Policy Enforcement and Tamper-Evident Audit Chains | Imran Siddique | MCP Release Party - Seattle
Imran Siddique introduces cMCP, an open-source gateway that enhances Modular Control Plane (MCP) servers with policy enforcement and tamper-evident audit trails. It achieves this by running Cedar policy evaluation within Trusted Execution Environments (TEEs), ensuring that agent actions are governed securely and verifiably. The talk delves into the concept of "beyond governance" towards verifiable AI, the 'trace' standard for auditable logging, and the importance of confidential computing for regulated industries.
Imran Siddique introduces the concept of Confidential MCP (cMCP), an open-source gateway designed to address critical limitations in existing MCP (Modular Control Plane) servers: the lack of built-in policy enforcement and the inability to prove past actions. While acknowledging the advancements in MCP servers and the rapid evolution of agentic AI, Siddique highlights a significant gap in governance and verifiability.
The Evolution from Governance to Verifiability
Siddique reflects on his past work on the Agent Governance Toolkit (AGT) at Microsoft, which gained significant adoption. However, the core question shifted to “what lies beyond governance?” This led to the pursuit of verifiability—the ability to ensure that policies themselves are secure and that any actions taken can be unequivocally proven or disproven after the fact. Traditional software-based governance, he argues, is susceptible to tampering, where policies or even audit logs could be maliciously altered.
Confidential AI and Trusted Execution Environments
The path to verifiability, especially for regulated industries and sovereign entities, lies in Confidential AI, where agents and models operate within Trusted Execution Environments (TEEs) or enclaves. The cMCP project focuses on bringing this confidential computing paradigm to MCP interactions.
The key architectural innovation is the cMCP Gateway:
- Policy Enforcement: It wraps any existing MCP server without requiring modifications.
- Cedar Policies: Before each tool call from an agent, the cMCP gateway enforces Cedar policies, ensuring adherence to predefined rules.
- Tamper-Evident Audit Chains: Every call and its associated policy evaluation is chained into a tamper-evident record.
Crucially, the cMCP gateway, along with the policy evaluation logic, runs inside a hardware-secured boundary (an enclave). This design ensures that:
- Policies cannot be tampered with.
- If tampering occurs, it can be detected.
- Trace records generated are inherently trustworthy.
Agents and MCP servers themselves can remain outside the confidential hardware, optimizing cost and deployment flexibility, while critical governance logic is secured.
The Trace Standard for Verifiable Auditing
To further enhance verifiability, the initiative is standardizing a comprehensive logging format called Trace. This standard aims to record all pertinent information related to an agent’s decision-making process, including:
- Model IDs
- Policy hashes
- Actions taken
- Machine state
- Reasons for approvals or denials
The goal of Trace is not just to log information, but to make it verifiable, ideally through hardware guarantees from attestation services (e.g., Azure, Google, Nvidia). This ensures that audit trails cannot be altered post-factum. Siddique also acknowledges ongoing work into software-based verifiable logging for scenarios without TEEs.
Demonstrations and Broader Impact
Siddique presents demonstrations illustrating how cMCP can:
- Enforce policies: Denying an agent action (e.g., a loan approval exceeding a limit) based on Cedar policies.
- Detect policy tampering: By comparing the hash of the policy used during an agent’s operation with the approved policy bundle, any unauthorized modification is identified.
He emphasizes that this concept of verifiability extends beyond MCP to the broader AI ecosystem, including model provenance, supply chain integrity, and ensuring the trustworthiness of open models.
Open Source and Future Directions
The speaker underscores the commitment to open source, with projects like Confidential MCP, Agent Trust.io, and Trace being openly available. The Agent Manifest, a solution for verifying an agent’s identity and state at deployment, is being donated to the Coalition for Secure AI (COAI) for standardization.
Key areas of ongoing research and development include:
- Performance overhead: Evaluating the latency introduced by running policy evaluation within TEEs.
- Full system verifiability: Extending the current TEE-based policy evaluation to ensure the verifiability of the entire system.
In response to audience questions:
- Latency: While the deterministic policies of AGT introduced minimal latency (milliseconds), the performance overhead of TEEs is an active research area.
- Prompt Overriding Policies: Acknowledged as a growing challenge as models become more capable. Solutions involve external “watch over actions” mechanisms, potentially through software enclaves, to detect and prevent agents from bypassing policy engines.
- Verifiable Reports: The
tracestandard aims to generate tamper-evident reports stamped by attestation services, ensuring that claims of action and state can be independently verified. This is being driven towards an open standard with industry partners.