Linux Foundation to Govern TRACE, an Open Standard for AI Runtime Attestation

TRACE (Trust, Runtime Attestation and Compliance Evidence) is an open specification contributed to the Linux Foundation by OPAQUE, AMD, Intel, Microsoft, and the Technology Innovation Institute. It creates a hardware-backed, cryptographically verifiable record that ties together the runtime environment, software executed, applied policies, data classification, and AI tools invoked. TRACE is designed to be portable across different cloud providers, confidential computing platforms, and sovereign infrastructure. It integrates existing standards such as RATS, EAT, SLSA, SCITT, SPIFFE, and EAR into a single evidence layer to provide unified compliance and security evidence for AI workloads. This standard supports organizations moving AI agents beyond isolated experiments into production environments that handle sensitive data and span multiple systems, addressing the need for independently verifiable evidence of AI agent behavior and governance enforcement.

TRACE enhances security and compliance for AI workloads by providing cryptographic evidence of runtime environments and governance enforcement. It supports hardware-based attestation and confidential computing, enabling organizations to verify AI agent identity, authorized actions, and policy enforcement. This reduces risks associated with AI agents operating in production environments with sensitive data. TRACE's portability across cloud and sovereign infrastructures facilitates trust in AI deployments. However, TRACE itself is a standard and framework rather than a vulnerability or exploit, so it does not represent a direct security threat but rather a security enhancement.

This is not a vulnerability but an open standard designed to improve security and compliance for AI workloads. No remediation or patching is required. Organizations adopting TRACE can leverage it to gain verifiable evidence of AI runtime behavior and governance enforcement, thereby strengthening their security posture for AI deployments.