One of the assumptions behind CROA is that an AI agent should be able to propose actions, but should not be the final authority deciding whether those actions are allowed to change the state of a real system.
That sounds straightforward until you start looking at trajectories rather than individual actions.
Imagine an agent is allowed to expose up to 100 customer records. It performs three operations:
CROA is an open, vendor-neutral architecture for governing what AI agents can actually execute. Instead of relying on the agent to respect constraints, CROA separates intelligence from authority and constrains execution against registered invariants before state change. The public Pilot makes the approach reproducible: run it, inspect the evidence, and try to break the claim.
