A cloud reference framework of controls for enterprise-grade trustworthy AI agents. When an AI system can take real-world actions, the primary production constraint becomes trust - not model capability.
GATE specifies 20 controls across four layers that wrap probabilistic agents in a deterministic shell of governance. The model proposes; the control plane decides. Built on the architectural argument set out in the Trustworthy Agentic AI Blueprint.
Download the Frameworkv1.4 adds one control and tightens three, completing the boundary model: identity at instantiation, policy at execution, observation throughout, classification at delivery. The four-layer architecture is unchanged; all v1.3 implementations remain compatible.
Observability & Forensics layer. Every final agent response is classified immediately before delivery: sensitivity tier, regulated categories, confidence score, and obligations (redact, hold, human review) from a signed action matrix. Fail-closed by default at high_privilege tier. An agent can pass every existing check and still deliver regulated content to a user with no record; C20 closes the output boundary.
The C09 emergency override is now a signed break_glass_record with schema-enforced dual approval, scope binding, and expiry. Every invariant-halt override is programmatically tied to the authorisation that permitted it; an unauthorised override surfaces as a conformance failure, not an audit-time surprise.
Machine-validated mappings pinned to upstream snapshots: every referenced requirement and technique ID resolves against the pinned standard with a matching title. The honest gaps are documented - training data, model lifecycle, and supply chain sit outside GATE's runtime scope by design.
gate-rust ships the high-throughput companion crate, hash-compatible with gate-python by contract and enforced by shared test vectors in CI. gate-fuzz proves the byte-equivalence with Hypothesis-driven differential properties. gate-knowledge publishes the conceptual layer as an Open Knowledge Format bundle for agent consumption. Check20 joins the runner; Check17 and Check18 upgrade to AUTOMATED when bundle stores are configured.
Prompts are configuration, not governance. Enterprises cannot safely rely on prompt-only safety for systems that plan and execute actions across enterprise tools.
LLMs are non-deterministic and can be influenced by adversarial inputs. Trust must be engineered into the surrounding platform with controls that are deterministic, enforceable, and auditable outside the model.
When an agent can write to a database, call a payments API, or rotate a credential, the cost of an unbounded action is no longer reversible. The control plane authenticates, authorizes, and records every action before it takes effect.
Audit, incident response, and regulatory inquiry all require the same primitive: a tamper-evident record of who did what, on what authority, with what consequences. GATE makes that record a first-class output of every run - an architectural property the executive operating model increasingly depends on.
GATE uses “deterministic” to describe the control plane boundaries that surround the agent - not the model itself. LLMs remain probabilistic. What GATE enforces is operational determinism at the tool and memory boundary.
GATE defines a trustworthy agent as one whose failures are contained (limited blast radius), attributable (who did what), reproducible (deterministic replay), governable (policy, budgets, approvals), and auditable (tamper-evident evidence). Each control in the framework targets one or more of these properties directly.
A cross-cutting pattern that turns the 20 controls into a closed-loop autonomy dial: measure → score risk → constrain execution → audit. Higher autonomy tiers require more controls, stronger evidence, and tighter human-in-the-loop gates. The dial is calibrated against actual telemetry, not declared in policy.
20 controls across four layers. Each control specifies Why (the risk), What (the mechanism), How (implementation patterns), Evidence (what to log), and Failure Modes (common foot-guns). Built to be read like a platform spec, not a conceptual paper. v1.3 added C17, C18, and C19; v1.4 adds C20.
| ID | Control | Layer |
|---|---|---|
| C01 | Workload Identity and Attestation | Layer 1 - Identity & Integrity Prove who/what is acting and that execution is untampered. |
| C02 | Confidential Execution and Secret Boundary Control | Layer 1 - Identity & Integrity |
| C03 | Artifact Integrity and Supply Chain Controls | Layer 1 - Identity & Integrity |
| C04 | Agent Lifecycle Governance | Layer 1 - Identity & Integrity |
| C17 | Agent Discovery and Shadow AI Detectionv1.3 | Layer 1 - Identity & Integrity |
| C05 | Tool Gateway with Policy-as-Code Enforcement | Layer 2 - Runtime & Constraints Enforce deterministic policy, budgets, and execution boundaries. |
| C06 | Circuit Breakers and Emergency Stop | Layer 2 - Runtime & Constraints |
| C07 | Resource Governance and Economic Safety | Layer 2 - Runtime & Constraints |
| C08 | Prompt and Content Injection Defense | Layer 2 - Runtime & Constraints |
| C09 | Execution Constraints and Invariant Enforcement | Layer 2 - Runtime & Constraints |
| C18 | Data Quality Gatesv1.3 | Layer 2 - Runtime & Constraints |
| C10 | Deterministic Replay | Layer 3 - Observability & Forensics Produce evidence, replayability, and non-repudiation. |
| C11 | Verifiable Audit Ledger | Layer 3 - Observability & Forensics |
| C12 | Signed Actions and Non-Repudiation | Layer 3 - Observability & Forensics |
| C13 | Agent-Native Observability and Semantic Tracing | Layer 3 - Observability & Forensics |
| C19 | Model Behaviour Monitoringv1.3 | Layer 3 - Observability & Forensics |
| C20 | Agent-to-Human Output Validationv1.4 | Layer 3 - Observability & Forensics |
| C14 | Secure Multi-Agent Protocols | Layer 4 - Orchestration & Ecosystem Safely scale to distributed and multi-agent autonomy. |
| C15 | Distributed Orchestration Control Plane | Layer 4 - Orchestration & Ecosystem |
| C16 | Continuous Adversarial Validation and High-Assurance Verification | Layer 4 - Orchestration & Ecosystem |
GATE is open and vendor-neutral. The control catalog and v1.3.0 conformance runner output map to recognised governance standards and regulatory regimes so enterprise teams can use them alongside existing programs.
Each GATE control maps to GOVERN, MAP, MEASURE, and MANAGE functions, with explicit traceability tables in the appendix.
High-level theme alignment table covers the management-system clauses an ISO 42001 implementation needs to evidence.
Per-requirement mapping pinned to AISVS v1.0, machine-validated against the upstream snapshot. Strongest coverage in agentic security, monitoring, output control, access control, and memory; out-of-scope chapters named honestly.
28 techniques mapped with verified IDs and titles, pinned to ATLAS content 2026.05. Out-of-scope model-interior techniques listed explicitly; the C16 harness coverage list is part of the mapping.
Conformance-runner evidence maps to Articles 12 (record-keeping), 14 (human oversight), 15 (accuracy, robustness, cybersecurity), and 72 (post-market monitoring). Runtime layer for providers and deployers of high-risk AI systems.
Evidence supports Annex I Part I (essential cybersecurity requirements) and Part II (vulnerability handling). Substantive obligations apply from 11 December 2027.
Regulatory mappings are general engineering guidance, not legal advice. Specific obligations depend on your role under each regulation, the system you operate, your jurisdiction, and your supervisory authority. The runner produces the runtime layer of evidence these regimes assume exists; it does not replace the broader compliance programme that wraps it. Built for Cloud Architects, AI Architects, Platform Engineering, Security Engineering, GRC, and SRE/Operations teams.
GATE ships with open-source companion artifacts. All MIT-licensed and ready to fork. v1.4 bumps gate-contracts, gate-policies, and gate-python to v1.2.0 and gate-conformance to v1.3.0, and adds three new repositories: gate-rust, gate-fuzz, and gate-knowledge. The paper source itself is now public.
Framework release home: artifacts bundle, PDF, and single-file markdown edition. Now v1.4.
JSON Schema contracts for all control plane events. v1.2.0 adds the C20 output classification event, the break-glass record with schema-enforced dual approval, the auto-enrolment policy, and the approved feed registry.
Python reference library. v1.2.0 adds the C20 output module, break-glass verification, strict canonical-JSON hashing, and the cross-language test vectors that gate-rust builds against.
OPA/Rego policy and invariant bundles. v1.2.0 adds C20 output classification with a fail-closed guardrail, C09 break-glass verification, and the C17 auto-enrolment fast-path, plus an explicit bundle manifest.
Twenty conformance checks with a CLI runner: 9 AUTOMATED out of the box, 11 when bundle stores are configured. v1.3.0 adds Check20 and machine-validated mappings for OWASP AISVS, MITRE ATLAS, and NIST SSDF.
Rust companion crate for high-throughput Tool Gateways: canonical JSON, envelopes, hash-chained ledger, ES256 signing. Hash-compatible with gate-python by contract, enforced by shared test vectors in CI.
Hypothesis-based differential property suite proving byte equivalence between gate-python and gate-rust at the canonical-JSON, signing, and schema-validation layers.
The GATE conceptual layer as an Open Knowledge Format bundle: one document per control, threat model component, and adoption phase, with typed relationship links and a validator.
Canonical project home: deterministicagents.ai
What the framework argues, in short form.
Agentic AI is crossing from “assistive” software into systems that plan and execute actions across enterprise tools. When an AI system can take real-world actions, the primary production constraint becomes trust, not model capability. The core challenge is architectural: models are probabilistic and influenceable; trust must be engineered into the surrounding platform.
gate-conformance v1.3.0 runner automates 9 of the 20 checks out of the box and 11 when bundle stores are configured; the rest return PARTIAL with explicit manual_steps payloads. No false guarantees. Wire it into CI for a gate, not just a report.Trust must be engineered into the surrounding platform with controls that are deterministic, enforceable, and auditable outside the model.
GATE is intended for adoption. The companion repositories provide schemas, policy templates, matrices, and runbooks that architects can use to model and map implementations in real cloud environments. This page reflects v1.4 (August 2026).
The architectural argument GATE implements, and the executive operating model it supports.
A 141-page open framework for engineering teams productionizing agentic AI. CC BY 4.0 documentation; MIT-licensed reference contracts and code. Available as a direct PDF download.