Search papers, labs, and topics across Lattice.
This paper introduces Canonical Action Verification and Attestation (CAVA), a framework designed to standardize the representation of actions taken by agentic AI systems across diverse runtime environments. By establishing a canonical action identity and formalizing key concepts such as approval binding and receipt integrity, CAVA enables independent verification of actions, addressing critical governance challenges in AI deployment. The authors validate their approach through extensive benchmarking, demonstrating its effectiveness in ensuring semantic equivalence and integrity across various operational scenarios.
CAVA transforms the chaotic landscape of agentic AI actions into a standardized framework, enabling reliable governance and verification of AI behavior across heterogeneous environments.
Agentic AI systems increasingly act through heterogeneous runtimes: local coding hooks, SDK tools, browser automation, managed-agent traces, API gateways, and workflow engines. A single operational act such as publishing code, changing identity state, moving money, or exporting data may therefore be represented by many incompatible runtime records. This makes a basic governance question difficult to answer: what action was actually approved, what evidence binds the approval to execution, and can an independent verifier reproduce the same action identity later? This paper presents Canonical Action Verification and Attestation (CAVA), a runtime-semantics layer for converting heterogeneous agent activity into canonical runtime action objects. CAVA is positioned below Proof-Carrying Agent Actions (PCAA): PCAA defines the deployer-owned route-review-prove governance process, while CAVA defines the stable action object that process governs. The paper formalizes canonical action identity, semantic pattern detection, approval binding, receipt integrity, runtime-portable projection, and optional attestation substrates. We study a reference implementation through a 96-seed, 384-variant benchmark covering semantic equivalence, semantic separation, wrapper bypass, false-positive control, approval binding, receipt reproducibility, attestation tamper detection, runtime portability, semantic pattern detection, policy degradation, and Azure deployment drills. The contribution is a systems formulation of action-level canonicalization and policy-addressable semantic patterns as a necessary substrate for deployer-side AI governance.
