Summary

  • The IETF archive announced The Governance Audit Record for Agentic AI Systems revision 07 on 3 September 2026. Datatracker classifies it as an individual Internet-Draft with no IETF endorsement, formal standing, RFC stream or responsible Area Director.
  • GAR-06 attached external recovery signing to R-3 and called that class an attestation-integrity failure. The related MAD-03 taxonomy actually defined R-3 as non-response and stopped at R-7.
  • GAR-07 moves the external-signing rule to R-8, expands the recorded revocation classes from six to eight and makes the re-attestation event R-8-only.
  • Multi-Agent Delegation in Sovereign Object Systems revision 04, dated 4 September, adds R-8 for a suspected or confirmed compromise. It requires immediate revocation, human reauthorization and descendant cascade while warning that a forged compromise signal can itself become an attack.
  • The current texts are semantically aligned, but GAR-07's normative bibliography still identifies MAD-03. A reproducible implementation profile should bind GAR-07 to MAD-04 by revision and hash, record the reason-to-code mapping and test the whole recovery path.

The repair starts with a category error

GAR is designed to record an agent session's governance history: what authority existed, why a session stopped, what state remained and who approved recovery. In revision 06, its external-signing rule said R-3 applied to an “Attestation Integrity Failure.” It then required a verifier outside the governing enforcement component to sign the completed re-attestation, because a compromised kernel should not certify its own return.

The principle was intelligible. The class was not. The related MAD-03 text defines R-3 as Non-Response: a session did not answer a governance signal within the required window. Its revocation taxonomy contains seven classes and no separate compromise class. GAR-06 also exposed only R-1 through R-6 in its single-session and child-event fields, leaving R-7 outside those enumerations.

This is more than a typographical untidiness. A code decides which recovery gate opens, whose signature is acceptable and which descendants lose authority. If one document says R-3 means non-response while another uses the same code for suspected kernel compromise, a conforming implementation cannot obtain a deterministic meaning from the joined text.

GAR-07 moves the signer to R-8

The 3 September revision makes a narrow set of connected changes. The design principle now assigns external signing to R-8 Compromise. The ALE_KIA_REATTESTATION_COMPLETED event fires only for R-8. Single-session and child revocation fields expand to R-1 through R-8. The residual-risk section likewise says the R-8 carve-out supplies an external signature for this one recovery event.

That change preserves an important separation of authority. The component whose integrity is under question can still produce ordinary audit material, but it cannot be the sole witness to the specific act that says its identity and policy state are trustworthy again. The verifier's identifier and Ed25519 signature are separate fields. Sessions that ran during the attestation gap are listed and must carry a warning in an audit package.

The draft is also candid about the limit. External signing protects one event. It does not prove that every earlier record signed by a compromised-but-still-signing component was true. GAR says stronger hardware attestation is the relevant mitigation at its highest conformance level and warns lower levels not to advertise a guarantee they do not supply.

MAD-04 gives R-8 its operational meaning

One day later, the current MAD-04 added the missing class. Its revision note says the gap surfaced while the taxonomy was mapped to a separate mandate-lifecycle profile that already had a compromise reason without an R-code counterpart.

R-8 covers a mandate or credential believed compromised through a suspected or confirmed external attack. Examples include exposed key material, credential theft and an attestation failure showing that runtime identity no longer matches the attested state. MAD distinguishes this from R-1, where the agent violates a constitutional limit inside the authority that was granted. In R-8 the authority instrument itself may no longer be trustworthy.

The consequence is deliberately severe. The session stops immediately rather than waiting for a natural breakpoint. Its completion state cannot be clean. A human principal must authorize any continuation, and new authority cannot reuse the compromised credential or key material derived from it. Revocation cascades through all descendants because their authority came from the suspect mandate. Their sub-agent composition records and ephemeral identity references are voided.

The record must name a detection source—an attestation failure, a continuous-access security signal or an operator report—and retain the specific evidence reference when available. MAD-04 then identifies the counter-risk: a false compromise signal could become a denial-of-service tool. The governing component must authenticate the signal against the signaling authority's own keys before it commits the revocation.

That creates a complete decision chain: detected condition, authenticated evidence, reason code, halt, partial-state classification, cascade, human gate, external re-attestation and restoration. R-8 is not merely a new label. It allocates losses and signing power across the recovery path.

The living documents agree; the fixed citation does not

Current readers can open the Datatracker entries and see GAR-07 beside MAD-04. At that level the taxonomy joins cleanly. But GAR-07's normative references still name draft-sato-soos-mad-03, dated June 2026. That immutable artifact defines R-1 through R-7 and gives R-3 the non-response meaning. It cannot supply the R-8 semantics that GAR-07 invokes.

This may be ordinary editorial sequencing: GAR-07 appeared on 3 September and MAD-04 is dated 4 September. The public record does not establish motive, coordination or error handling, so none should be invented. The observable fact is narrower. A reader who resolves the document family to its newest version gets one dependency graph; a reader who follows the cited revision gets another.

An alias is convenient for discovery. It is insufficient for an audit. If an implementation claim says only “supports GAR and MAD,” later revisions can silently change what that claim means. If it pins only GAR-07, the normative path still ends at a taxonomy without R-8. The smallest complete unit is a pair: GAR-07 plus MAD-04, accompanied by the exact file hashes and the mapping that justifies the pair.

A version-joined receipt

A compact conformance receipt can make the boundary reproducible without turning the draft family into a heavy governance system. It would record the GAR and MAD names, revisions, hashes and retrieval times; the reason string and R-code; the accepted detection-source types; the key used to verify the trigger; the affected root and descendants; the completion state; the human decision; the external verifier; and the final restoration event.

Negative tests matter most. Present R-3 non-response and confirm that it never enters the R-8 re-attestation branch. Present an authenticated R-8 signal and confirm immediate cascade. Present a forged signal and confirm rejection without authority loss. Attempt recovery using the compromised component's own signature, a derived key and an unresolved partial state. Each must fail for a different recorded reason.

Corrections should append. If GAR-08 later cites MAD-04 or a newer revision, the receipt should retain the old pair and state exactly which dependency edge changed. That preserves the historical answer to a practical question: what rule did the running implementation believe on that date?

Heng Lu's Running-Code Primacy supplies the editorial test, not evidence of deployment. Publication is not operational reality; deterministic local validation and use are what give a technical rule effect. His minimum-specification discipline points in the same direction: share only the semantics needed for interoperation, but make those semantics exact enough that independent operators reach the same result.

Keep the authority label honest

The GAR Datatracker page and the MAD page carry an unusually important warning. Both are individual Internet-Drafts. Anyone may submit such a document. Neither is endorsed by the IETF or has formal standing in its standards process. There is no RFC stream, responsible Area Director or telechat date.

The documents' own headers express an intended standards-track destination, but intention is not process state. The drafts may be updated, replaced, abandoned or allowed to expire. No implementation, interoperability test, production use, regulatory acceptance or live compromise event was found for this review.

The news is therefore neither that the IETF has standardized an AI-governance architecture nor that a deployed control failed. It is that two public working artifacts corrected an important authority mapping, and the correction itself exposes a basic requirement for trustworthy governance: the code, the reason and the version that defines them must travel together.

Sources

  1. IETF archive announcement — GAR-07
  2. IETF Datatracker — Governance Audit Record
  3. GAR revision 07
  4. GAR revision 06
  5. IETF Author Tools — GAR-06 to GAR-07
  6. IETF Datatracker — Multi-Agent Delegation
  7. MAD revision 04
  8. MAD revision 03
  9. IETF Author Tools — MAD-03 to MAD-04
  10. Heng Lu — Running-Code Primacy
  11. Heng Lu — Minimum Initial Specification
  12. Heng Lu — Reality, Not Advocacy