Skip to content
AIGP

DOC-002: Agentic Governance — Coverage Findings & Resolution

DOC-002: Agentic Governance — Coverage Findings & Resolution

PRIVATE AND PROPRIETARY — Owned by Kanjani AI Research & Causum. See NOTICE.md. Status: Living findings · Date: 2026-09-10

This is the consolidated agentic findings record: the state of AIGP’s agentic governance across three axes — (1) protocol/server operability, (2) OWASP-ASI threat coverage, and (3) agent-framework adapter coverage — plus what was resolved on 2026-09-10 and what remains.

It ties together three living documents; consult them for detail:

1. Protocol / server operability (the “is it wired?” axis)

Finding (audit 2026-09-10): the agentic client was a hybrid mid-migration — the newest primitives were on the v3 contract, but the older agentic core had drifted.

Resolved:

  • 5 orphaned agentic endpoints routed — tool-request, plan-submit, escalate, step-complete, attest-input were called by the client but existed in neither openapi-v3.yaml nor the server dispatch. Now in the contract (38 paths) and routed; handle_attest_input built (per-segment scope check); input 400-guards added.
  • protocol_version normalized to "1" across the Python client, TS client, and the agentcore adapter (was a mix of "1.1" / "4.1").
  • agentcore adapter endpoint drift fixed — /api/v1/anticipate → /api/v1/agent/anticipate.

Operability now: memory integrity (RFC-044), circuit breaker (RFC-043), authority reconciliation (RFC-033), generation act / MBC (RFC-034), and the agentic core all resolve on the server and are exercised by the server test suite.

2. OWASP-ASI threat coverage (the “does it govern the threat?” axis)

Per the coverage matrix (ASI01–ASI10). Highlights after 2026-09-10:

  • COVERED: ASI02 (tool misuse), ASI03 (excessive agency — scope + circuit breaker, routed), ASI04 (memory poisoning — RFC-044 attest/verify, all 8 SDKs), ASI05 (cascading failures).
  • PARTIAL: ASI01 (goal hijack — intent declared, no runtime goal-integrity check), ASI07 (inter-agent comms — delegation + reconcile exist, no message-authenticity model), ASI09 (drift measured, not yet a governed auto-trip), ASI10 (kill switch routed, no rogue-agent detection signal).
  • GAP: ASI06 (tool/skill provenance), ASI08 (agent identity as a first-class principal).

These remaining PARTIAL/GAP items are the Track-B backlog (RFC-045+ agent identity, tool provenance, goal-integrity, drift-as-control, HITL, rogue detection).

3. Agent-framework adapter coverage (the “can teams actually adopt it?” axis)

Per the industry analysis. 15 adapters, with market-leader coverage raised from ~3.5/7 to ~6.5/7 on 2026-09-10:

  • Production (tested): strands, langchain/langgraph, google-adk, pydantic-ai, agentcore.
  • Added 2026-09-10 (unit-tested): microsoft-agent-framework (the SK+AutoGen convergence), openai-agents (OpenAI Agents SDK), claude-agent-sdk.
  • Real (tested): crewai, mcp. Deprecated → MAF: autogen, semantic-kernel.
  • Raw-SDK wrappers: openai, anthropic (base chat/messages, not agent loops).

4. KPG integration seam (the “where do agentic findings land?” axis)

The Knowledge Property Graph (KPG) stack (AI-DOMAIN / Metis + knowledgeproperty-graph) already models AIGP as an event source into the graph. The AI Value RFC family (RFC-045–052) is the value-knowledge layer over the KPG; RFC-048 (KVCE) is the typed KPG value-semantics contract. Status: the KPG store exists (sibling repos), but AIGP has no event-emission code into it yet — this is the primary open integration, pending RFC-048 finalization against the real KPG.

5. What remains (open agentic work)

  1. RFC-048 (KVCE) finalized against the real Knowledge Property Graph + an AIGP→KPG emission path (the one substantive integration gap).
  2. Track-B agentic RFCs: agent identity (ASI08), tool/skill provenance (ASI06), runtime goal-integrity (ASI01), drift-as-control (ASI09), HITL approval gate, rogue-agent detection (ASI10).
  3. Agentic-core SDK parity: the 6 non-Python SDKs lack the 5 agentic-core methods (tool-request/plan-submit/escalate/step-complete/attest-input) — a parity wave.
  4. Adapter hardening: promote unit-tested new adapters (MAF/openai-agents/claude-agent-sdk) to integration-tested once the frameworks are available in CI; flesh out the llamaindex stub.

6. Provenance of these findings

Derived from the 2026-09-09 audit + the 2026-09-10 remediation session (agentic drift fix, memory + value SDK parity, three new adapters, industry analysis). Commits on main: A1 (server dispatch), A2 (authority), A3 (repo cleanup), B1 (memory), value schemas + client, agentic-drift fix, adapter Wave A (drift + tests), adapter Wave B (MAF/openai-agents/claude).