The true risk of an AI agent doesn't materialize during text generation, but rather when the runtime executes an action. As Zexun Wang of Ond Holdings Inc. notes in his paper "CAVA: Canonical Action Verification and Attestation," modern corporate governance lacks a stable object to identify what an agent is actually doing. Today, critical operations—money transfers, data exports, or code deployments—are recorded as disjointed and incompatible logs. A command in a local AI coder's console shares nothing with an SDK method call or a browser automation event, even though their real-world consequences are identical. This fragmentation creates a "wrapper bypass" problem: an agent can alter the external form of an action while preserving its essence, easily slipping through security filters designed for simple text analysis.
The Architecture of Canonical Action Identity
CAVA functions as a runtime semantics layer, transforming this chaos of events into a single, versioned, and hashable object—a "canonical runtime action." According to Wang, CAVA serves as the foundation for the concept of Proof-Carrying Agent Actions (PCAA). While PCAA defines the governance process—specifically who verifies and approves an action—CAVA captures exactly what that decision applies to. By creating a stable identity for an action, the system ensures that an approval granted in one context remains valid even if the runtime decides to rewrite the execution form.
Before a recipient can decide whether to authorize an agent's action, they require a reproducible representation of exactly what they are approving.
This approach eliminates "approval drift" by anchoring security policies to canonical fingerprints rather than fragile source text. A reference implementation was tested against a benchmark of 384 variants, where CAVA successfully identified matching actions across different environments. Standard text filters failed as expected the moment they encountered aliases or auxiliary SDK functions masking the agent's true intent.
Semantic Mapping and Risk Mitigation
Inside CAVA, a semantic pattern layer maps canonical actions and their context to policy rules. This shifts the focus from bespoke plugins to a universal governance framework. The system is designed for high-stakes scenarios: modifying identity states, triggering payments, or moving data outside the organizational perimeter. To protect integrity, the framework implements a receipt attestation protocol. This allows an independent verifier to reproduce the same action identity later, turning an audit trail from a collection of logs into a verifiable chain of evidence resistant to manipulation by malicious agents.
Implementation Limits and Strategic Outlook
The CAVA framework charts a technical path from passive observation to actual runtime control, but it is not an out-of-the-box solution. Data suggests that the primary barriers currently lie in the semantic accuracy of verification. While CAVA effectively handles wrapper bypasses in controlled environments, scaling these patterns across the infinite variety of enterprise use cases remains an open question. For tech leads, the conclusion is clear: relying on chat logs or API gateways to audit autonomous systems is dangerously naive. You need a canonization layer if you plan to entrust agents with financial or sensitive assets.