Agent systems execute through runtimes with very different control points: local coding tools, framework SDKs, managed agent platforms, API gateways, and observer-only integrations. A high-risk action such as publishing data externally may therefore appear as a shell command in one runtime, a tool call in another, and a hosted session transition in a third. This makes it difficult to answer a basic governance question consistently: what action was authorized, under whose authority, with what approval semantics, and with what evidence after execution? This paper presents Proof-Carrying Agent Actions (PCAA), a runtime-neutral governance model centered on an action certificate rather than on a vendor-native session record. PCAA organizes control around five checkpoints: pre-action admissibility, action open, assumption capture, approval, and outcome closure. It binds these checkpoints to a portable action envelope, runtime and approval receipts, and replay-ready proof. The model is extended in two practical ways: the certificate is externality-aware, carrying boundary facts such as destination visibility and account provenance, and approval is described by explicit enforceability classes rather than by a single reviewed or unreviewed bit. We study the model through a reference implementation in a heterogeneous agent control plane and a disclosure-bounded evaluation protocol. On a protected benchmark expanded from 24 executable seeds to 96 traces across four runtime families, PCAA preserves route quality while exposing distinct failure modes under ablation. The paper contributes a systems formulation of runtime governance around certificate-bearing actions and an implementation-grounded account of how that formulation can remain portable under runtime churn without collapsing into vendor-specific control surfaces.

翻译：智能体系统通过具有截然不同控制点的运行时环境执行：本地编码工具、框架软件开发工具包、托管智能体平台、API网关以及仅可观测的集成方式。例如"向外部发布数据"这类高风险操作，可能在一种运行时中表现为Shell命令，在另一种中表现为工具调用，在第三种中表现为托管会话的状态转移。这使得难以一致地回答基础治理问题：什么行为被授权、由谁授权、采用何种批准语义、执行后有何种证据？本文提出证书化智能体行为（Proof-Carrying Agent Actions, PCAA），一种以行为证书而非厂商原生会话记录为核心的运行时中立治理模型。PCAA围绕五个检查点组织控制：行为前可接受性、行为开启、假设捕获、批准与结果闭合。它将这些检查点绑定到可移植行为信封、运行时与批准收据以及可重放证明上。该模型通过两种实用方式扩展：证书对外部性感知，携带目标可见性、账户来源等边界事实；批准通过显式的可执行性类别描述，而非简单的"已审查/未审查"二进制位。我们通过在异构智能体控制平面中的参考实现以及受披露约束的评估协议研究该模型。在从24个可执行种子扩展至跨四个运行时家族的96条轨迹的保护性基准测试中，PCAA在消融实验下暴露不同失效模式的同时保持路径质量。本文贡献了围绕证书化行为的运行时治理系统化表述，以及该表述如何在运行时更迭中保持可移植性而不陷入厂商特定控制面的实现落地分析。