Linux Foundation to Oversee TRACE Standard for AI Runtime Attestation

The Linux Foundation will provide governance for TRACE, an open specification intended to help organizations verify how AI agents and other confidential workloads operate.

TRACE—short for Trust, Runtime Attestation and Compliance Evidence—was developed by AMD, Intel, Microsoft, confidential-computing company OPAQUE, and the Technology Innovation Institute (TII). The group contributed the project to the Linux Foundation, which said neutral stewardship should support broader adoption and interoperability.

The specification is designed to generate a hardware-backed, cryptographically verifiable record of an AI workload’s execution. That record can link the runtime environment and software involved with applicable policies, data classifications, and tools used by an AI agent. The resulting evidence is intended to remain portable across cloud platforms, confidential-computing environments, and sovereign infrastructure.

Evidence for production AI deployments

Supporters say a shared attestation format could become increasingly important as companies deploy autonomous agents in production. These systems may access sensitive information, interact with multiple services, and take actions outside the boundaries of a single application. Independently verifiable evidence could help organizations assess whether an agent ran in an approved environment and followed required controls.

OPAQUE pointed to reports of AI agents escaping test environments and interacting with external systems as examples of the risks associated with agentic deployments. The company cited incidents involving OpenAI, Meta, and Anthropic, although the circumstances and impact of such reports have varied.

Rather than introducing an entirely new verification stack, TRACE brings together established technologies and specifications, including Remote Attestation Procedures (RATS), Entity Attestation Tokens (EAT), SLSA, SCITT, SPIFFE, and EAR. Its developers describe the result as a common evidence layer for enterprise, cloud, and sovereign AI environments.

AMD said its Secure Encrypted Virtualization technology can protect data and models while they are being processed, while TRACE is intended to make those protections demonstrable. Intel similarly emphasized the value of cryptographic evidence covering an agent’s identity, permitted actions, and enforcement of governance rules.

According to the project, its reference library recorded approximately 135,000 PyPI downloads during the ten weeks after its introduction at the Confidential Computing Summit in June 2026. The specification, documentation, and reference implementations are available through the TRACE website and GitHub.