in mechanism with extra steps. Relying parties have to trust the issuer, and if the issuer is also selling the platform being attested, the incentives are visibly wrong.

Moving TRACE under Linux Foundation governance addresses that directly, and the backer list — AMD, Intel, Microsoft and the Technology Innovation Institute — spans competing silicon and cloud interests. That is the same structural logic behind Akrites, the foundation's open source AI threat defence project, and behind the Open Secure AI Alliance's 40-plus member push in July.

For teams already thinking about agent provenance, this slots alongside the identity work we covered when CrowdStrike gave AI agents verifiable identity with zero standing privilege. Identity answers who the agent is; TRACE aims at what it ran, under which policy, on what.

What to Do With This Today

Not much yet, and that is the correct answer. TRACE is a specification entering vendor-neutral governance, not a product you deploy this quarter. The practical move for security teams is to check whether your confidential computing platform already exposes AMD SEV or Intel TDX attestation, since that is the substrate TRACE builds on, and to note the requirement in any agent governance framework you are drafting now.

If you are hardening agent pipelines in the meantime, our guide to securing AI coding agents in CI covers the controls available today. More defensive coverage lives on the AI security page.

Sources: The Linux Foundation — August 25, 2026; SecurityWeek — August 26, 2026; Help Net Security — August 26, 2026.