Agent Contracts
in Production

This website is maintained by 7 OSSA-defined agents. Real manifests, real autonomy levels, real governance. Not a demo — the proof.

Every agent below has an OSSA manifest that defines its identity, capabilities, autonomy level, and governance rules. They run as GitLab CI/CD jobs. They create merge requests, file issues, update content, and validate links — all without human intervention.

This is what we mean by “the contract layer.” The manifest is the contract. It says what the agent can do, how autonomous it is, and what oversight applies. Change the manifest, change the behavior. Move the manifest, move the agent.

Real Manifest

This Is What an Agent Contract Looks Like

The SEO Optimizer agent that monitors this website. Every field is part of the OSSA specification.

spec/v0.5/agent.schema.jsonDownload ↗

{   "$schema": "http://json-schema.org/draft-07/schema#",   "$id": "https://openstandardagents.org/schemas/v0.5/agent.schema.json",   "title": "OSSA v0.5 Agent Manifest Schema",   "type": "object",   "required": ["apiVersion", "kind", "metadata"],   "properties": {     "apiVersion": {       "type": "string",       "pattern": "^ossa/v(0\.5|0\.4|1).*$",       "examples": ["ossa/v0.5", "ossa/v0.4.9", "ossa/v1"]     },     "kind": {       "type": "string",       "enum": ["Agent", "Task", "Workflow", "Flow"],       "description": "Resource type: Agent (agentic loops), Task (steps),
                      Workflow (composition), or Flow (streaming)"     },
    "metadata": {       "type": "object",       "required": ["name"],       "properties": {         "name":    { "type": "string", "pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?$", "maxLength": 253 },         "version": { "type": "string", "description": "Semantic version (semver 2.0.0)" },         "description": { "type": "string", "maxLength": 2000 },         "labels":  { "type": "object", "additionalProperties": { "type": "string" } },         "status":  { "type": "string", "enum": ["active", "deprecated", "revoked"] },         "x-signature": {           "type": "object",           "description": "Cryptographic signature for NIST CAISI identity alignment",           "properties": {             "type":      { "enum": ["Ed25519", "RSA-PSS", "ECDSA", "jwt", "vc", "did"] },             "value":     { "type": "string", "description": "Base64 encoded signature" },             "publicKey": { "type": "string" },             "issuer":    { "type": "string", "description": "DID or URI of signing entity" }           }         },         "identity": { "$ref": "#/definitions/AgentIdentity" },         "agentType": {           "enum": ["claude", "kagent", "openai", "langchain", "crewai",                    "autogen", "agentscope", "pydantic-ai", "custom"]         },         "agentKind": {           "enum": ["assistant", "orchestrator", "worker", "coordinator",                    "supervisor", "tool", "reviewer", "planner"]         }       }     },
    "security": {       "$ref": "#/definitions/SecurityPosture",       "description": "v0.4.7+ — threat model, capabilities, sandboxing"     },     /* SecurityPosture definition: */     "SecurityPosture": {       "properties": {         "tier": { "enum": ["tier_1_read","tier_2_write_limited","tier_3_write_elevated","tier_4_system_admin"] },         "threat_model": [{           "category": "prompt-injection | data-exfiltration | privilege-escalation | ...",           "severity": "critical | high | medium | low",           "mitigations": ["input-validation", "output-filtering", "rate-limiting"]         }],         "capabilities": {           "required": ["filesystem-read", "network-outbound", "tool-execution"],           "optional": ["browser", "database-read", "agent-spawn"]         },         "sandboxing": {           "required": true,           "type": "container | vm | wasm | process | none",           "resource_limits": { "max_memory_mb": 512, "max_cpu_cores": 1, "max_execution_seconds": 120 }         },         "data_classification": "public | internal | confidential | restricted",         "audit": { "log_inputs": false, "log_outputs": false, "log_tool_calls": true }       }     },
    "protocols": {       "$ref": "#/definitions/ProtocolDeclarations",       "description": "v0.4.7+ — MCP, A2A, ANP interoperability"     },     /* ProtocolDeclarations definition: */     "ProtocolDeclarations": {       "properties": {         "mcp": {           "mode": "server | client | both",           "server_url": "http://localhost:4200",           "tools": ["duadp_discover", "duadp_search", "duadp_publish_agent"],           "version": "0.1.8"         },         "a2a": {           "agent_card_url": "https://example.com/.well-known/agent.json",           "trust_level": "public | internal | trusted",           "capabilities": ["text-generation", "tool-use", "multi-turn"],           "streaming": true         },         "anp": {           "did_document_url": "https://example.com/.well-known/did.json",           "supported_methods": ["did:web", "did:key"]         }       }     },
    "governance": {       "$ref": "#/definitions/Governance",       "description": "Cedar policies, compliance, autonomy, HITL"     },     /* Governance definition: */     "Governance": {       "properties": {         "cedar_policies": {           "policy_set_url": "https://compliance.blueflyagents.com/api/v1/cedar/catalog",           "evaluate_before_execution": true,           "confidence_threshold": 85         },         "compliance": {           "frameworks": ["SOC2", "HIPAA", "NIST-AI-RMF", "GDPR", "FedRAMP"],           "data_residency": "us-east-1",           "audit_trail": true         },         "autonomy": {           "level": "L1 | L2 | L3",           "approval_required": ["delete_operations", "config_changes"],           "human_in_loop": { "channels": ["gitlab_mr", "slack"] }         }       }     },
    "cognition": {       "$ref": "#/definitions/Cognition",       "description": "v0.5.0 draft — reasoning, trace, confidence"     },     /* Cognition definition: */     "Cognition": {       "properties": {         "reasoning_pattern": "ReAct | CoT | ToT | MCTS | plan-and-solve | reflection",         "max_reasoning_steps": 10,         "trace": {           "enabled": true,           "include_thoughts": true,           "retention_policy": "7d"         },         "confidence": {           "method": "cisc",           "threshold_auto_approve": 90,           "threshold_human_review":  50,           "threshold_reject": 30         }       }     },
  }
}

apiVersion / kind

API Version & Kind

Declares the OSSA spec version and resource type (Agent, Task, Workflow, Flow). Backward-compatible from v0.2 to v0.5.

Full JSON Schema ↗·Spec Explorer →

Why Contracts, Not Scripts

A CI/CD script runs code. An agent contract declares what the agent is, what it can do, and what oversight applies.

Traditional: Script

# run-seo-check.sh
curl https://site.com/sitemap.xml
python3 check_meta_tags.py
python3 update_sitemap.py
echo "Done" | slack-notify

✗No identity — who owns this?
✗No governance — what can it delete?
✗No cost controls — how much can it spend?
✗Not portable — locked to this CI system

OSSA: Contract

# manifest.ossa.yaml
metadata:
  name: seo-optimizer
  version: 1.2.0
spec:
  autonomy: { level: L2 }
  tools: [http, file, search]
  constraints: { max_daily_tokens: 50000 }

Identity — versioned, labeled, discoverable
Governance — autonomy levels, approval gates
Cost controls — token budgets, timeouts
Portable — move to any platform, same contract

The Fleet

7 agents maintaining this website. Each one defined by an OSSA contract.

SEO Optimizer

Active

Monitors page metadata, generates sitemaps, optimizes content for search engines.

AutonomyL2 — Conditional

Toolshttp, file, search

Triggerschedule: daily

View Manifest →

Content Curator

Active

Scans ecosystem for new frameworks, creates integration guides, files GitLab issues.

AutonomyL2 — Conditional

Toolshttp, code, search

Triggerschedule: weekly

View Manifest →

Blog Author

Active

Generates blog posts from CHANGELOG updates and spec changes, creates merge requests.

AutonomyL2 — Conditional

Toolshttp, file, code

Triggerevent: release

View Manifest →

Example Generator

Active

Creates example manifests for new frameworks, validates schemas, updates examples.json.

AutonomyL3 — High

Toolshttp, file, code, database

Triggerevent: new_framework

View Manifest →

Link Checker

Active

Crawls website for broken links, creates GitLab issues for 404s and timeouts.

AutonomyL1 — Suggest

Toolshttp

Triggerschedule: daily

View Manifest →

Docs Validator

Active

Keeps documentation in sync with spec changes, flags outdated sections, validates examples.

AutonomyL2 — Conditional

Toolshttp, file, search

Triggerevent: spec_update

View Manifest →

Analytics Reporter

Active

Generates weekly analytics reports on traffic, agent activity, and user engagement.

AutonomyL1 — Suggest

Toolshttp, database

Triggerschedule: weekly

View Manifest →

Autonomy levels: L1 = suggest only (human approves all), L2 = conditional (human approves risky actions), L3 = high (human notified).

The Normative Schema

The OSSA specification is enforced by a comprehensive JSON Schema. This ensures every agent manifest is valid, portable, and compliant with the standard.

ossa-0.4.9.schema.json

Download Full Schema →

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "$id": "https://openstandardagents.org/schemas/ossa-0.4.9.schema.json",
  "title": "OSSA Agent Manifest",
  "description": "Validation schema for Open Standard Agents (OSSA) manifests",
  "type": "object",
  "required": ["apiVersion", "kind", "metadata", "spec"],
  "properties": {
    "apiVersion": {
      "type": "string",
      "enum": ["ossa.ai/v0.4", "ossa/v0.4.9", "ossa/v0.4", "ossa/v0.3", "ossa/v0.2"],
      "description": "The OSSA API version"
    },
    "kind": {
      "type": "string",
      "enum": ["Agent", "AgentGroup", "Capability", "Tool"],
      "description": "The type of OSSA resource"
    },
    "metadata": {
      "type": "object",
      "required": ["name", "version"],
      "properties": {
        "name": { "type": "string", "pattern": "^[a-z0-9-]+$" },
        "version": { "type": "string", "pattern": "^\\d+\\.\\d+\\.\\d+(-[a-z0-9.]+)?$" },
        "description": { "type": "string" },
        "labels": { "type": "object", "additionalProperties": { "type": "string" } },
        "annotations": { "type": "object", "additionalProperties": { "type": "string" } }
      }
    },
    "spec": {
      "type": "object",
      "required": ["identity"],
      "properties": {
        "identity": {
          "type": "object",
          "required": ["name", "role"],
          "properties": {
            "name": { "type": "string" },
            "role": { "type": "string" },
            "avatar": { "type": "string" }
          }
        },
        "llm": {
          "type": "object",
          "properties": {
            "provider": { "type": "string" },
            "model": { "type": "string" },
            "temperature": { "type": "number", "minimum": 0, "maximum": 2 },
            "max_tokens": { "type": "integer", "minimum": 1 }
          }
        },
        "tools": {
          "type": "array",
          "items": { "type": "object", "required": ["type", "name"] }
        },
        "autonomy": {
          "type": "object",
          "properties": {
            "level": { "type": "string", "enum": ["L1", "L2", "L3"] },
            "approval_required": { "type": "array", "items": { "type": "string" } }
          }
        },
        "constraints": {
          "type": "object",
          "properties": {
            "cost": { "type": "object" },
            "performance": { "type": "object" }
          }
        },
        "observability": {
          "type": "object",
          "properties": {
            "logging": { "type": "object" },
            "metrics": { "type": "object" },
            "tracing": { "type": "object" }
          }
        }
      }
    }
  }
}

This schema is normative. It defines the structure and constraints for all OSSA-compliant agents.

From Manifest to Execution

How an OSSA contract becomes a running agent

Step 1Write manifest.ossa.yaml

Identity, role, tools, autonomy, constraints

Step 2Validate against OSSA schema

ossa validate manifest.ossa.yaml

GitLab CI/CDSchedule trigger

KubernetesCronJob

Any CI/CDSame manifest

Step 4Agent executes within contract boundaries

Autonomy enforced · Costs tracked · Actions logged

Recent Activity

Live

Loading agent activity...

Define Your First Agent Contract

Install the CLI, write a manifest, validate it. The contract is the starting point.

Get Started Agent Examples View Source

Agent Contractsin Production

This Is What an Agent Contract Looks Like

API Version & Kind

Why Contracts, Not Scripts

Traditional: Script

OSSA: Contract

The Fleet

SEO Optimizer

Content Curator

Blog Author

Example Generator

Link Checker

Docs Validator

Analytics Reporter

The Normative Schema

From Manifest to Execution

Recent Activity

Define Your First Agent Contract

Agent Contracts
in Production