Cross-ecosystem vocabulary for agent governance

[aeoess]

Across #36, #37 and #38 we are already connecting identity continuity, delegated authority and trust across different implementations. The concepts overlap but the names often do not. That leaves every integration to build its own translation layer.

I maintain agent-governance-vocabulary, an open Apache-2.0 registry built for this problem. It gives shared names to governance primitives and keeps per-system crosswalks so tools and verifiers can understand how each system expresses them. It currently maps more than thirty systems and includes fixtures. A mapping becomes canonical only when it is backed by implementation evidence.

The question I want to raise is whether the registry should continue to be governed by one project alone. I can continue the editorial and implementation work but naming and admission decisions would be stronger with independent review from the people building these systems.

This group is already where identity, delegated authority and trust are being connected. I think the registry could complement KYA-OS and the Delegated Authority work as the crosswalk between systems rather than another protocol.

Does this seem useful for the WG to explore? I am happy to walk through the registry, contribution policy and existing crosswalks here or on a WG call.

[aeoess]

https://github.com/aeoess/agent-governance-vocabulary

[0xbrainkid]

The crosswalk framing seems useful, especially if the registry stays evidence-backed instead of becoming a parallel naming authority.

One split I would preserve in the vocabulary is between the actor, the delegated authority, and the observed action receipt. A lot of agent-governance systems compress those into one "trust" object, but verifiers usually need to ask different questions:

• identity continuity: is this the same agent/runtime/profile I saw before?
• authority: what was it allowed to do at this moment, and by whom?
• evidence: what action happened, under which policy/capability, with what result?
• portability: can another verifier replay the claim without trusting the agent's summary?

That gives a registry a concrete admission test: a mapping should point to implementation evidence for each primitive separately, and mark unknown/combined fields explicitly. For example, a "passport" or "profile" might carry identity and reputation hints, but it should not be treated as authorization unless the underlying system has a scoped mandate/capability artifact.

That is close to how we think about SATP/AgentFolio: portable trust works better as small, typed receipts and attestations that can survive movement across runtimes, rather than as one score that every ecosystem has to interpret the same way.

So yes, this feels worth exploring in the WG. The strongest version would be a minimal vocabulary plus conformance fixtures: given a system's sample artifact, identify which governance primitives are present, absent, or only inferable.

[aeoess]

These four questions give the registry a much clearer basis than a general trust label. I think mappings should carry evidence at the primitive level, not only at the system level, and mark each field as present, absent or only inferable rather than filling gaps by assumption.

The passport example is useful because APS makes that separation explicit. The passport establishes identity continuity, while authority comes from a separate scoped delegation artifact. One should not be treated as evidence of the other.

I'll turn this into a draft update to the contribution policy and include one worked fixture using a real artifact, then link it here for review.

[hegu-1]

A cross-ecosystem vocabulary feels necessary because agent governance is fragmenting into many valid but incompatible dialects.

The terms I would want to normalize first are the ones that sit on the execution boundary:

• agent identity vs user delegated authority
• capability vs tool vs action
• policy decision vs audit event
• approval vs attestation vs receipt
• runtime principal vs organization owner
• memory/context provenance vs authorization provenance

Without shared names, every verifier ends up translating after the fact, which is exactly where governance evidence gets weak.

I have been sketching a related enterprise AI OS architecture around the same idea: models and frameworks change, but identity, workflow, policy, memory, and audit need stable semantics across the stack: https://github.com/hegu-1/enterprise-ai-os-architecture