CAVA: Canonical Action Verification and Attestation for Runtime Governance of Agentic AI Systems

Source: arXiv:2607.13716 · Published 2026-07-15 · By Zexun Wang

TL;DR

This paper addresses a fundamental challenge in governance for agentic AI systems acting through diverse and heterogeneous runtimes such as shell hooks, SDK tools, browser automation, managed-agent platforms, API gateways, and workflow engines. Because a single operational action (e.g., publishing code, moving money) can be represented by many incompatible runtime events, it becomes difficult to unambiguously determine what action was approved, how approval binds to execution, and whether verification or replay is possible. To solve this, the authors propose Canonical Action Verification and Attestation (CAVA), a runtime semantics layer that transforms heterogeneous runtime events into stable, versioned, hashable canonical action objects. These canonical objects enable consistent semantic equivalence, clearly separate materially different actions, resist obfuscation through wrappers or indirection, and allow approval bindings and receipts to be attached to canonical fingerprints rather than brittle raw texts.

The paper formalizes canonical action identity, semantic pattern detection that allows reusable risk patterns beyond customer-specific rules, and a protocol for capturing, normalizing, interpreting, fingerprinting, binding approvals, closing, and optionally attesting actions. They implement a reference system and evaluate it on a comprehensive benchmark with 96 seeds and 384 runtime variants covering semantic equivalence, separation, wrapper bypass, false-positive control, approval binding, receipt reproducibility, tampering detection, runtime portability, and more. Compared to raw-text and first-token heuristics, CAVA achieves perfect scores across these key governance metrics. The work thus provides a practical and reproducible foundation for deployer-side runtime governance that can integrate with higher-level Proof-Carrying Agent Actions (PCAA) frameworks to close the deployer-owned governance loop.

Key findings

• CAVA scores 1.0 (perfect) on semantic equivalence recall across 96 seeds and 384 runtime variants vs 0.0 for raw-text and first-token baselines.
• CAVA achieves 1.0 semantic separation precision, vs 1.0 for raw-text but only 0.75 for first-token baseline.
• Wrapper bypass catch rate is 1.0 for CAVA vs 0.0 for raw-text and first-token rules.
• False-positive control rate is 1.0 for CAVA versus 0.5 for both raw-text and first-token baselines.
• Approval binding correctness and receipt reproducibility both score 1.0 for CAVA and 0.0 for baselines.
• Attestation tamper detection and runtime portability convergence are 1.0 for CAVA, 0.0 for others.
• Semantic pattern detection and policy profile routing score 1.0 for CAVA, 0.0 for raw-text, and 0.333 for first-token heuristics.
• Ablation removing canonical fingerprint or receipt verifier causes CAVA to lose key governance guarantees (retained score 0.0).

Threat model

The adversary includes malicious or accidental failures aiming to evade governance controls by rewriting actions into semantically equivalent but syntactically different forms (equivalent syntax bypass), hiding actions behind wrappers or shells (wrapper bypass), causing approval drift by disguising an action as approved but executing a different action, ambiguous traces that do not conclusively prove what was authorized, sanitizing or laundering evidence after the fact, and capturing or compromising parsers to become single points of governance failure. The model assumes runtime events can be captured and normalized but does not assume inline enforcement uniformly or complete runtime coverage.

Methodology — deep read

The authors begin with a clearly defined threat model that includes malicious or accidental governance failures: equivalent syntax bypass (rewriting actions so policies keyed on raw text miss them), wrapper bypass (hiding high-impact actions behind shells, env, sudo, SDK calls), approval drift (approving one surface representation but executing another), trace ambiguity, evidence laundering, and parser capture. The only assumption is that runtime events can be captured, normalized, scored, and attached to explicit receipts; enforcement depth varies by runtime.

Data comes from a benchmark harness designed by the authors containing 96 seed scenarios expanded into 384 runtime variants spanning shell hooks, MCP-style tool calls, browser automation, and managed-agent traces. Each variant tests specific governance challenges such as semantic equivalence, semantic separation, wrapper bypass, approval binding, receipt integrity, tamper detection, and runtime portability. Production parser packs, policy rules, and customer connectors are withheld to protect commercial-sensitive data but the public open-core code and schema are released.

CAVA's architecture defines a canonical runtime action object C(a) capturing version, runtime family, executable identity, normalized operation, risk category, touched systems, reversibility, context, and adapter metadata. A canonical fingerprint F(a) is computed by applying a collision-resistant hash to a deterministic serialization of the canonical object. Policy decisions, approvals, and audit evidence bind to the fingerprint rather than raw runtime text.

The CAVA protocol has six steps: capture raw event and context, normalize into canonical action, interpret semantic patterns from canonical action and boundary/data context, fingerprint semantics to get hash, bind approvals to fingerprint, close with outcome and receipts, and optionally attest using signatures, verifiable credentials, or ledger anchors.

For semantic pattern detection, CAVA maps canonical actions into reusable risk patterns (e.g., external sharing, public persistent egress, security control weakening, delegated authority mismatch) rather than brittle customer rules, allowing scalable enterprise policy profiles.

The authors implemented a reference system split into an open-core CAVA skeleton (schema, hashing, adapters) and a managed OSuite layer integrating production parser packs, PCAA policy routing, approval workflows, evidence graph construction, signature orchestration, and ledger attestation.

Evaluation is conducted with the 96-seed, 384-variant benchmark testing nine properties quantitatively. Baselines include raw-text policy (binding to literal runtime string) and first-token heuristics (classify by first executable token). Each metric is a recall or precision measure relevant to governance correctness (e.g., semantic equivalence recall, wrapper bypass catch rate). An expanded evaluation matrix and ablation study examine failure modes and components necessary for CAVA's functionality.

Ablation studies removing wrapper parsing, profile aliases, canonical fingerprint, receipt verifier, or PCAA binding show severe drops in coverage and correctness, confirming the architecture's key components. The paper discusses practical deployment considerations, limitations in parser coverage, runtime variants, attestation scope, and the need for ongoing adversarial benchmark expansion.

Overall, the methodology blends formal systems definitions of canonical actions, a practical layered implementation, and a comprehensive empirical benchmark with operationally meaningful metrics and attacker-style red team cases. The reproducible open-core artifacts enable community validation and ecosystem growth.

Technical innovations

• Formalization of canonical runtime action identity that maps heterogeneous runtime events into stable, versioned, hashable canonical action objects enabling robust approval binding.
• A Semantic Pattern Layer mapping canonical actions plus boundary and data context into reusable, policy-addressable risk patterns rather than customer-specific heuristics.
• A 6-step CAVA protocol capturing, normalizing, interpreting, fingerprinting, approval binding, closing with receipts, and optional attestation, establishing a composable substrate for deployer-owned runtime governance loops.
• An open-core system architecture separating a portable CAVA skeleton from managed enterprise parser packs, PCAA policy routing, approval workflows, evidence graphs, and attestation orchestration.
• A comprehensive evaluation harness combining 96 seed scenarios expanded into 384 runtime variants to benchmark CAVA against raw-text and first-token baselines across multiple governance dimensions.

Datasets

• CAVA benchmark corpus — 96 seed scenarios expanded into 384 runtime variants — proprietary with public benchmark harness

Baselines vs proposed

• Raw-text policy: semantic equivalence recall = 0.0 vs CAVA: 1.0
• First-token rules: semantic equivalence recall = 0.0 vs CAVA: 1.0
• Raw-text policy: approval binding correctness = 0.0 vs CAVA: 1.0
• First-token rules: approval binding correctness = 0.0 vs CAVA: 1.0
• Raw-text policy: wrapper bypass catch rate = 0.0 vs CAVA: 1.0
• First-token rules: wrapper bypass catch rate = 0.0 vs CAVA: 1.0
• Raw-text policy: false-positive control = 0.5 vs CAVA: 1.0
• First-token rules: false-positive control = 0.5 vs CAVA: 1.0
• Raw-text policy: semantic pattern detection = 0.0 vs CAVA: 1.0
• First-token rules: semantic pattern detection = 0.333 vs CAVA: 1.0

Limitations

• The benchmark corpus is representative but not comprehensive of all enterprise runtime actions; broader real-world traces and third-party examples are needed.
• Canonicalization quality depends heavily on parser coverage; private or custom parser packs may be needed for specific environments, introducing risks of missed escalations or false positives.
• Production parser packs, enterprise policy routing, and managed connector rules are withheld limiting full third-party reproduction of managed OSuite behavior.
• Attestation mechanisms prove integrity and binding but cannot assess business wisdom or policy soundness—attested actions can still be incorrect or risky.
• Runtime observability depth varies; some runtimes allow inline blocking while others are observe-only, and CAVA must disclose enforcement limits rather than overclaim uniformity.
• Current results are from synthetic and controlled variants; adversarial evaluation and deployment in live heterogeneous systems remain as future work.

Open questions / follow-ons

• How does CAVA perform under adaptive adversarial agents purposely crafting obfuscated or adversarial runtime events to evade canonicalization?
• Can the canonical action semantics be extended to support real-time enforcement or inline blocking across a broad range of heterogeneous runtimes?
• How to systematically expand parser adapter coverage to handle the full diversity of proprietary or emerging runtimes in enterprise environments?
• What integration approaches are effective to combine CAVA with existing security information and event management (SIEM) systems or extended detection and response (XDR) platforms?

Why it matters for bot defense

Bot-defense and CAPTCHA engineers can view CAVA as a paradigm for robustly identifying and verifying agent-driven actions beyond superficial indicators like literal text or single tokens. Its approach to canonicalizing heterogeneous runtime events into stable, hashable action objects that can be independently verified and bound to policy approvals addresses a fundamental problem in governance of autonomous agents executing complex workflows. For CAPTCHA or bot mitigation solutions layered on top of AI-driven agents, adopting canonical semantics and pattern-based risk detection rather than brittle heuristics would improve robustness against evasive automation and obfuscation. Furthermore, incorporating attestation and receipt verification can enable audit-ready evidence to disambiguate authorized from unauthorized actions. While CAVA is focused on enterprise governance, its methodological insights on canonicalization and semantic pattern detection could inform bot defense systems that rely on runtime activity traces or API calls, providing stronger guarantees against manipulation and approval drift. Integrating similar semantic canonicalization could yield more resilient bot indicators and reduce false positives arising from syntactic rewrites or wrappers.

Cite

@article{arxiv2607_13716,
  title={ CAVA: Canonical Action Verification and Attestation for Runtime Governance of Agentic AI Systems },
  author={ Zexun Wang },
  journal={arXiv preprint arXiv:2607.13716},
  year={ 2026 },
  url={https://arxiv.org/abs/2607.13716}
}

Read the full paper

• arXiv:2607.13716 (abstract)
• arXiv:2607.13716 (PDF)