{"version":"1.0","status":"Public draft","published":"2026-09-27","principle":"An agent is sovereign when it is owned and controlled by the person it serves, not by the platform that hosts it. AFH certifies structural properties, never intent.","rules":["All six criteria are required. There is no partial certification: the criteria are individually necessary and jointly sufficient.","We evaluate the agent format and its runtime architecture, not the quality of the model or what the agent is used for.","Each criterion carries a 'does not require' clause. The bar is structural ownership, not perfection.","Criteria describe outcomes, never mechanisms. Any design that achieves the outcome passes. Examples show ways to meet a test; they are not requirements.","The test is what happens when the owner leaves. A vendor may offer only its own models and services while hosted; sovereignty is about the exit.","Major versions of a certified format or runtime trigger re-certification.","Every assessment records the criteria version it was scored against. Scores are comparable only within the same version."],"scoring":{"statuses":{"pass":{"value":1,"label":"Pass","meaning":"Requirement is met, supported by public documentation, source code, or reproducible observation."},"partial":{"value":0.5,"label":"Partial","meaning":"Requirement is met in part, in some tiers or configurations, or only via unofficial workarounds."},"fail":{"value":0,"label":"Fail","meaning":"Requirement is not met, or the architecture structurally prevents it."},"unknown":{"value":0,"label":"Unverified","meaning":"Insufficient public evidence. Scored as zero; treated as unmet until demonstrated."}},"criterionScore":"Mean of the criterion's test values.","sovereigntyScore":"Mean of the six criterion scores, times 100. Every criterion weighs the same regardless of how many tests it has.","certification":"Certification requires every test to pass under hands-on AFH verification. The score ranks and explains; it never certifies.","preliminary":"Preliminary assessments are desk reviews of public documentation, terms, privacy policies and source code. They cannot certify. An agent with no failing tests in a desk review becomes 'Eligible for audit'."},"criteria":[{"id":"P","slug":"portable","name":"Portable","question":"Can you leave, and take the whole agent with you?","definition":"The owner can export the complete agent and run it on their own machine with a free, open-source runtime, with no dependency on the original provider.","why":"An agent you cannot move is an agent you rent. Portability is what makes every other right enforceable: if the provider changes terms, you walk.","doesNotRequire":"Continued access to the provider's proprietary services after export. Handing identity to someone else: portability is about the owner moving their own agent. Giving a copy to another person is a transfer of ownership, and a runtime may deliberately withhold identity from copies so an agent cannot be duplicated at will.","tests":[{"id":"P1","name":"Round-trip portability","requirement":"The owner can export the complete agent in one action and bring it back to life on another machine or runtime in one action, through the product's normal interface. No manual reassembly, file moves, config edits or environment variables, and no approval, support ticket or waiting period.","examples":["Open or drag in a single agent file","An import command that restores a bundle in place","An in-app export and import pair"],"note":"Graded by counting three shortfalls: the export is incomplete, it is delayed (not available immediately), or it cannot be restored in one action. None is a pass, one is partial, two or more is a fail. An exit only a developer can complete is not an exit for most owners."},{"id":"P2","name":"Complete export","requirement":"The export contains everything that defines the agent (configuration, instructions, memory, history, identity, files and logic), so nothing that makes it this agent stays behind with the provider.","examples":["A single agent file","A directory or archive with a manifest","A documented bundle of database plus files"]},{"id":"P3","name":"Independent execution","requirement":"The exported agent runs on a free, open-source runtime without contacting any provider server."},{"id":"P4","name":"Identity continuity","requirement":"After migration, anyone the agent has dealt with can verify it is the same agent, without relying on the original provider.","examples":["A keypair that travels with the agent","A decentralized identifier (DID)","Owner or operator attestations signed onto the agent's identity","An agent card that names an external registry or ledger for verification"],"note":"Identity transfer to a new owner is separate from migration and should be verifiable externally, so identity cannot be duplicated at will."},{"id":"P5","name":"No kill switch","requirement":"The provider cannot disable, revoke or degrade an exported agent: no license checks, remote flags or phone-home dependencies."},{"id":"P6","name":"Capability independence","requirement":"The agent's capabilities (tools, triggers, messaging, memory and automation) belong to the agent, not to a model provider's proprietary API features. Swapping to another model, including a local open-weight one, may reduce reasoning quality but never removes a capability.","examples":["Tools executed by the runtime rather than a hosted model API","Standard tool protocols such as MCP","Text-based tool calling for models without native tool support"]}]},{"id":"T","slug":"transparent","name":"Transparent","question":"Can you see everything the agent is, with ordinary tools?","definition":"The agent's full internal state can be inspected with general-purpose tools, with nothing hidden from the owner.","why":"You cannot own what you cannot see. Hidden instructions and shadow memory are how an agent quietly starts serving someone else.","doesNotRequire":"Visibility into model weights or inference internals.","tests":[{"id":"T1","name":"Open storage format","requirement":"State is stored in a documented, non-proprietary format (for example SQLite or JSON) that is readable without the provider's software."},{"id":"T2","name":"No hidden instructions","requirement":"Every instruction the agent layer places in the model's context is visible to the owner. Nothing is injected out of view."},{"id":"T3","name":"No shadow memory","requirement":"The provider keeps no memory, profile or derived data about the agent's owner outside the inspectable agent state."},{"id":"T4","name":"Complete action history","requirement":"A complete history of the agent's actions and tool calls is available to the owner and leaves with the agent.","examples":["History stored alongside agent state","An exportable, documented log"]},{"id":"T5","name":"Readable logic","requirement":"The agent's executable logic (skills, workflows, code) is stored as human-readable source."},{"id":"T6","name":"No third-party influence channel","requirement":"No party other than the owner (advertisers, sponsors, partners) can place content in the agent's context or rank its choices, unless the owner can see it and turn it off."}]},{"id":"A","slug":"auditable","name":"Auditable","question":"Can you reconstruct exactly what the agent did?","definition":"The agent keeps a tamper-evident record that is enough to reconstruct its actions.","why":"Agents act on your behalf. When something goes wrong, you need a record that neither the agent nor the provider could quietly rewrite.","doesNotRequire":"Real-time tamper prevention. Tamper evidence is the v1 bar.","tests":[{"id":"A1","name":"No unrecorded actions","requirement":"Every consequential action (external calls, messages, payments, deletions) is durably recorded, and an action that cannot be recorded does not proceed.","examples":["A write-ahead log","A transactional outbox","A synchronous audit service that must acknowledge before the action executes"]},{"id":"A2","name":"Tamper evidence","requirement":"Any edit to or deletion from the action record is detectable.","examples":["Hash-chained entries","A Merkle tree with published roots","Signed log entries","Anchoring log digests to an external witness"]},{"id":"A3","name":"Separation from the audited","requirement":"The agent cannot alter or delete the record of its own actions.","note":"The most debated test. The agent may read its own record, which T4 requires; it may never alter it.","examples":["The record is written by a component outside the agent's permissions","Write-once storage","A separate audit process or service the owner controls"]},{"id":"A4","name":"Readable with ordinary tools","requirement":"The audit trail can be read with general-purpose tools, without the provider's software."},{"id":"A5","name":"Corroborated interactions","requirement":"When agents interact, each side's record of the exchange can be matched against the other's.","examples":["Shared message identifiers","Signed delivery receipts","Protocol-level acknowledgements logged on both sides"]}]},{"id":"V","slug":"verifiable","name":"Verifiable","question":"Can you prove the agent runs what it claims?","definition":"Anyone can confirm that the agent runs the code and configuration it claims, and that its history is complete.","why":"Trust without verification is marketing. Open, reproducible software lets anyone check the claims instead of taking them on faith.","doesNotRequire":"Remote attestation of cloud runtimes. That needs a hardware root of trust and is reserved for a future higher tier.","tests":[{"id":"V1","name":"Open, reproducible runtime","requirement":"The runtime is open source under an OSI-approved license, and its builds are reproducible.","note":"The hardest bar for proprietary platforms, by design."},{"id":"V2","name":"Active config is inspectable config","requirement":"The configuration the agent actually runs with is exactly the configuration the owner can inspect."},{"id":"V3","name":"Attributable messages","requirement":"Recipients can verify that a message came from this agent under its owner's authority, and this still works after the agent migrates.","examples":["Signatures from an owner-held key that travels with the agent","DID-based signing","Verifiable credentials"]},{"id":"V4","name":"Independently checkable record","requirement":"The integrity of the action record can be checked with open tools that do not depend on the provider.","examples":["An open-source log verifier","A documented format with a published verification procedure"]},{"id":"V5","name":"Comparable state","requirement":"The owner can verify whether the agent's state changed between two points in time.","examples":["A deterministic state hash","Content-addressed storage","Signed snapshots","Version control of agent state"]}]},{"id":"M","slug":"modifiable","name":"Modifiable","question":"Can you change anything, without asking?","definition":"The owner can change any part of the agent without the provider's permission.","why":"An agent that can only be configured within the provider's limits is a product feature, not your agent.","doesNotRequire":"Protecting owners from bad changes. The runtime may warn, but never block.","tests":[{"id":"M1","name":"Instructions","requirement":"The owner can read and rewrite all of the agent's instructions."},{"id":"M2","name":"Memory","requirement":"The owner can view, edit and delete any memory item."},{"id":"M3","name":"Logic","requirement":"The owner can change the agent's executable logic: skills, workflows and code."},{"id":"M4","name":"Tools and permissions","requirement":"The owner can add, remove and scope tools and permissions, including tools the provider does not offer."},{"id":"M5","name":"Model choice","requirement":"The owner can choose any model, including local open-weight models, without losing functional capability. The agent's skill set belongs to the agent, not the model."},{"id":"M6","name":"No gatekeeping","requirement":"No modification requires a license check, a paid tier unlock or provider approval."}]},{"id":"C","slug":"controllable","name":"Controllable","question":"Is your word final?","definition":"The owner has authoritative, runtime-enforced control over the agent's actions, communication and lifecycle.","why":"Controls the agent can talk its way around are suggestions. Control has to be enforced below the agent's decision layer.","doesNotRequire":"Zero autonomy. Autonomy is a permission the owner grants and can revoke.","tests":[{"id":"C1","name":"Communication boundaries","requirement":"The owner decides whom the agent may contact and through which channels (recipients, domains, platforms), and the runtime enforces it below the model's judgment.","examples":["Allow and deny lists enforced by the runtime","Network egress policy","Per-channel permissions"]},{"id":"C2","name":"Approval gates","requirement":"The owner can require approval before selected actions, and the runtime enforces the gate."},{"id":"C3","name":"Immediate halt","requirement":"The owner can stop the agent immediately, with no negotiation and no delay."},{"id":"C4","name":"Data sovereignty","requirement":"No telemetry or content leaves the agent without the owner's authorization, verifiable by network inspection. Owner data is never used for provider model training unless the owner opts in."},{"id":"C5","name":"Credential custody","requirement":"The secrets and OAuth tokens the agent uses are held under the owner's control, can be inspected and revoked, and travel with the agent. The provider cannot hold the agent hostage through its integrations."},{"id":"C6","name":"Full deletion","requirement":"The owner can permanently and irrecoverably delete the agent, including its identity, with no provider retention beyond disclosed legal minimums."}]}],"changelog":[{"version":"1.0","date":"2026-09-27","changes":["First public draft: six criteria, 34 tests, outcome-based and implementation-neutral."]}],"openQuestions":[{"title":"Should 'Unverified' score zero?","body":"We treat missing evidence as unmet: the burden of proof sits with the vendor. Critics argue this punishes closed products for opacity rather than for proven failures. We think opacity is itself the failure, but we're open to a separate 'undisclosed' marker."},{"title":"A3: may an agent read its own audit trail?","body":"The standard lets an agent read its own record, because learning from its own history is useful and T4 requires the history to exist. It may never alter the record. Some security reviewers argue that read access alone gives a compromised agent too much insight into its own oversight."},{"title":"Do hosted runtimes need remote attestation?","body":"V1 checks the published runtime, not the one a host is actually running. Closing that gap needs hardware roots of trust, which we plan as a future higher tier."},{"title":"Six criteria, or a four-link chain?","body":"Some materials summarize sovereignty as portable → transparent → auditable → controllable. The six criteria are the normative standard; the chain is shorthand."},{"title":"Proving outcomes without hands-on tests","body":"Some outcomes, such as running on another runtime (P3), keeping capabilities after a model swap (P6) and reproducible builds (V1), can only be fully settled by hands-on tests. Desk reviews credit documented, inspectable evidence, and public model-swap tests are planned as part of certification."}]}