The Procurement Binary: Moving Beyond Vendor Assertions
For enterprise security leaders, the current state of agentic AI deployment is defined by a fundamental asymmetry. While organizations are rapidly integrating autonomous agents into critical workflows, the ability to verify that these agents remain within defined operational boundaries is lagging. This widening distance between agent activity and verifiable compliance is what the industry now identifies as the Verifiability Gap.
Today, at the Linux Foundation Decentralized Trust, the Advanced AI Society launched the working draft of Proof-of-Control (PoC) v1.0. Developed by a coalition of over 80 global security leaders, including a Distinguished Review Board featuring security technologist Bruce Schneier, this standard aims to replace vague vendor promises with cryptographic evidence.
Defining the Verifiability Gap
As Charles Iheagwara, Global Head of AI & Cybersecurity at AstraZeneca, noted, the industry is currently operating on a broken trust model. Relying on vendor assertions rather than objective evidence is untenable when patient safety and intellectual property are at stake. Proof-of-Control seeks to bridge this gap by establishing a standardized framework for runtime governance, ensuring that every tool call and side-effect invocation is not just logged, but verifiable.
The standard introduces 127 requirements across 10 chapters, covering provenance, privacy, portability, authorization, identity, security, evidence generation, verifiability tiers, architecture, and conformance. Crucially, it establishes a binary threshold for procurement: an agent system has achieved Proof-of-Control only if it meets Tier 3 or higher. This transforms a complex technical audit into a yes-or-no question for enterprise buyers.
The Four Tiers of Trust
The framework categorizes verifiability into four tiers, graded not by whether cryptography is used, but by who you must trust:
- Tier 1 (Assertion): Relies entirely on the operator’s word. The system writes its own record.
- Tier 2 (Attestation): An auditor verifies with privileged access. Good hygiene, but static and retrospective — it cannot stop a live action.
- Tier 3 (Trust-minimized): Anyone can verify without privileged access using mathematical or distributed-assumption mechanisms. This is the binary threshold — the minimum bar for a Proof-of-Control claim.
- Tier 4 (Self-enforcing): Execution is gated on cryptographic proof. No proof, no write. The system halts on violation.
To achieve Tier 3, the standard mandates an Action Interception Gateway — a separate process from the agent with no bypass path (C7.1.1, Level 3). Every tool call and side-effect invocation must route through this gateway, which blocks out-of-scope actions rather than merely flagging them. The gateway’s own integrity is in scope.
Governance in Context
Proof-of-Control arrives one day after the Blueprint Alliance formed — 12 major vendors including Okta, AWS, Google Cloud, and CrowdStrike co-authoring a reference architecture for agent governance. The Alliance supports established protocols (MCP, OCSF, SSF, CAEP) and committed to publishing joint interoperability results. But consensus on architecture is not the same as verification of behavior.
The emerging landscape has three distinct governance layers. The CNCF is evaluating MCP as a cloud-native wire specification. Edge-based approaches focus on runtime enforcement. Proof-of-Control provides the evidence layer — the record of what an agent actually did, verifiable by anyone without trusting the operator. As the NSA noted in its May 2026 guidance on MCP, these challenges “should not be viewed as isolated problems that can be patched at the interface or endpoint level.”
The Insurance Angle
Perhaps the strongest signal of the standard’s potential market impact is the involvement of the insurance industry. An Insurance Working Group, convened by Vidur Nayyar, is working to convert runtime verification data into priceable risk models. Carriers pricing AI risk today rely on questionnaires and vendor self-claims — none of which produce evidence an outside underwriter can verify. Proof-of-Control supplies the record. Adjusters can be deposed; AI agents cannot.
Looking Ahead
Proof-of-Control v1.0 is a working draft, released under an Apache 2.0 license with an open-source reference implementation. It is designed to complement existing frameworks — CSA AARM enforces what an agent may do; Proof-of-Control evidences what it did. Crosswalks to NIST AI RMF, ISO/IEC 42001, SOC 2, the EU AI Act, OWASP, and MITRE ATLAS are published in the repository.
Public comment runs through October 30, 2026, with a final release targeted for February 1, 2027. The launch webinar “Who’s Watching the Agents?” runs today, September 23, at 11:00 AM ET, with speakers including Jim Zemlin (CEO, Linux Foundation), Tricia Wang (CEO, Advanced AI Society), and Daniela Barbosa (Executive Director, LFDT).
The open question is whether the standard can move fast enough to shape procurement before the market locks in on lower-tier verification. The Blueprint Alliance built consensus across 12 vendors in one day. Proof-of-Control is building the mechanism that makes that consensus enforceable. Whether the two converge — and whether insurers, regulators, and enterprise buyers adopt the binary threshold — will determine whether “Does your AI have Proof-of-Control?” becomes the question every vendor must answer.