RFC 0013: Governance Declarations — feedback

[chaholl]

RFC 0013: Governance Declarations is Draft and open for comment. This thread is the place for it.

What it proposes

Two additive declaration surfaces, so a pack records the governance facts about an agent alongside the behaviour it already describes:

• metadata.governance — intended purpose, foreseeable misuse, autonomy level, accountable owner, operator role, risk classification, capabilities, intended deployment contexts, approved environments, and whether AI disclosure is required.
• Tool.action_scope — what a tool can affect: effect, reversibility, data_classes.

Plus a governance override on AgentDef, and extensions bags throughout for annotations the specification does not interpret.

The thesis: the pack becomes the authoritative, versioned record of everything constituting an agent, so logs, telemetry and audit key back to one artifact by version and content digest. Two concrete payoffs — policy stops enumerating tool names, and a runtime can refuse a pack whose approved_environments excludes the environment it is being deployed into.

Open questions where feedback would change the design

1. Is approved_environments enough on its own? It answers "may this pack run here", not "is this a candidate for promotion to production", which is how most pipelines work.
2. What does a runtime do with risk_classification? Refusing a pack whose classification "exceeds what the deployment permits" assumes classifications are ordered. A namespaced term from an arbitrary framework is not.
3. Should the Article 14(4) oversight affordances be declarable? A pack states an autonomy level but not whether a stop button exists or output can be reversed. Those are runtime properties — a pack claiming them would claim what it cannot honour — yet their absence leaves the record incomplete on the point Article 14 cares most about.

Decisions already taken, and the reasoning

Recorded so they can be challenged rather than rediscovered:

• requires_approval_for was removed. A pack-level rule matching each tool's action_scope resolves statically — always true or always false per tool — so it was indirection, not information. autonomy_level states the requirement, action_scope states the facts, the runtime composes them.
• Four autonomy levels, not three. The EU AI Act defines no autonomy taxonomy, but Article 14 draws the line the enum splits on: 14(4) requires the capability to monitor, override and reverse with no mandatory gate; 14(5) requires prior verification by two natural persons for remote biometric identification. So acts_with_oversight is optional approval and acts_with_approval is mandatory.
• Provenance and attestation are deferred to a separate RFC. Every field here is an assertion, and the pack does not record who declared it, when, or under what review. The Drawbacks section states the cost: without it, a governance block is weaker evidence than it looks.
• Level 2 runtimes must honour what they claim. A runtime declares which constraints it enforces and must not contradict one it has declared. The mechanism is deliberately unspecified.

Anything else

Disagreement with the framing is as welcome as detail on the fields. The RFC reversed its own thesis once already during review — an earlier draft organised around pack portability and excluded owner, risk and role as deployment facts. That version survives as Alternative 2, with why it was rejected.