[Audit] Charter Comments -- more specific on the scope?

["Liuchunchi(Peter)" <[e-mail]>]

Thanks Mirja and Henk for organizing the charter and the list

I took some time reading the proposed charter as well as the relevant designs. I have a few observations to share.

In practice, I see agent auditability is mostly conducted through hooks, which is a common technique used to monitor and take record of function calls and events. Surprisingly this has not yet been discussed on the list.

Both Openclaw and Hermes have hooks, so do many other proprietary implementations.

        https://github.com/openclaw/openclaw/blob/main/src/plugins/hook-types.ts
            https://github.com/NousResearch/hermes-agent/blob/main/hermes_cli/plugins.py

On one hand these could be draft input right away, on the other hand these are just the hooks needed on the agent runtime side, which is only one (however important) part of the visibility chain.  Getting how detailed behavioral information depends on how deep and how wide the hooks are implemented by important PEPs, like EDR/Sandbox/Gateway/RS or AS/User Inference Interfaces of many kinds.

As I currently reading the proposed charter, I see in the Deliverables Section : "One or more Standards Track RFC(s) that identify and reuse existing or specify new IETF data models that can represent audit information about agents and delegated systems ".

Given the vastly diverse scenarios of hook deployment, the difficulty of reconciling disparate data records into a single unified dataset is foreseeable. I see Orie had similar concerns. So I suggest at least consider identifying the first minimal set of important PEP/PDPs, which leads to first set of deliverable documents. Several necessary subparts could include Agent Runtime, Gateways (of many kinds), User Interfaces. Inside these documents, there should include topology of the call-chain, key execution or decisition making nodes, technology stack (especially at runtime), call input and outputs, so as to consolidate into minimally necessary record sets.

Just my two cents to help push this forward. I think this is useful work and hope to see it proceed. Let me know if you want me to share some of our practices on EDR and Gateways during any interim or future meetings.

Best,
Peter