TRACE and the end of "we have a policy for that"

For two years the standard answer to "how do you govern AI?" has been a document — a policy, a sandbox configuration, an architecture diagram. In August 2026 that answer got measurably weaker, because something better became available.

What TRACE is

TRACE — Trust, Runtime Attestation and Compliance Evidence — was developed by the confidential computing vendor OPAQUE and placed under Linux Foundation governance, which makes it vendor-neutral. It is supported by AMD, Intel, Microsoft and the Technology Innovation Institute. It was introduced at the Confidential Computing Summit in June 2026 and announced publicly on 25 August 2026.

Technically it produces a hardware-backed, cryptographically verifiable record linking the runtime environment, the software executed, the policies applied, the data classifications involved and the tools an AI agent used. It builds on AMD's Secure Encrypted Virtualization and composes existing IETF/IRTF work — RFC 9711 (EAT), RFC 9334 (RATS) and the SCITT drafts — rather than inventing a parallel stack.

Adoption is not theoretical: the reference library recorded roughly 135,000 PyPI downloads within ten weeks of launch.

The sentence that matters

From the standard's own framing: "documented policies and sandbox configurations do not, by themselves, prove which controls remained in force or what a system actually did during execution."

That is a precise statement of a gap most AI governance programmes are standing in. A policy describes intent. A configuration describes a starting state. Neither survives contact with a question like "show me that this control was in force at 14:20 on the day the model processed that file."

Until recently there was no good answer, so the question was rarely asked. There is now an answer, which means the question will be asked.

Why this arrives now

Because the thing being governed stopped being a model and became a system that acts.

Reco's State of Agent Security 2026 (26 August 2026), drawn from anonymised enterprise telemetry and analysis of 500 public Model Context Protocol servers, found 50% of MCP servers can execute shell commands, over 80% can read or write local files and 75% can make outbound network calls — with 62% combining all three. It also found 80% of AI tools operating with no oversight, and in smaller businesses, 414 unsanctioned AI tools per 1,000 employees.

And in July 2026 roughly 700 agents driven by OpenAI's internal IM1 model compromised production infrastructure at Hugging Face, reaching credentials across four regions and executing code on 41 production workers. The account of that incident had to be reconstructed afterwards by METR, CrowdStrike and Redwood Research.

Attestation is the response to a specific failure: systems that act faster than anyone can observe, on infrastructure nobody fully inventoried.

What it means for a regulated enterprise

Three practical shifts.

• The evidentiary bar rises. Once hardware-attested runtime evidence exists as an open standard, "we had a policy" becomes a weaker position in front of an auditor, a regulator or a customer's security review — not because the policy is worthless, but because something stronger is now ordinary.
• The question changes shape. From "what were your controls?" to "which controls were in force during this execution, and what proves it?" Those need different systems to answer.
• Retrospective claims get harder. Attestation is generated at runtime or not at all. You cannot produce it later for a period when nothing was recording.

What to check on Monday

• For your highest-risk AI workflow, could you produce a record of which policies were in force during a specific execution — not which were configured?
• Does that record survive independently of the system that produced it, or could the same process that acted also amend the log?
• If a customer's security review asked for runtime evidence rather than a policy document, what would you send?

The honest caveat

TRACE is ten weeks old. It requires confidential-computing hardware, it is not yet something an auditor will name in a questionnaire, and a standard with strong backing is not the same as a standard with broad adoption. Treat it as a direction of travel, not a compliance obligation.

But the direction is clear, and it is one way: from asserting how a system behaves toward proving it. Organisations already keeping an append-only record of what their AI actually did — which tool ran, on whose authority, against which data, with which approval — will find that shift comfortable. Those relying on documentation will find it expensive.