VOCE Agent Conformance · Shareable lens
Technology lens · A2
An architecture view of API contracts, MCP, A2A, workload identity and observability required for controllable agent execution.
Priority domains
Technology lens
An architecture view of API contracts, MCP, A2A, workload identity and observability required for controllable agent execution.
API & tool contracts5 applicable controls
MCP governance5 applicable controls
A2A & delegation0 applicable controls
Identity & workload trust4 applicable controls
Observability & audit5 applicable controls
Normative controls remain in English so the framework has one reference wording.
Applicable controls
19 applicable controls · 11 critical controls
API-01Machine-readable operation contractA1+ · major · documented→API-02Material-write idempotencyA2+ · critical · tested→API-03Version and deprecation policyA1+ · major · documented→API-04Transaction and rate limitsA2+ · critical · tested→API-05Error and exception contractA1+ · standard · tested→MCP-01MCP server inventoryA1+ · major · documented→MCP-02Tool-level authorizationA1+ · critical · tested→MCP-03Resource boundary enforcementA1+ · critical · tested→MCP-04Tool revocationA2+ · critical · tested→MCP-05Protocol and extension controlA1+ · major · documented→ID-01Unique workload identityA2+ · critical · verified_in_operation→ID-02Short-lived credentialsA2+ · critical · tested→ID-03Human-to-agent bindingA2+ · critical · verified_in_operation→ID-04Environment and trust-domain separationA2+ · major · tested→OBS-01End-to-end task traceA1+ · critical · verified_in_operation→OBS-02Model and version traceabilityA0+ · major · verified_in_operation→OBS-03Tool execution evidenceA1+ · critical · verified_in_operation→OBS-04Approval evidenceA2+ · critical · verified_in_operation→OBS-05Telemetry privacy policyA1+ · major · tested→
VOCE
This page describes a VOCE lens on the framework. It contains no private self-assessment data and is not an EU or ISO certification.