Implementation profile
Implementation profile: governance
For a security team governing agents it did not build.
An implementation profile is the subset of OpenA2A specifications a team needs for one job, in reading order. It is a guide, not a conformance level, and it is unrelated to the behavioralProfile field of an ATX credential, the AAP broker profile, and the conformance.json profile format.
How to read this profile
Four artifacts, in the order a governing team meets them: a behavioral contract for each agent, a benchmark for the tools that watch those agents, a shared vocabulary for the attacks those tools report, and a public declaration each domain can publish. Every command below runs against a published package or a live URL; the outputs captured at the time of writing sit in the change that added this page, not on it, so nothing here goes stale silently.1. ABGS: what each agent promises to do and not do
Agent Behavioral Governance Specification, version 1.0.0-draft, Draft. Conformance: conformance.md (3 levels) via hackmyagent scan-soul, requirements-based levels audited by a scanner (keyword detection); no byte-pinned fixture suite yet — manual audit confirms detections are substantive.
ABGS, published as OASB-2, is the governance companion to the OASB security benchmark. It defines what goes in an agent's SOUL.md governance file: behavioral domains, controls, and conformance levels a file can declare. A governing team asks every agent it operates for one, then scores the file it received. HackMyAgent generates a starting file and scores an existing one; it reports the score, the tier the file declares, and the level the file reaches, as the tool computes them for that file. ABGS, which HackMyAgent reports as OASB-2, is documented on the ABGS spec page.
npx hackmyagent harden-soul . # writes SOUL.md from the catalog
npx hackmyagent scan-soul SOUL.md # scores it: domains, controls, level2. OASB: does the security tool actually catch agent attacks
Open Agent Security Benchmark, version 0.4.0, Stable. Conformance: OASB is itself the harness, 222 attack scenarios that measure tools; a tool proves coverage by running the benchmark, not by passing fixtures.
The benchmark measures a security tool's detection coverage against a fixed corpus of attack scenarios. It defines three levels for the tools it measures, named as hackmyagent secure --help prints them: L1 Essential, L2 Standard, L3 Hardened. They describe what a run checks, not a standing anyone holds. A governing team runs the benchmark against its own tooling and reads the compliance line.
npx hackmyagent secure -b oasb-1 # L1 Essential (default)
npx hackmyagent secure -b oasb-1 -l L2 # L2 Standard3. Agent Threat Matrix: one vocabulary for what the tools report
AI Agent Threat Matrix, version 1.1.0, Published (June 2026). Conformance: evidence audit + machine-readable matrix, a taxonomy, not a protocol: conformance means citing techniques accurately; every technique carries an evidence tier.
A taxonomy of attack techniques against agents, each with an identifier, an evidence tier, and mappings to MITRE ATLAS and OWASP. Scan findings, benchmark scenarios and research reports cite the same identifiers, so a governing team can compare a finding from one tool with a report from another. It is a taxonomy, not a protocol: using it well means citing techniques accurately.
curl -sL https://threats.opena2a.org/techniques/T-2002 | grep -o "<title>[^<]*</title>"4. ai-safety.txt: what a domain declares about its agents
Domain AI-safety declaration, version draft-01, Filed as IETF Internet-Draft (draft-fane-ai-safety-txt-01). Conformance: none.
A file a domain publishes at a well-known URI describing how it handles AI agents. Every field is self-asserted, so a consuming agent treats it as one input to a risk decision, not as proof. A governing team publishes one for the domains it is responsible for and reads the ones published by the domains its agents call.
curl -s https://opena2a.org/.well-known/ai-safety.txt | head -12After the four
Governance sits on top of identity and trust. When the team also needs to verify who an agent is and whether it is still trusted, the OpenA2A Agent Passport page lists the artifacts a counterparty checks, and the layered stack shows why the order matters.