AI Agent Compliance Data Model

Why This Exists

AI agents make autonomous decisions, call external tools, and transfer data across jurisdictions — often faster than any human oversight loop. The compliance infrastructure around them is fragmented: security tools track what tools were called, IT governance tools track which agents exist, and legal/privacy tools track data flows. None of them share a common data model.

This means a DPO auditing an HR screening agent, a regulator assessing an EU AI Act Annex III system, and a CISO investigating a potential prompt injection incident are all looking at different records — or no records at all.

This specification defines a minimal, interoperable data model for AI agent compliance events. It is designed to be:

• Implementable by any tool — security, governance, or compliance
• Composable — the same event stream should satisfy GDPR Art. 30 (records of processing), EU AI Act Art. 14 (human oversight), and internal audit requirements
• Extensible — v0.1 defines the floor, not the ceiling

The goal is not a new standard to replace existing ones. It is a shared vocabulary so that tools operating at different layers of the agent stack can produce records that fit together.

Scope

This version covers five core object types:

1. AgentRecord

Represents a registered AI agent. Should be created when an agent is deployed and updated when its capabilities or policies change.

{
  "schema": "acm/agent-record/v0.1",
  "agent_id": "agt_7f3a9c",
  "display_name": "HR Screening Agent",
  "version": "2.1.0",
  "owner": {
    "organization": "Acme Corp",
    "team": "People Operations",
    "contact": "dpo@acme.com"
  },
  "deployment": {
    "environment": "production",
    "region": "eu-west-1",
    "data_residency": "DE",
    "first_deployed_at": "2026-01-15T09:00:00Z"
  },
  "classification": {
    "eu_ai_act_risk_level": "high",
    "eu_ai_act_annex": "III",
    "processes_personal_data": true,
    "special_categories": ["employment_decisions"],
    "automated_decision_making": true
  },
  "tools_permitted": ["cv_parser", "calendar_api", "email_sender"],
  "transfer_policies": ["policy_eu_only", "policy_scc_us"],
  "a2a_card_url": "https://acme.com/.well-known/agent-cards/hr-screening.json",
  "registered_at": "2026-01-15T09:00:00Z",
  "last_updated_at": "2026-03-01T14:22:00Z"
}

Field reference

2. ToolCallEvent

Represents a single tool invocation. Every time an agent calls an external tool, a ToolCallEvent should be emitted. This is the primary record for data minimization audits and AI Act oversight.

{
  "schema": "acm/tool-call-event/v0.1",
  "event_id": "evt_a3f81b",
  "agent_id": "agt_7f3a9c",
  "session_id": "sess_9d2e4f",
  "tool_id": "cv_parser",
  "tool_version": "1.4.2",
  "called_at": "2026-03-20T11:34:52Z",
  "inputs": {
    "fields_requested": ["name", "email", "work_history"],
    "data_subjects": 1,
    "contains_special_categories": false
  },
  "outputs": {
    "fields_returned": ["name", "email", "work_history", "inferred_age"],
    "data_subjects": 1
  },
  "context_trust": {
    "level": "degraded",
    "degraded_by": "external_document",
    "degraded_at": "2026-03-20T11:34:10Z",
    "annotation_ref": "cta_7c1a3e"
  },
  "outcome": {
    "decision_made": true,
    "decision_type": "candidate_shortlisted",
    "human_review_required": true,
    "oversight_record_ref": "hor_2b9f5a"
  },
  "legal_basis": "legitimate_interests",
  "purpose": "employment_screening"
}

Field reference

3. DataTransferRecord

Represents a personal data transfer to a third country or international organization under GDPR Chapter V. Should be emitted whenever an agent call results in personal data leaving the EEA.

{
  "schema": "acm/data-transfer-record/v0.1",
  "transfer_id": "xfr_5c2d7a",
  "agent_id": "agt_7f3a9c",
  "event_ref": "evt_a3f81b",
  "transferred_at": "2026-03-20T11:34:53Z",
  "origin": {
    "jurisdiction": "EU",
    "data_residency": "DE"
  },
  "destination": {
    "jurisdiction": "US",
    "recipient": "OpenAI Inc.",
    "recipient_country": "US",
    "service_endpoint": "api.openai.com"
  },
  "transfer_mechanism": {
    "type": "scc",
    "scc_version": "2021/914/EU",
    "module": "2",
    "executed_at": "2025-11-01T00:00:00Z",
    "document_ref": "vault://scc/openai-2025-11-01.pdf"
  },
  "data": {
    "categories": ["professional_history", "contact_information"],
    "special_categories": [],
    "data_subjects_count": 1,
    "pseudonymised": false
  },
  "adequacy_decision_applicable": false,
  "dpf_relied_upon": false,
  "blocked": false,
  "block_reason": null
}

Transfer mechanism types

4. ContextTrustAnnotation

Captures the trust state of an agent's context window at a point in time. Inspired by AgentLock v1.1's context trust model. Intended to be referenced by ToolCallEvents and HumanOversightRecords.

{
  "schema": "acm/context-trust-annotation/v0.1",
  "annotation_id": "cta_7c1a3e",
  "agent_id": "agt_7f3a9c",
  "session_id": "sess_9d2e4f",
  "evaluated_at": "2026-03-20T11:34:10Z",
  "trust_level": "degraded",
  "sources_in_context": [
    {
      "source_type": "external_document",
      "source_identifier": "cv_upload_20260320_candidate_88.pdf",
      "introduced_at": "2026-03-20T11:34:08Z",
      "trust_classification": "untrusted"
    },
    {
      "source_type": "internal_system",
      "source_identifier": "hr_database",
      "introduced_at": "2026-03-20T11:33:50Z",
      "trust_classification": "trusted"
    }
  ],
  "degradation_trigger": {
    "source_type": "external_document",
    "introduced_at": "2026-03-20T11:34:08Z",
    "reason": "unverified_external_content_entered_context"
  },
  "session_trust_persistent": true
}

Trust levels

session_trust_persistent: true means that once degraded, trust does not recover within the session — consistent with AgentLock v1.1 semantics.

5. HumanOversightRecord

Records a human review, intervention, or override of an agent decision. Required for EU AI Act Annex III systems under Art. 14. Should reference the ToolCallEvent that triggered the review.

{
  "schema": "acm/human-oversight-record/v0.1",
  "record_id": "hor_2b9f5a",
  "agent_id": "agt_7f3a9c",
  "event_ref": "evt_a3f81b",
  "reviewer": {
    "reviewer_id": "usr_hr_manager_42",
    "role": "HR Manager",
    "organization": "Acme Corp"
  },
  "review_triggered_by": "degraded_context_trust",
  "review_initiated_at": "2026-03-20T11:40:00Z",
  "review_completed_at": "2026-03-20T11:47:23Z",
  "agent_decision": {
    "decision_type": "candidate_shortlisted",
    "confidence_score": 0.87,
    "reasoning_summary": "Candidate meets 7 of 9 required criteria"
  },
  "reviewer_outcome": {
    "action": "overridden",
    "override_reason": "Candidate's gap year misclassified as unemployment",
    "final_decision": "candidate_shortlisted",
    "notes": "Agent reasoning was valid but factual error in CV parsing triggered manual correction."
  },
  "eu_ai_act_compliance": {
    "art_14_satisfied": true,
    "human_had_meaningful_control": true,
    "override_capability_tested": false
  }
}

review_triggered_by values

Event Relationships

AgentRecord
    └── ToolCallEvent (many per agent session)
            ├── ContextTrustAnnotation (one per evaluation)
            ├── DataTransferRecord (zero or many per call)
            └── HumanOversightRecord (zero or one per call)

A single HR screening session might produce:

• 1 AgentRecord (the agent, registered at deployment)
• 12 ToolCallEvents (each tool invocation in the session)
• 1 ContextTrustAnnotation (trust degraded when CV uploaded)
• 3 DataTransferRecords (calls to US-based LLM API, 3 times)
• 1 HumanOversightRecord (triggered by degraded trust on the final decision)

Together, these five records constitute a complete Art. 30 processing entry, an Art. 14 oversight log, and a Chapter V transfer audit trail — from a single agent session.

Implementation Guidance

Minimum viable implementation

A tool implementing this spec should, at minimum:

1. Emit ToolCallEvents with context_trust.level and outcome.decision_made populated
2. Emit DataTransferRecords for any call that routes personal data outside the EEA
3. Store records in an append-only, tamper-evident log

Interoperability

Tools may implement any subset of this model. Cross-tool interoperability is achieved by:

• Using agent_id as the shared key across all records
• Referencing related records by their IDs (event_ref, annotation_ref, oversight_record_ref)
• Exposing records via a REST endpoint at /.well-known/acm/ on the implementing service

Suggested endpoint structure

GET /.well-known/acm/agents/{agent_id}           → AgentRecord
GET /.well-known/acm/events?agent_id=&from=&to=  → ToolCallEvent[]
GET /.well-known/acm/transfers?agent_id=          → DataTransferRecord[]
GET /.well-known/acm/oversight?agent_id=          → HumanOversightRecord[]

What This Spec Does Not Cover (v0.2 candidates)

• Consent records and withdrawal events
• Data subject access request (DSAR) workflow events
• Agent-to-agent (A2A) delegation chains and inherited trust
• Cryptographic signing of records (tamper evidence)
• Retention and deletion schedules per record type
• Mapping to specific national DPA reporting formats

Contributions and proposals for v0.2 are welcome via GitHub Issues.

Relationship to Existing Standards

This spec is designed to be complementary, not competing:

Version History