A data system is an agentic dataset when these can be found in its implementation, not just in its documentation.
- It describes itself. A machine-readable descriptor states the dataset's identity, capabilities and prohibitions. A dataset without a well-formed descriptor takes no part in admission. (AD-001)
- Only what it advertises can run. Every executable action is a registered capability; an unregistered one is denied, never allowed by default. (AD-002, AD-006)
- It decides before anything runs. A control plane rules on each requested action before it executes: Approved, Refused or Indeterminate, each with a typed reason.
- Only approval grants authority. Execution requires an approval token, and only Approved mints one. After a refusal, or an unknown, there is nothing to execute with. (AD-003, AD-004, AD-005)
- Scope never widens. What was admitted is what runs: no wider at execution, through a cache, through a remote tool server, or in a handoff to another agent. (AD-007, AD-008, AD-013, AD-014)
- Every decision leaves evidence. Every decision gets an append-only, hash-chained record, refusals included. It names the descriptor clause, the dataset revision and the policy version that applied, and every result traces to what produced it. (AD-009 to AD-012)
- Prohibited means never. A prohibited action executes zero times, not rarely. (AD-015)
- It is checked by behavior, not wording. Each point above is checked through the public interface, without an LLM, by the absence of authority rather than the wording of a refusal. That means any implementation, in any framework, is checked the same way.
Refusal is not a message. Meeting these points is a claim an implementation makes about itself, made checkable. It is not a security guarantee.
The assertions cited are those of the behavioral contract in reference/CONFORMANCE.md, and its language-neutral vectors check them.
© 2026 Alexander Chernov. Documentation licensed CC BY 4.0.