Security

• Secrets
• Supply chain
• Tamper-evident audit
• Threat model

Governance in AWP is enforced by the runtime outside the model: an agent cannot change permissions, policies, budgets or approvals by producing text. Unknown fields, unsupported profiles, undeterminable regions and unverifiable digests lead to rejection or denial, never silent acceptance (fail closed).

Normative text: Security considerations.

Compliance

AWP provides machine-readable governance primitives that can help organizations implement and enforce their own compliance requirements. Compliance depends on the implementation, organizational controls and applicable regulatory requirements.