# AATS assurance and certification protocol (v0.9 draft)

## Independent decision

An AATS certificate requires a named, competent, independent assessor; a declared system scope and capability level; dated test results for all applicable normative requirements; an assessment decision; and a digitally signed certificate record. Self-assessment, a readiness score, and MC-1 technical verification are useful but are not an AATS certificate. The assessor signs the certification decision and retains authority to suspend, reinstate, or revoke it. A technical monitor can automatically impose a more restrictive state under the rules below; it cannot unilaterally restore independent certification after a critical failure.

## States and precedence

The public state is one of `ACTIVE`, `DEGRADED`, `REVIEW_REQUIRED`, `SUSPENDED`, or `REVOKED`. Precedence is `REVOKED` > `SUSPENDED` > `REVIEW_REQUIRED` > `DEGRADED` > `ACTIVE`; the most restrictive applicable condition wins. State must never be inferred from a numerical score.

| State | Entry condition | Action or exit |
|---|---|---|
| ACTIVE | Certificate is unexpired; all applicable critical controls pass; monitoring and evidence are current; no unresolved material change | Maintain continuous signals and periodic independent assessment |
| DEGRADED | Noncritical failure or evidence gap with bounded impact; critical controls remain verified | Publish reason and remediation deadline; restore only after evidence passes |
| REVIEW_REQUIRED | Material configuration change whose impact is not yet independently resolved, without known critical violation | Restrict affected consequential capability; assessor reviews changed scope |
| SUSPENDED | Critical control violation, unauthorized capability/tool, uncontained incident, or inability to verify a critical runtime control | Block consequential actions where possible; assessor approves reinstatement after remediation and retest |
| REVOKED | Expired, withdrawn, fraudulent, out-of-scope, or permanently invalid certification; assessor or issuer revokes | New independent assessment and certificate required |

`REVIEW_REQUIRED` is the wire value corresponding to the display label **REVIEW REQUIRED**. An implementation MUST emit a state event whenever effective state changes, including previous/new state, time, reason code, triggering control, evidence reference, verifier, and scope. For expiry and signature revocation, the state MUST change to `REVOKED` without waiting for a monitoring cycle. An unreachable monitor or expired critical evidence MUST NOT leave a certificate `ACTIVE`: use `SUSPENDED` if critical verification is unavailable, otherwise `DEGRADED`.

## Event and timing policy

The operator MUST publish a maximum detection, decision, enforcement, and registry propagation interval for each critical signal. For L3–L5 consequential actions, authorization and trust status MUST be checked on the action path. The registry MUST show its latest verification timestamp, and clients MUST enforce a maximum acceptable age appropriate to their risk. A state event is append-only and integrity protected; corrections are new events referencing the superseded event.

Material triggers include model/provider/prompt/policy changes, new or modified tools/MCP servers, permission or delegated authority changes, memory topology or retention changes, code changes affecting action paths, data-route changes, and new runtime environments. The operator classifies the change with documented reasoning. Unknown effect maps to `REVIEW_REQUIRED`; known critical breach maps immediately to `SUSPENDED`. Emergency change does not bypass this rule.

## Restoration

For `DEGRADED`, automated verification MAY restore `ACTIVE` if the original independent decision explicitly pre-authorized that control and the evidence proves the same scope. For `REVIEW_REQUIRED`, the independent assessor or delegated review process MUST approve the changed scope. For `SUSPENDED`, the independent assessor MUST review root cause, remediation, negative tests, and restored continuous monitoring before reinstatement. `REVOKED` requires a new certificate. Every restoration decision is logged and signed.

## Certificate and badge semantics

The public certificate MUST include a unique certificate ID, organization, named system or estate, class, level, exact scope hash, AATS version, assessor identity, issue and expiry dates, current state, latest verification time, and status endpoint. `AATS Certified` may be displayed only while an independently issued certificate is `ACTIVE`; a `DEGRADED` or `REVIEW_REQUIRED` state must be shown with qualification. `MC-1 Trust Verified` indicates technical continuous verification and has a different issuer and meaning. Neither badge may imply endorsement by NIST, ISO, OWASP, or another outside organization.

## Trust score

An optional 0–100 score may be used for readiness prioritization. The calculation MUST expose domain weights, control results, stale evidence penalty, missing data, and algorithm version. A critical failure forces a visible failure state regardless of score. Score and certificate state must be displayed as separate fields.