The industry is converging fast on open protocols for how AI agents connect — MCP for tools, A2A for agent-to-agent communication. What has had no open standard is the layer above: what an agent is allowed to do, on whose authority, and who is accountable when it acts.
Today we're publishing that layer. All 27 AGF specifications are now public:
github.com/agent-governance-foundation/agf-standards
What's in the repository
The specifications cover the full governance surface:
- Delegation — the signed token format (Spec 01), chain semantics with scope-narrowing and depth limits (Spec 02), and canonical serialization (Spec 25)
- Trust — trust zones from local to cross-org (Spec 03), risk layers (Spec 04), and the cross-org Trust Summary, relay protocol, and registry design (Specs 24–27)
- Control — revocation with branch-cut semantics (Spec 05), policy model and versioning (Spec 06), emergency procedures (Spec 12), and human oversight and escalation (Spec 15)
- Accountability — signed, replayable audit trails (Spec 07), behavioral monitoring and drift detection (Spec 17), and regulatory compliance mapping (Spec 18)
- Interoperability — protocol adapters that apply governance decisions to MCP, A2A, and plain HTTP traffic without modifying those protocols (Specs 21–23)
Alongside the specs: a governance model with a defined maturity lifecycle (Working Draft → Candidate → Stable), an RFC process for proposing changes, a security disclosure policy, and the roadmap for machine-readable schemas and a conformance test suite.
Everything is licensed Apache 2.0 — free to implement, royalty-free, with an express patent grant. No permission needed, no registration, no fees.
Why open the standard
Governance infrastructure sits between your agents and everything they touch. Nobody should put a proprietary black box in that position — and no security team should have to.
- No lock-in. The protocol is open. You can read every rule your authorization decisions follow, implement it yourself, or switch implementations. The spec is the contract.
- Auditable by construction. "Our agent authorization follows the published AGF specifications" is a sentence a compliance officer or regulator can verify — section by section.
- Interoperable by design. A spec proven by independent implementations is how delegation chains, revocation, and audit artifacts work across vendors, not just within one.
The specifications reach Stable status only when at least two independent implementations pass the conformance suite. That bar applies to our own implementation too.
What this means for the AGF platform
The managed AGF Authorization Service is the reference implementation of these standards — hosted, hardened, and operated with SLAs, dashboards, HITL approval workflows, and enterprise integrations. That doesn't change. What changes is what you can now verify: every decision the service makes follows rules you can read in a public spec, and you're never locked to us for the protocol itself.
Implementing the specifications is free and requires no permission. Claims of AGF conformance are governed by the conformance process, so "conformant" stays meaningful as the ecosystem grows.
What's next
- Machine-readable schemas — JSON Schema for tokens, chains, and audit records; OpenAPI for the decision API
- Conformance test vectors — signed artifacts with expected verification outcomes, so any implementation can test itself
- Your feedback — every spec is a Working Draft, and implementation experience reports are the fastest way to move them toward Stable. Open an issue or an RFC.