---
type: analysis
slug: research-safe-is-an-incident-compact-not-a-flight-recorder-protocol
title: "SAFE is an incident compact, not a flight-recorder protocol"
description: "The Open Secure AI Alliance’s SAFE proposal tells members which forensic evidence to keep after agent incidents. It does not yet bind tool calls, approvals, and committed artifacts the way ACTA, Agent Receipts, and Microsoft AGT try to do at runtime."
published_at: 2026-10-26T01:00:00.000Z
topics: ["governance","prompts","research"]
source_urls: ["https://raw.githubusercontent.com/OpenSecureAIAlliance/RFCs/main/rfc-safe-proposal.md","https://www.linuxfoundation.org/blog/proposing-the-safe-working-group-an-open-community-effort-to-improve-ai-security","https://www.linuxfoundation.org/blog/open-secure-ai-alliance-joins-the-linux-foundation-to-build-a-shared-open-defense-stack-for-the-ai-era","https://secureaialliance.org/","https://github.com/OpenSecureAIAlliance/wg-safe/issues/5","https://github.com/OpenSecureAIAlliance/wg-safe/issues/53","https://github.com/OpenSecureAIAlliance/wg-safe/issues/54","https://www.axios.com/2026/08/11/open-source-security-ai-agent-reporting","https://techcrunch.com/2026/08/04/nvidia-doesnt-mess-around-a-week-after-open-ai-industry-group-formed-its-already-showing-progress/","https://blogs.nvidia.com/blog/open-secure-ai-alliance-contributions/","https://datatracker.ietf.org/doc/draft-farley-acta-signed-receipts/","https://agentreceipts.ai/spec/v0.5.0/","https://microsoft.github.io/agent-governance-toolkit/specs/AUDIT-COMPLIANCE-1.0/","https://microsoft.github.io/agent-governance-toolkit/packages/agent-lightning/","https://raw.githubusercontent.com/microsoft/agent-governance-toolkit/main/docs/proposals/verifiable-compliance-receipts.md","https://github.com/OpenSecureAIAlliance/wg-safe/issues","https://github.com/OpenSecureAIAlliance/RFCs","https://github.com/OpenSecureAIAlliance/wg-safe","https://github.com/OpenSecureAIAlliance/wg-safe/issues/62"]
author: "Andrey Reshetnikov"
author_profile: https://newruntime.com/owner-profile.md
---
SAFE, the Shared AI Findings Exchange, is the first major RFC from the Open Secure AI Alliance. On 4 August 2026 the Linux Foundation opened comments on a draft written with NVIDIA, Cisco, CrowdStrike, Hugging Face, Red Hat and other members. Participating operators would report unauthorized third-party access, sandbox or policy escapes, confidential-data exposure, and continued probing after the operator suspects the activity is out of scope, then preserve forensic evidence and turn recurring failures into shared controls. Axios and TechCrunch placed the launch at Black Hat, with more than 120 organizations in the alliance.

The newsroom asked whether this strengthens external flight recorders for AI agents, and whether SAFE captures the accepted result of an action rather than a log of attempted tools. That distinction matters because many products now market themselves as flight recorders, while a separate stack of receipt drafts tries to make authorization and outcomes independently verifiable. If SAFE is treated as a recorder format, teams will under-build runtime evidence. If it is treated only as a press release, they will miss a membership duty that assumes they already keep traces, approvals, and artifacts.

## What we checked

- **How SAFE binds tool-call telemetry, approval, validation and the final native artifact, and how that differs from ACTA, Agent Receipts and Microsoft AGT** partly confirmed. SAFE is a cross-organization incident-learning compact, not a runtime receipt protocol. The RFC lists prompts, traces, tool calls, approvals, and files or external artifacts as evidence to preserve, but specifies no cryptographic or schema binding among them. ACTA signs access decisions, Agent Receipts bind an action to an outcome hash, and AGT records in-process audit and flight-recorder spans; open working-group issues argue that proposal-to-commit binding is still missing. [1][7][11][12][13]
- **SAFE records the accepted result of an agent action, not only the actions attempted** partly confirmed. The Evidence Preservation list includes files and external artifacts created or modified, plus human approval and intervention events, so the intended forensic set is broader than a tool-call log. The RFC does not define how to prove that a retained artifact is the authorized, committed result of a specific approved action. Open issue 54 proposes an explicit chain from proposal through authorization and commit to the external side effect. [1][7][6]
- **SAFE is a drop-in flight-recorder SDK or product that operators install in agent runtimes** refuted. Linux Foundation and NVIDIA posts, the alliance site, and the RFC describe SAFE as a Shared AI Findings Exchange for confidential incident reporting and shared controls. The flight-recorder language in Axios is NVIDIA’s Justin Boitano analogizing the agent harness, not a SAFE software artifact. [2][10][4][8]
- **SAFE is an operational incident exchange with live reporting and legal safe harbor** refuted. As of sources opened on 23 October 2026, SAFE remains a draft RFC plus an active GitHub working-group discussion, with issues still open after mid-October. Axios reported that the proposal has no formal safe-harbor protections. No primary page documents a live intake endpoint or published incident catalog. [3][16][8]

## What we found

- SAFE’s stated mission is to confidentially collect and analyze AI incidents and near misses, notify affected parties, and convert recurring failures into evidence-based controls. Proposed membership spans model developers, deployers, cloud and tool providers, researchers, critical-infrastructure operators, and civil society, with governments as non-controlling observers. The alliance site still points readers to the RFC rather than to a reporting console. A 14 September 2026 Linux Foundation announcement moved the alliance under Foundation governance and still described SAFE as an RFC initiative. [1][2][3][4]
- The RFC’s Evidence Preservation section requires prompts, traces, tool calls, logs, configurations, model and safeguard versions, identities, permissions and credentials available during the run, human approval and intervention events, files and external artifacts created or modified, detection and recovery events, a complete incident timeline, and reproduction evidence. That is a forensic shopping list, not a record format. Members must also file a preliminary control-failure analysis within 30 days and report near misses. Notification runs from ASAP notice to the affected organization, a confidential SAFE report in four business days, and remediation status at 90 days. Working-group issues 5, 53 and 54 show the list is still being argued: OpenTelemetry is proposed as a baseline transport, while reviewers say preserving available permissions does not reconstruct why a specific action wa [1][5][6][7]
- Linux Foundation compared SAFE to NASA’s Aviation Safety Reporting System: voluntary, confidential, and oriented to learning rather than blame. Axios quoted NVIDIA vice president Justin Boitano saying the harness with visibility into everything the agent is doing is the flight recorder, and that experts need those recorders after accidents. Those are two different objects. SAFE is the sharing system; the recorder is whatever harness, telemetry, or receipt stack the operator already runs. Axios also reported that the proposal has no formal safe harbor for voluntary disclosure. TechCrunch described the early guidelines as confidential reporting, affected-party alerts, and blame-free analysis rather than new technology. [2][8][9][10]
- IETF individual draft-farley-acta-signed-receipts-03 (29 August 2026) defines portable Ed25519-signed decision receipts for machine-to-machine access control, aimed at MCP tool invocation. An access-decision receipt records tool name, decision (allow, deny, rate_limit, or require_approval), and an optional policy digest. Section 9.8 states that a decision receipt attests policy evaluation, not that the action executed, succeeded, or returned a particular result; a post-execution receipt is a separate artifact. Optional payload_digest can hash associated tool input or output, but the spec forbids embedding raw prompts or arguments. Microsoft AGT is listed as a consumer of Acta receipts, not a signer. [11]
- Agent Receipts Protocol v0.5.0 (9 June 2026) is a W3C Verifiable Credential for a single action taken on behalf of a principal. Required fields include action type, risk level, timestamp, and an outcome status of success, failure, or pending. Optional state_change hashes bind before and after state; optional response_hash commits to the server response after redaction. Authorization scopes and grant_ref are optional. The spec states that receipts live in a separate log, not attached to action outputs, and that DID resolution is not fully specified in this version. [12]
- Microsoft’s Agent Governance Toolkit Audit and Compliance spec 1.0-DRAFT defines a Flight Recorder as a circular buffer of recent agent activity in Agent Lightning, convertible to spans for policy checks, signals, and tool calls. Agent Mesh audit entries can carry an outcome field and optional approver_did, arguments_hash, and issued_at/completed_at, but those additive fields are not in the v1.0 canonical hash. A 21 April 2026 proposal, still marked draft as of 23 September 2026, adds independently verifiable compliance receipts with a pre-execution authorizationHash and a post-execution resultHash. AGT is a runtime governance toolkit, not an industry incident exchange. [13][14][15]

## What it means

Builders should split three layers. SAFE, if they join, is a reporting and evidence-retention duty after incidents, modeled on aviation safety reporting, not a control plane. Runtime proof still has to be built in the harness: a non-bypassable authorize-then-commit gate, signed decision records for allow, deny, and require_approval, and a post-execution receipt or hash that binds the native artifact that was actually accepted. ACTA is the closest public spec for the decision half; Agent Receipts and AGT’s resultHash proposal are the closest for the outcome half; OpenTelemetry is a transport, not a substitute for those bindings. Do not buy or build a flight recorder that only streams tool calls. If SAFE later adopts the proposal-authorization-commit chain argued in issues 53 and 54, members who already emit that evidence will be able to report; members who only have traces will not.

## Still open

- Whether the Alliance will make proposal-authorization-commit-consequence normative in the RFC rather than leaving it as an open issue.
- Whether a live confidential intake or published control catalog exists after the comment period; none was documented on the primary pages opened.
- How SAFE will interoperate with ACTA, Agent Receipts, and AGT instead of adding a fourth evidence schema.
- Whether any safe-harbor or liability treatment will appear; Axios reported none in the current proposal.

## Sources

1. [Shared AI Findings Exchange (SAFE) RFC](https://raw.githubusercontent.com/OpenSecureAIAlliance/RFCs/main/rfc-safe-proposal.md) (primary)
2. [Proposing the SAFE Working Group: An Open Community Effort to Improve AI Security](https://www.linuxfoundation.org/blog/proposing-the-safe-working-group-an-open-community-effort-to-improve-ai-security) (primary)
3. [Open Secure AI Alliance Joins the Linux Foundation](https://www.linuxfoundation.org/blog/open-secure-ai-alliance-joins-the-linux-foundation-to-build-a-shared-open-defense-stack-for-the-ai-era) (primary)
4. [Open Secure AI Alliance home](https://secureaialliance.org/) (primary)
5. [Specify a machine-readable baseline for Evidence Preservation (OpenTelemetry)](https://github.com/OpenSecureAIAlliance/wg-safe/issues/5) (primary)
6. [Add runtime authorization / commit as a first-class review layer](https://github.com/OpenSecureAIAlliance/wg-safe/issues/53) (primary)
7. [Preserve authorization and commit provenance as incident evidence](https://github.com/OpenSecureAIAlliance/wg-safe/issues/54) (primary)
8. [www.axios.com](https://www.axios.com/2026/08/11/open-source-security-ai-agent-reporting)
9. [techcrunch.com](https://techcrunch.com/2026/08/04/nvidia-doesnt-mess-around-a-week-after-open-ai-industry-group-formed-its-already-showing-progress/)
10. [AI Leaders Propose SAFE Guidelines for Cybersecurity Transparency](https://blogs.nvidia.com/blog/open-secure-ai-alliance-contributions/) (primary)
11. [draft-farley-acta-signed-receipts-03](https://datatracker.ietf.org/doc/draft-farley-acta-signed-receipts/) (primary)
12. [Agent Receipts Protocol Specification v0.5.0](https://agentreceipts.ai/spec/v0.5.0/) (primary)
13. [AGT Audit and Compliance Specification 1.0-DRAFT](https://microsoft.github.io/agent-governance-toolkit/specs/AUDIT-COMPLIANCE-1.0/) (primary)
14. [microsoft.github.io](https://microsoft.github.io/agent-governance-toolkit/packages/agent-lightning/)
15. [raw.githubusercontent.com](https://raw.githubusercontent.com/microsoft/agent-governance-toolkit/main/docs/proposals/verifiable-compliance-receipts.md)
16. [SAFE working-group issues list](https://github.com/OpenSecureAIAlliance/wg-safe/issues) (primary)
17. [OpenSecureAIAlliance/RFCs repository](https://github.com/OpenSecureAIAlliance/RFCs) (primary)
18. [OpenSecureAIAlliance/wg-safe repository](https://github.com/OpenSecureAIAlliance/wg-safe) (primary)
19. [Define an Evidence Handling and Disclosure Profile](https://github.com/OpenSecureAIAlliance/wg-safe/issues/62) (primary)

Author: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Governance](https://newruntime.com/topics/governance.md): Explore the governance topic hub.
- topic hub: [Prompts](https://newruntime.com/topics/prompts.md): Explore the prompts topic hub.
- topic hub: [Research](https://newruntime.com/topics/research.md): Explore the research topic hub.
- collection: [Analysis](https://newruntime.com/analysis.json): Open the latest authorial analysis.
- collection: [Source Ledger](https://newruntime.com/source-ledger.json): Inspect the public source evidence graph.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)