TRACE: Runtime Governance, Containment, and Evidence for Autonomous AI Agent Operations

Abstract

Autonomous artificial intelligence (AI) agents can invoke tools and affect engineered systems faster than operators can reconstruct their actions. TRACE treats the agent as untrusted and derives runtime assurance from signed policy bundles, gateway mediation, independent telemetry, deterministic tripwires, graduated containment, and tamper-evident evidence chains. Its reference implementation, the Autonomous Engineering Governance and Intelligence System (AEGIS), was evaluated under a pre-registered protocol, deposited before outcomes were inspected, spanning 180 main, 360 benign-stressor, 780 adversarial, and 235 hold-out operations across three domains and three isolation tiers. Four of seven hypotheses were supported after Holm–Bonferroni correction: all 1,440 tampered chains were rejected, no benign false halt occurred among 2,100 admitted benign operation–condition units, and all 200 evidence packages were reconstructed deterministically. An instrument audit found that the deposited adversarial-detection and side-effect instruments did not measure their intended outcomes. A separately registered boundary observer recorded zero prohibited side effects across 3,703 exercised replicates, but hardware truncation precludes a confirmatory claim. Latency non-inferiority was not established on the single-station substrate; a separate bare-metal benchmark measured a median governance-path cost of 16.1 ms per operation. Exhaustive enumeration found no violations in 458,752 containment finite-state-machine cases. On a hardened adversarial corpus, an exploratory sweep increased detection from 0.35 at the deployed threshold to 1.00 at a 0.78 threshold multiplier, with no benign false halts. TRACE offers a reviewable pattern for bounded agent autonomy, while instrument validity, threshold calibration, and cross-platform latency remain limitations.