CAVA: A Canonical Action Layer for Governing Agentic AI

Introduction

Agentic AI systems are increasingly moving beyond text generation into operational environments. They can invoke SDK tools, run through local coding hooks, drive browsers, call API gateways, trigger workflow engines, and leave traces inside managed-agent platforms. This creates a practical governance problem: the same act, such as publishing code, changing identity state, moving money, or exporting data, may appear as many incompatible runtime records.

The arXiv paper “CAVA: Canonical Action Verification and Attestation for Runtime Governance of Agentic AI Systems” focuses on this gap. Its central question is simple but consequential: what action was actually approved, what evidence binds that approval to the later execution, and can an independent verifier reproduce the same action identity afterward?

Key ideas

• Canonicalizing runtime activity: CAVA, short for Canonical Action Verification and Attestation, is proposed as a runtime-semantics layer. It converts heterogeneous agent activity into canonical runtime action objects so that different traces can be compared through a stable semantic representation.
• A layer below PCAA: The paper positions CAVA underneath Proof-Carrying Agent Actions. PCAA describes a deployer-owned route-review-prove governance process; CAVA defines the durable action object that this process governs.
• Binding approval to execution: A governance workflow is weak if an approval is attached only to a fragile log field, a wrapper name, or a natural-language description. CAVA formalizes action identity, approval binding, receipt integrity, and reproducibility so the approved action and the executed action can be checked against the same canonical object.
• Semantic pattern detection: The paper also discusses policy-addressable semantic patterns. This matters because equivalent risky behavior may be expressed through different calls, while superficially similar calls may not mean the same thing.
• Reference benchmark: The author studies a reference implementation with a 96-seed, 384-variant benchmark. The evaluation covers semantic equivalence, semantic separation, wrapper bypass, false-positive control, approval binding, receipt reproducibility, attestation tamper detection, runtime portability, semantic pattern detection, policy degradation, and Azure deployment drills.

Why it matters

CAVA reframes agent governance from “collecting logs” to “verifying action identity.” In enterprise environments, agents may cross several systems before completing a sensitive operation. If each system only exposes its own local trace, auditors may struggle to determine whether the reviewed action is truly the one that ran.

The paper’s broader implication is that permissions, human approvals, and policy engines are not enough unless the governed object is stable. A deployer may approve a code-publishing action, but if that action is transformed through wrappers or represented differently across runtimes, the approval chain can become ambiguous. CAVA aims to provide the missing semantic substrate: a portable, reproducible, and attestable action object.

This is not presented as a consumer-facing agent product. It is better understood as infrastructure for deployers, agent platforms, and audit systems that need runtime governance over high-impact actions. As agents begin to handle code release, identity changes, financial operations, and data export, action-level canonicalization may become a necessary foundation for trustworthy deployment.

Source: arXiv