AgentTrust tests whether AI agents stay inside their declared capabilities

Red Hat’s Emerging Technologies group has published AgentTrust, an open-source framework for checking whether an AI agent’s observed behavior matches the capabilities it declares. The project targets a weak point in multi-agent systems: discovery documents such as Agent2Agent agent cards tell other agents what a service claims it can do, but do not enforce that boundary.

The work is explicitly experimental. Red Hat says Emerging Technologies projects are upstream, pre-product efforts and are not supported offerings or commitments to a future product. The public repository is Apache-2.0 licensed, has no published release, and currently describes a Python command-line pipeline rather than a production policy-enforcement layer.

How the audit works

AgentTrust reads an agent’s capability card and generates three classes of synthetic requests: in-scope tasks the agent should accept, clearly out-of-scope tasks it should reject, and “near-miss” requests that share vocabulary with the declared skill but fall outside it. Red Hat’s example distinguishes a current-weather lookup from a request for historical snowfall: both concern weather, but only the first fits the declared capability.

Each answer receives a compliance score from an LLM judge. For instrumented agents, AgentTrust can also query MLflow traces to see which tools ran. That second signal is important because a polite refusal can hide undeclared tool activity, while an apparently useful answer can come from model memory instead of the live data source implied by the capability contract.

The framework builds a behavioral baseline from tools invoked during valid probes. It then flags three patterns: scope leakage, where an agent handles work outside its contract; behavioral-textual divergence, where its response and tool activity disagree; and parametric override, where it skips expected tools and answers from model knowledge. Infrastructure failures are excluded from behavioral scoring.

What teams can try now

The repository README requires Python 3.11 or newer, uv, and a running A2A agent. A basic run invokes agenttrust pipeline against an agent URL; MLflow trace checking is optional. The default pipeline generates five probes per scope and reports a weighted trust score, with configuration for the generator model, judge model, timeouts and an alignment threshold.

The design is useful as an audit pattern, but it does not remove the need for judgment. Red Hat notes that an LLM evaluating another LLM can share its failure modes, and that baselines become difficult for agents with many tools or rarely exercised capabilities. The current implementation also focuses on single-turn interactions and post-hoc auditing. Runtime interception is described as a next step, not a feature available today.

For platform teams evaluating agent-to-agent delegation, AgentTrust offers a concrete way to test capability claims against traces instead of trusting metadata alone. Its immediate value is evidence gathering; whether the scoring remains reliable under adversarial behavior and complex tool sets is still an open question.