What question did this study set out to answer?

This work defines a governance framework for managing configurations within agent systems to prevent emergent harm.

June 11, 2026Open Access

RFC-ATF-7: Agent Trust Fabric — System Configuration Governance Contract. Closing the Emergent Harm Gap: Configuration-Level Governance, Emergent Harm Boundaries, and System Convergence Receipts

Key Points

This work defines a governance framework for managing configurations within agent systems to prevent emergent harm.
Introduced three key protocol artifacts: System Configuration Governance Contract (SCGC), Session Configuration Binding (SCB), and System Convergence Receipt (SCR).
Utilized cryptographic methods to ensure data integrity and session binding.
Tested compliance against existing AI governance standards, with detailed audit results.
Achieved a PASS rating on 15 attack vectors with 53/53 success, indicating robust security.
Specified 13 new invariants, totaling 119 across 21 protocol families.
Demonstrated compliance alignment with multiple regulatory frameworks, including the EU AI Act.

Abstract

RFC-ATF-7 specifies the System Configuration Governance Contract (SCGC) layer of the Agent Trust Fabric — the seventh RFC in the ATF Open Standard series published by OMNIX QUANTUM LTD. RFC-ATF-7 answers the structural question that no prior RFC in the series addresses: who governs the configuration that produces the sessions? Session-level governance proves that each session was governed — it cannot prove that the system of sessions was governed. When harm emerges from configuration-level interaction — feedback loops, dependency propagation, cross-agent effects — session-level receipts are necessary but not sufficient. This is the Emergent Harm Gap, formally articulated by Greggory Don Butler (TA-14). Three protocol artifacts are introduced: System Configuration Governance Contract (SCGC): A PQC-sealed (ML-DSA-65) artifact issued before any session begins, declaring the complete governance posture of the configuration in six canonical blocks: STD (topology), DPM (dependencies), IFL (interaction logic), CEP (escalation policies), EHB (emergent harm boundaries), TCW (temporal/version window). A single configfingerprint = SHA3-256 (sorted block hashes) provides tamper-evident identity of the entire configuration's governance posture. Invariants SCGC-INV-001, 003, 004, 005. Session Configuration Binding (SCB): An append-only cryptographic link between each OGR session and its parent SCGC, fail-closed at session start. Binding is rejected if the SCGC is not SEALED, expired, or belongs to a different organization. A bindingₕash = SHA3-256 (scgcᵢd ‖ sessionᵢd ‖ runtimeconfigₕash ‖ timestamp) prevents replay attacks. Fingerprint divergence auto-records a CRITICAL drift event. Invariants SCGC-INV-002, 005. System Convergence Receipt (SCR): The closing artifact aggregating all bound sessions, CTCHC behavioral attestations, MIVP mandate certifications, and drift events into a single PQC-signed, Merkle-rooted system-level verdict: SYSTEMCONVERGENT | SYSTEMWARNING | SYSTEMHALTED | SYSTEMINDETERMINATE. Verdict is deterministic from evidence (SCGC-INV-010). Race condition eliminated: converge () always recomputes from current evidence (R-005). Invariants SCGC-INV-008, 009, 010. The primary differentiator is the Emergent Harm Envelope (EHE): a set of predicates defined over INTERACTIONS between sessions, tools, and components — not over any individual session's behavior. Any EHB breach is cryptographically irrefutable, auto-escalates to SYSTEMHALTED permanently (SCGC-INV-007), and cannot be overridden by any operator action or API call. No equivalent artifact exists in any published AI governance standard as of June 2026. Adversarial audit: SCGC-AUDIT-V2 (2026-06-08) — 15 attack vectors (A1–A15, including 5 VC interoperability vectors from RFC-ATF-8) — 53/53 PASS, 0 FAIL. 7 findings identified and remediated in V1 (including 3 HIGH/CRITICAL): fingerprint re-verification on read (SCGC-INV-011), Merkle re-verification on read (SCGC-INV-012), PQC fail-closed enforcement (SCGC-INV-013), SCR race condition elimination. 13 new invariants are introduced (SCGC-INV-001 through SCGC-INV-013), bringing the total ATF invariant count to 119 formally specified invariants across 21 protocol families. An implementation complying with RFC-ATF-1 through RFC-ATF-7 is designated ATF-SCGC-Compliant — the seventh compliance tier in the ATF stack. Compliance hierarchy: ATF-ID-Compliant → ATF-RGC-Compliant → ATF-ELP-Compliant → ATF-AGV-Compliant → ATF-CGL-Compliant → ATF-BEV-Compliant (106 inv. ) → ATF-SCGC-Compliant (119 inv. ) Persistence schema: 5 new PostgreSQL tables — atfₛcgccontracts · atfₛcgccomponents · atfₛcgcₛessionbindings · atfₛcgcdriftₑvents · atfₛcgcconvergenceᵣeceipts (all auto-created via CREATE TABLE IF NOT EXISTS). Regulatory alignment: EU AI Act Art. 9 (risk management), Art. 12 (record-keeping), Art. 13 (transparency) · NIST AI RMF GOVERN 1. 1, GOVERN 6. 2 · ISO/IEC 42001 §6. 1, §9. 1. Related ADR: ADR-213 (System Configuration Governance Contract). Implementation: omnixcore/govern/scgcₑngine. py (1, 244 lines). Test suite: tests/testₛcgc. py (47 tests, all PASS).

Read Full Paperexternally

Mark Helpful

Bookmark

Relay

View Full Paper