View Markdown

Platform Conformance Profile

Version: 0.1.0-draft.6 — Working Draft
Status: Working Draft (# syntax=agentrc.agentfile/v0.1)
Date: 2026-06-30
Audience: platform / runner authors

The normative keywords MUST, MUST NOT, SHOULD, and MAY follow RFC 2119. This profile defines what a platform (the runtime / operator / organization authority that runs an agentrc agent) must do to claim conformance. It is the operational companion to the Specification and the Enforcement profile.

This profile (agentrc/platform/v0.1) defines platform-conformance — reading labels and granting / projecting / enforcing them — which is distinct from build-conformance, a compiler emitting correct ai.agentrc.* labels from an Agentfile, which lives in the Core profile.

Secrets are deferred in this draft; credential resolution is platform-defined and out of scope.

Purpose

agentrc itself is not a runner. An Agentfile compiles to an ordinary OCI artifact carrying ai.agentrc.* labels and layers; something must read those labels and run the agent. This profile exists so independent platforms — clouds, CLIs, sandboxes, Kubernetes operators, framework-native adapters — can state exactly what level of agentrc support they provide, and so that two conformant platforms decide and enforce grants identically.

The central contract is simple and absolute: a conformant platform reads labels, not the Agentfile. The Agentfile is the human-authored recipe; the labels are the machine-readable manifest. The platform never parses Agentfile source at deploy / run time.

The labels-only contract

A POLICY line in an Agentfile is a request, not enforcement. The author expresses intent; the platform holds authority. For every request — including the auto-derived egress the compiler emits from hook / interrupt URLs — the platform is free to grant, narrow, or reject.

author writes          compiler emits              platform decides + enforces
─────────────          ──────────────              ───────────────────────────
POLICY request   ──►   ai.agentrc.* labels   ──►  grant / narrow / reject,
(in the Agentfile)     (in the OCI image config)   then enforce with Cedar

Everything below is keyed off the labels, never off the source recipe.

Core requirements

A platform claiming agentrc Platform Conformance MUST, at deploy / run time:

Pull the OCI artifact from any OCI-compatible registry.
Read all ai.agentrc.* labels from the image config without parsing the Agentfile. Source is unavailable and unnecessary; the labels are the manifest.
Evaluate each request — every POLICY-derived label, including auto-derived ai.agentrc.network.dns.* egress — against organization / platform policy and available resources, and grant, narrow, or reject it. Narrowing and rejection SHOULD be auditable (this auditability requirement is open decision #4).
Fetch --runtime resources now. For each ai.agentrc.<kind>.<name>=runtime:<url> label, fetch the resource at bootstrap and apply its failure mode: --fail-if-unavailable (default — refuse to boot) or --warn-if-unavailable (log and continue).
Honour *.origin overrides. The platform MAY substitute an embedded (--cached) resource by reading an overridden ai.agentrc.<kind>.<name>.origin label — e.g. re-point a public MCP server to an internal mirror — without rebuilding the artifact.
Enforce via Cedar (see Enforcement): deny-by-default, forbid over permit order-independently, and monotonic intersection across FROM.
Project the filesystem and boot CMD. Load the SOP from /mnt/SOP, select / validate the model from model.*, project /mnt/tools, /mnt/skills, and /mnt/mcp, populate /mnt/proc with the live grant / identity / budget / audit state, then run CMD on the chosen substrate with the granted constraints.
Fail closed. If any required constraint cannot be enforced — a network grant the platform cannot confine, a device it cannot isolate — the platform MUST refuse to boot rather than run the agent with weaker guarantees than were requested.

Resolving labels

The label namespaces a conformant platform consumes:

Label namespace	Source keyword	What the platform does
`ai.agentrc.identity.*`	`IDENTITY`	Establishes the Cedar principal (`ai.agentrc.identity.name`).
`ai.agentrc.capability.*`	`CAPABILITY`	Advertised modalities; informational + match against substrate.
`ai.agentrc.sop`, `ai.agentrc.sop.sha256`	`SOP`	Locates and verifies the prompt file at `/mnt/SOP` (pointer + digest, never full text).
`ai.agentrc.agent.*`	`POLICY agent.*`	Agent-side operational constraints / lifecycle / hooks.
`ai.agentrc.substrate.*`	`POLICY substrate.*`	Resource requests (memory, cpu, device, ptty…).
`ai.agentrc.model.*`	`POLICY model.*`	Model selection / fallback / required capabilities.
`ai.agentrc.network.dns.*`	`POLICY network` + auto-derived	Egress grants; auto-derived entries carry a `.source` attribution.
`ai.agentrc.tool.` / `.skill.` / `.mcp.*`	`COPY` / `ADD --remote`	Resource delivery: `local`, `<digest>` (+ `.origin`), or `runtime:<url>`.

The platform MUST support both policy encodings: inline values in labels, and digest form where a label carries the digest of a structured manifest embedded as a layer. The build seam is --policy-mode inline|digest; which is the default is open decision #1.

Enforcement

Enforcement is Cedar, platform-side. Cedar MUST NOT appear in the Agentfile; authors speak only typed POLICY requests. The platform compiles each granted request plus its own organization Cedar policies into one Cedar PolicySet and evaluates the grant. A conformant platform MUST derive Cedar entities / actions from the request labels (principal = ai.agentrc.identity.name):

Request label	Cedar action	Cedar resource
`ai.agentrc.network.dns.<host>=<port>`	`Action::"NetworkEgress"`	`Host::"<host>:<port>"`
`ai.agentrc.tool.<name>`	`Action::"tool.invoke"`	`Tool::"<name>"`
`ai.agentrc.mcp.<name>`	`Action::"mcp.request"`	`MCPServer::"<name>"`
`ai.agentrc.agent.sub_agents=true`	`Action::"agent.delegate"`	`Agent::*` (capped by `sub_agents.max`)
`ai.agentrc.substrate.device=<dev>`	`Action::"device.access"`	`Device::"<dev>"`

The enforcement properties a conformant platform MUST preserve (these are Cedar’s):

Deny-by-default. Absence of a grant is a denial. An unrecognised request, an un-granted auto-derived egress, or an action with no matching permit is denied.
forbid overrides permit, order-independently. An organization forbid (e.g. “no agent may reach the public internet”) defeats any agent request, regardless of evaluation order.
Monotonic composition across FROM. When an agent inherits (FROM another-agent), the effective authorization is the intersection of ceilings: a child’s granted set MUST NOT exceed its parent’s, and a parent forbid is un-loosenable by the child.

The agent’s POLICY requests are the floor of intent; the organization’s Cedar policies are the ceiling of authority. One author surface (typed requests), one engine (Cedar). The full mapping is normative in the Specification and the Enforcement profile.

Substrate-neutral

A conformant platform MAY run the agent on any substrate. The substrate is a run-time choice (agentrc run --isolation local|container|microvm --substrate <driver>), never an Agentfile directive, and it does not change Agentfile semantics:

local process
container (Docker / containerd)
gVisor-style sandbox
microVM
Kubernetes job
serverless worker
managed cloud agent runtime
SSH remote runner
framework-native adapter

Whatever the substrate, the /mnt projection (/mnt/tools, /mnt/skills, /mnt/mcp, /mnt/proc, /mnt/SOP) and the label-derived grants are identical. Placement is a platform concern expressed at run time; a portable artifact does not hard-code it. A future companion document MAY define a separate run manifest for placement.

Required disclosure

A conformant platform SHOULD publish a support statement so authors and security reviewers know what to expect. It SHOULD declare:

supported Agentfile syntax version (e.g. agentrc.agentfile/v0.1);
which ai.agentrc.* label namespaces it reads and honours;
supported policy encoding(s) — inline, digest, or both;
supported substrates / isolation modes, if any;
resource delivery support — --cached, --runtime, and *.origin override;
audit / export formats for grant / narrow / reject decisions;
unsupported labels or constraints, and the failure behaviour for each;
known security limitations.

Verifying conformance

This profile is verified against the adversarial conformance suite, which probes the fail-closed and deny-by-default guarantees above — for example, that an un-granted auto-derived egress is denied, that a forbid defeats a conflicting request, and that a child agent cannot widen a parent’s locked constraint across FROM. The packaging side of the contract is the OCI labels & package profile, and the /mnt layout the platform projects is the projection profile.