CAVA Enables Governance for Agentic AI Systems.

A new framework called Canonical Action Verification and Attestation (CAVA) has been introduced to address the complex challenge of governing agentic AI systems. These systems often operate across diverse runtimes, leading to incompatible records for a single operational act, making it difficult to verify what actions were approved and executed. CAVA functions as a runtime-semantics layer, standardizing heterogeneous agent activities into canonical action objects. This standardization is crucial for establishing a clear, verifiable record of agent actions, which is essential for accountability and compliance. It complements existing governance processes like Proof-Carrying Agent Actions (PCAA) by providing the stable action object that these processes govern. The paper formalizes key aspects such as canonical action identity, semantic pattern detection, approval binding, and receipt integrity. A reference implementation was rigorously tested across numerous scenarios, demonstrating its effectiveness in ensuring semantic equivalence, controlling false positives, and detecting attestation tampering. CAVA represents a foundational step towards robust, deployer-side AI governance.