RFC: Governance namespace extension for OASF agent records

[Adirtr]

Summary

This RFC proposes a governance namespace extension to OASF that describes how AI agents are governed — embedded in the agent record itself, versioned with the agent, and portable across platforms.

The gap

OASF answers: what can an agent do? No current standard answers: how is it governed while doing it?

Organizations deploying agents today must invent governance schemas in isolation — policy files decoupled from the
agent record, with no versioning guarantees and no portability when agents move between platforms. Runtime
enforcement toolkits (including Microsoft's Agent Governance Toolkit, April 2026) enforce against framework-specific
files that live outside the agent record. There is no authoritative, portable declaration source for them to check
against.

Proposed extension fields

Five normative fields under a governance namespace:

• governance.rbac — invocation access control by role and organizational scope
• governance.approval_gates — human-in-the-loop requirements per action category
• governance.audit — logging level, reasoning chain capture, immutability
• governance.compliance_constraints — regulatory frameworks, data residency, PII handling
• governance.performance_metrics — SLA targets, escalation rate thresholds

Reference implementation

The schema was developed as part of the BizGenie Agent Configuration Schema v1.2 (Experasion.ai, 2025) and has been contributed openly following the company's closure.

• Full RFC: (https://github.com/Adirtr/agent-governance-schema/blob/main/rfc/rfc-001-oasf-governance-extension.md)
• JSON Schema:( https://github.com/Adirtr/agent-governance-schema/blob/main/schema/governance.json)
• Context article: The Agent Governance Stack Is Missing Its Foundation Layer

Open to feedback on field design, naming conventions, and alignment with OASF's existing extension mechanism (schema/extensions.md).