Issues

• [RefImpl] Migrate the NAT adapter to NVIDIA NeMo Relay before NAT reaches end of life

  help wantedstatus:acceptedtype:refimplworkstream:refimpl
  GenAI-Security-Project/agent-control-standard#543 · Filter by author rocklambros opened on Nov 10, 2026

• Identity descriptors: align with RFC 9493, add SPIFFE, and say how verification and Guardian identity reach the wire

  priority:P2scope:deferredstatus:acceptedtype:proposalworkstream:identity
  GenAI-Security-Project/agent-control-standard#540 · Filter by author rocklambros opened on Nov 10, 2026 · v0.2.0

• Identity docs: correct overstated claims in the overview and standards pages

  priority:P2scope:in-focusstatus:acceptedtype:docsworkstream:identity
  GenAI-Security-Project/agent-control-standard#539 · Filter by author rocklambros opened on Nov 10, 2026 · Spec and docs fixes for v0.1

• Capability and action vocabulary: registry, naming collision, core tool-call actions, resource URIs

  priority:P2scope:deferredstatus:acceptedtype:proposalworkstream:spec
  GenAI-Security-Project/agent-control-standard#538 · Filter by author rocklambros opened on Nov 10, 2026 · v0.2.0

• Intent: give immutability a mechanism, treat Intent as a wire type, and define goal-to-capability derivation

  priority:P2scope:deferredstatus:acceptedtype:proposalworkstream:spec
  GenAI-Security-Project/agent-control-standard#537 · Filter by author rocklambros opened on Nov 10, 2026 · v0.2.0

• Envelope and schema gaps: step id, ping result, SessionContext, payload limits, language tags, skill attestations

  priority:P2scope:deferredstatus:acceptedtype:proposalworkstream:spec
  GenAI-Security-Project/agent-control-standard#536 · Filter by author rocklambros opened on Nov 10, 2026 · v0.2.0

• Dispositions: one per-hook decision catalog, an ASK and DEFER contract, and one failure and error rule

  priority:P1scope:in-focusstatus:acceptedtype:bugworkstream:spec
  GenAI-Security-Project/agent-control-standard#535 · Filter by author rocklambros opened on Nov 10, 2026 · Spec and docs fixes for v0.1

• Define what a MODIFY replaces, starting with modified_content

  priority:P2scope:deferredstatus:acceptedtype:proposalworkstream:spec
  GenAI-Security-Project/agent-control-standard#534 · Filter by author rocklambros opened on Nov 10, 2026 · v0.2.0

• Handshake: declare MODIFY and ASK capability on the wire and tighten what the handshake negotiates

  priority:P2scope:deferredstatus:acceptedtype:proposalworkstream:spec
  GenAI-Security-Project/agent-control-standard#533 · Filter by author rocklambros opened on Nov 10, 2026 · v0.2.0

• Signatures: call HMAC a MAC, take the algorithm from the key, and cite composite ML-DSA

  priority:P2scope:in-focusstatus:acceptedtype:bugworkstream:spec
  GenAI-Security-Project/agent-control-standard#532 · Filter by author rocklambros opened on Nov 10, 2026 · Spec and docs fixes for v0.1

• Specify or drop the Guardian's two-layer decision path and the OPA/Rego binding

  priority:P2scope:deferredstatus:acceptedtype:proposalworkstream:spec
  GenAI-Security-Project/agent-control-standard#531 · Filter by author rocklambros opened on Nov 10, 2026 · v0.2.0

• Explain authorization paradigms as optional policy styles, and fix the ACS in Action example

  priority:P2scope:in-focusstatus:acceptedtype:docsworkstream:spec
  GenAI-Security-Project/agent-control-standard#530 · Filter by author rocklambros opened on Nov 10, 2026 · Spec and docs fixes for v0.1
  1

  

• Editorial pass on the Instrument specification and the trust concept pages

  priority:P2scope:in-focusstatus:acceptedtype:docsworkstream:spec
  GenAI-Security-Project/agent-control-standard#529 · Filter by author rocklambros opened on Nov 10, 2026 · Spec and docs fixes for v0.1

• Docs framing: state who ACS is for, name the Inspect tradeoff, and fix pillar and nav names

  priority:P2scope:in-focusstatus:acceptedtype:docsworkstream:docs
  GenAI-Security-Project/agent-control-standard#528 · Filter by author rocklambros opened on Nov 10, 2026 · Spec and docs fixes for v0.1

• acs-example-guardian keeps nonce state but never rejects a repeated nonce (10.3 SHOULD)

  Bug

  GenAI-Security-Project/agent-control-standard#524 · Filter by author simin-yuan opened on Nov 9, 2026

• acs-example-guardian crashes on import on Windows, and its secret-file check cannot pass there

  status:needs-triagetype:bug
  GenAI-Security-Project/agent-control-standard#523 · Filter by author simin-yuan opened on Nov 9, 2026

• [Conformance] Tool-call trace spans are dropped by a GenAI backend: no gen_ai.operation.name, span name is not execute_tool

  status:needs-triagetype:conformance
  GenAI-Security-Project/agent-control-standard#520 · Filter by author glanitcom opened on Nov 7, 2026

• Reference adapter follow-ups from the PR #22 review

  scope:in-focusstatus:accepted
  GenAI-Security-Project/agent-control-standard#509 · Filter by author rocklambros opened on Nov 5, 2026 · Reference adapters on main (Claude Code, Cursor, NAT)
  

• [Bug] Trace mapping leaves the session and message attributes underspecified

  status:acceptedtype:bugworkstream:spec
  GenAI-Security-Project/agent-control-standard#503 · Filter by author bar-capsule opened on Nov 5, 2026
  

• [Bug] Memory writes and reads carry no lineage across sessions, so stored untrusted content reads back as trusted recall

  GenAI-Security-Project/agent-control-standard#501 · Filter by author drk-ram opened on Nov 4, 2026
  1

• [Bug] The policy cannot see who sent a step

  status:needs-triagetype:bug
  GenAI-Security-Project/agent-control-standard#493 · Filter by author President opened on Nov 3, 2026

• [Bug] The Guardian denies a tool call when mapping.yaml names no argument for the tool

  status:needs-triagetype:bug
  GenAI-Security-Project/agent-control-standard#492 · Filter by author President opened on Nov 3, 2026
  1

• [Bug] subagentStart accepts a spawn with no intent, a derivation that cites no parent, and a child session id equal to the parent's, and only inherit_subset has a capability ceiling

  GenAI-Security-Project/agent-control-standard#474 · Filter by author drk-ram opened on Nov 3, 2026

• [Bug] The egress annotator judges the first URL in a command, so an allowlisted URL in a header or option value hides the real destination

  GenAI-Security-Project/agent-control-standard#470 · Filter by author drk-ram opened on Nov 3, 2026

• [Bug] The reference Guardian allows a call whose policy-target argument is not a string, and redacts only the first output of a result

  GenAI-Security-Project/agent-control-standard#469 · Filter by author drk-ram opened on Nov 3, 2026