CITATION.cff

cff-version: 1.2.0
title: "Agent Governance Spine: An architectural pattern for deterministic policy enforcement, per-agent identity, and tamper-evident audit for autonomous AI agents"
message: "If you use this specification, please cite it as below."
type: software
authors:
  - given-names: Drew
    family-names: Mattie
    affiliation: "SaaSquach AI Labs (a division of Charles & Roe Inc.)"
repository-code: "https://github.com/drewmattie-code/Agent-Governance-Spine"
url: "https://github.com/drewmattie-code/Agent-Governance-Spine"
license:
  - CC-BY-4.0
  - MIT
date-released: 2026-05-28
version: "1.0"
abstract: >
  AGS (Agent Governance Spine) is an architectural pattern for the
  governance layer that sits above MCP / PDS / ACS / ESF / CRI — the
  protocol-layer substrate where deterministic policy enforcement,
  per-agent identity, and tamper-evident audit are applied to every
  agent action BEFORE the model's intent reaches the wire. The pattern
  addresses four documented failure modes of naive agent deployment at
  scale: prompt-layer trust collapse (relying on the model's compliance
  instead of deterministic policy), identity blur (multi-agent systems
  where attribution is impossible), audit gap (no tamper-evident record
  for SOC 2 / regulator review), and policy drift (policy living in
  prose and tribal knowledge instead of versioned lintable code). The
  pattern is defined as ten principles plus reference SLAs and a
  numbered build sequence. It is the fifth specification in the
  SaaSquach AI Labs catalog alongside PDS, ACS, ESF, and CRI.
keywords:
  - agent-governance
  - policy-as-code
  - opa
  - cedar
  - spiffe
  - did
  - audit
  - tamper-evident
  - owasp-agentic
  - deterministic-enforcement
  - llm-architecture