A requirement-by-requirement map of the framework to Smartflow's enforcement plane, with conservative verdicts and the gap to close. Companion to the engineering roadmap.
Roadmap Phases 0–5 are live: action-risk tiering (P0), blocked-action audit sealing (P1), the MCP trust deny gate (P2), the gateway emergency stop + tier-aware fail-closed (P3), human-oversight effectiveness analytics (P4), and AIDA on the hot path + Ed25519 verifiable identity (P5). This brings 7 of 8 capability rows to EXISTS — #1 agent identity, #3 deterministic enforcement, #4 MCP governance, #5 tamper-evident audit, #6 fail-closed / kill switch, and #7 human-oversight analytics (#2 authorization-scoping upgraded, non-transferable binding remains Phase 6). Enforcement defaults ship opt-in (MCP_TRUST_ENFORCE, SHIELD_SHADOW_ENFORCE_CRITICAL, APPROVAL_QUEUE_FAIL_CLOSED, and now AIDA_ENFORCE / AIDA_REQUIRE — all default off) so enabling them never silently regresses live traffic. Remaining: Phase 6 (agent ⊂ human binding + recursive delegation chains).
The framework's central claim is identical to Smartflow's thesis: governance belongs in a deterministic enforcement plane between the agent and the systems it touches — not in prompts.
"A programmatic runtime policy enforcement layer is being implemented at the AI gateway before higher levels of autonomy are enabled." — MSD case study, p.21
"While usually considered a connectivity protocol, MCP can potentially act as a governance layer … filtering sensitive data, logging all agent-to-system interactions, or whitelisting only trusted servers." — p.34
Our job is to finish the enforcement story: move identity, trust-registry blocking, and fail-closed behavior off the admin/shadow paths and onto the default hot path, and add the human-oversight analytics the framework now expects.
| Framework requirement (page) | Smartflow capability / evidence | Verdict |
|---|---|---|
| Agent identity is unique & cryptographically verifiable (p.23) | Phase 5: AIDA adds an Ed25519 asymmetric credential mode + public verification path (/api/aida/pubkey, RFC 8037 OKP JWKS) so third parties verify offline with only the public key — src/aida/crypto.rs (HMAC fingerprint retained for back-compat; Ed25519 issuance gated by AIDA_ED25519) | EXISTS |
| Identity accounted for — tied to human/dept/supervisor (p.23) | AIDA stores principal_id, name/email, dept metadata | EXISTS |
| Identity differentiated by capacity / on-behalf-of (p.23) | Phase 5: AIDA principal model now enforced inline — credential validated (revocation → expiry → signature → validity) before egress, identity stamped on the VAS log — gate_request in src/proxy_handler.rs, gated by AIDA_ENFORCE / AIDA_REQUIRE | EXISTS |
| Recursive sub-agent delegation chains (p.23) | No parent-agent / delegation fields in aida/mod.rs or a2a/types.rs | ABSENT |
| Identities catalogued & centrally managed (p.23) | AIDA Redis registry + revoke; Phase 5 adds a first-class agent_identity kind to the signed AI-BOM (live credentials with principal, scopes, alg, expiry) — src/aibom/ | EXISTS |
| Authorization scoped, least-privilege, time-bound, non-transferable (p.24) | Virtual keys (sk-sf-*) allowlists/budgets/TTL; AIDA scope/TTL/revocation now checked inline (Phase 5); non-transferable bearer binding still Phase 6 | PARTIAL |
| Authorization bounded by authorizing human's permissions (p.24) | Maestro AD-group policies; no runtime agent⊂human intersection | PARTIAL |
| Prefer deterministic limits, bound by design (p.19) | System-level blocks (compliance, Maestro, Shield) on request path | EXISTS |
| Take agents offline / limit blast radius (p.19) | Phase 3 gateway-wide emergency stop (off / read_only / halt) on proxy + MCP + A2A, audit-chained — src/emergency_stop.rs, POST /api/admin/emergency-stop; plus circuit breaker | EXISTS |
| Framework requirement (page) | Smartflow capability / evidence | Verdict |
|---|---|---|
| Human approval at significant checkpoints (p.29) | Shield approval ticket queue; IDE retry via shield_ticket_id; MCP catalog approval | EXISTS |
| Approval requests contextual, with risk/confidence (p.29) | Shield decision payloads carry rule/severity context | PARTIAL |
| Deny-by-default when approval infra fails (p.30) | Maestro/compliance fail closed; Phase 3 tier-aware fail-closed — APPROVAL_QUEUE_FAIL_CLOSED (T2+ Approval → Block when ticket store down) + SHIELD_SHADOW_ENFORCE_CRITICAL (opt-in, default off) | EXISTS |
| Track human override rate (p.30) | Phase 4 — global + per-reviewer override rate over a selectable window; rubber-stamping alert below OVERSIGHT_RUBBER_STAMP_FLOOR (src/oversight_analytics.rs, /api/oversight/summary) | EXISTS |
| Track approval response time (p.30) | Phase 4 — median approval latency from ticket created_at→decided_at; automation-bias alert below OVERSIGHT_AUTOMATION_BIAS_SECS | EXISTS |
| Detect outlier reviewers (p.30) | Phase 4 — flags reviewers deviating >OVERSIGHT_OUTLIER_SIGMA from cohort override-rate/latency, guarded by OVERSIGHT_MIN_SAMPLE | EXISTS |
| Alerts on unauthorised access / repeated failed tool calls (p.30) | Denials log info/warn; no alerting pipeline | PARTIAL |
| Framework requirement (page) | Smartflow capability / evidence | Verdict |
|---|---|---|
| Structural/rule-based controls over prompt-layer (p.33) | Compliance block, Maestro X-Maestro-Blocked, Shield decisions; Maestro also prompt-enhances; Shield default shadow | PARTIAL |
| Tool least-privilege via authN/authZ (p.34) | src/mcp/access_control.rs allow/deny groups, per-tool rules | EXISTS |
| MCP server whitelisting — only trusted servers (p.34) | Phase 2: evaluate_call wired to deny untrusted servers before dispatch (src/mcp/proxy_handler.rs); gated by MCP_TRUST_ENFORCE (default off); denials hash-chained | EXISTS |
| Log all agent-to-system interactions (p.34) | Phase 1: blocked MCP actions now sealed into the VAS hash chain (handle_request wrapper → seal_blocked_action), not dropped | EXISTS |
| Filter sensitive data through MCP (p.34) | Compliance scan (MCP_COMPLIANCE_SCAN_ENABLED); no dedicated MCP PII redaction | PARTIAL |
| Sandbox code execution via tools (p.34) | Delegated to downstream MCP servers; not gateway-enforced | ABSENT |
| Tamper-proof audit incl. blocked actions (p.35) | src/audit_chain.rs hash chain; Phase 1 seals blocked MCP actions, Phase 0 stamps an action_risk_tier on every entry, Phase 3 chains emergency-stop activations as T3 events (WORM/TSA hardening tracked separately) | EXISTS |
| Runtime controls — rate limits, validation (p.33) | Rate limiter, adaptive rate limiter, circuit breaker | EXISTS |
| Structured A2A schemas / limit shared memory (p.34) | A2A gateway typed messages; no multi-hop taint labels | PARTIAL |
| Continuous monitoring & anomaly detection (p.42) | VAS analytics, perimeter egress; no agent-trajectory anomaly detection | PARTIAL |
| Change management / version control for agents (p.33) | AIBOM signed BOM; no drift re-certification trigger | PARTIAL |
| Framework requirement (page) | Smartflow capability / evidence | Verdict |
|---|---|---|
| Track data crossing trust/org boundaries; taint tracing (p.12, p.17) | src/perimeter.rs classification + VAS left_perimeter/perimeter_classification | EXISTS |
| Multi-hop taint propagation across agent chains (p.12) | Per-egress event only; no propagated taint labels | ABSENT |
| # | Capability | Verdict | One-line gap |
|---|---|---|---|
| 1 | Agent identity (AIDA) | EXISTS | Phase 5: AIDA validated inline on the hot path (AIDA_ENFORCE / AIDA_REQUIRE, default off) + Ed25519 verifiable identity with public JWKS; issuance/revocation hash-chained; recursive delegation (Phase 6) |
| 2 | Authorization scoping | PARTIAL | Strong vkey/Maestro/AD + Phase-5 inline scope/TTL/revocation; non-transferable + runtime agent⊂human binding (Phase 6) |
| 3 | Deterministic enforcement | EXISTS | Real blocks + Phase-3 tier-aware fail-closed; shadow-enforce-critical opt-in (default off) |
| 4 | MCP governance | EXISTS | Denied calls hash-chained (P1); trust deny gate shipped, gated by MCP_TRUST_ENFORCE |
| 5 | Tamper-evident audit | EXISTS | P1: blocked actions sealed by default; WORM/TSA hardening tracked separately |
| 6 | Runtime / fail-closed / kill switch | EXISTS | P3: gateway-wide emergency stop (proxy + MCP + A2A), audit-chained; ships inert |
| 7 | Human-oversight analytics | EXISTS | Phase 4: override rate, median approval latency, outlier-reviewer detection over a selectable window (/api/oversight/summary + dashboard); thresholds raise rubber-stamping / automation-bias / outlier alerts |
| 8 | Perimeter / A2A egress | PARTIAL | Egress marking yes; no multi-hop taint (Phase 6) |
Smartflow already had the right shape — a deterministic gateway with identity, policy, audit, and perimeter primitives. As of v1.7.55, the framework's "defaults and completeness" bar is met for 7 of 8 dimensions: agent identity is validated on the hot path and cryptographically verifiable by third parties (Ed25519 + JWKS) with issuance/revocation hash-chained, denials are hash-chained, the gateway has a real red button, tier-aware fail-closed is one flag away, and we measure whether human approval is meaningful (override rate / latency / outlier reviewers) rather than ceremonial. The single remaining track is Phase 6 — agent ⊂ human binding + recursive delegation chains (non-transferable, effective-scope = agent ∩ human, multi-hop taint). This yields direct, evidence-backed conformance to Dimensions 1–3 of an IMDA-published framework — a strong differentiator for regulated buyers.