docs: conformance is a technical measure — it cannot attest human intent

docs/spec/conformance.md

@@ -44,6 +44,14 @@ What "ACS-Core conformant" guarantees: the channel is authenticated and the Obse
 
 Who verifies a conformance claim: nobody, in v0.1.0. `profiles_supported` and `profiles_accepted` are self-declaration on the wire. This release ships no conformance test suite, no registry of conformant implementations, and no steward body to arbitrate a disputed claim. A deployment that advertises "ACS-Core conformant" is asserting that about itself, and a buyer who procures on that basis is trusting the implementer rather than a third party. Test the deployment against the requirements above the way you would check any other vendor claim. A conformance suite and the governance to operate it are tracked in [issue #19](https://github.com/GenAI-Security-Project/agent-control-standard/issues/19) and scoped to a later release.
 
+## Conformance does not establish human authorization
+
+ACS v0.1.0 conformance establishes the technical properties required by the claimed profile. It does not, by itself, attest asserted governance facts such as whether an Approver is human, whether that human contemporaneously authorized the action, or whether the Approver possessed valid institutional authority. A deployment whose policies were authored by automation and whose every ASK decision is answered by an automated service is fully conformant and produces a complete, intact audit chain. ACS can authenticate an approver credential and record a declared human approver — through `approver.type`, the handshake's `approver_types_supported` negotiation, and Guardian-verified approver identity ([§9](./instrument/specification.md#9-approver-model)) — without establishing contemporaneous human volition behind that credential; per [`trust.md`](../concepts/trust.md#invariants), a Guardian MUST NOT treat an asserted fact as attested. A conformant record may state that a human approved an action or that a delegation applied; conformance does not make those claims true, and verifying them requires a process outside this specification. At any tier, a deployment MUST NOT represent the fact of its ACS conformance, by itself, as satisfying a requirement for human authorization or institutional oversight, or as evidence that a human authorized a specific decision or act.
+
+Concretely, ACS conformance does not by itself satisfy governance or human-oversight outcomes defined elsewhere: NIST AI RMF GOVERN 2.1, 2.3, and 3.2 and MAP 3.5; MAESTRO's Layer 6 Security & Compliance governance surface; or OWASP LLM06:2025's recommendation that a human approve high-impact actions before execution. ACS can record evidence relevant to those processes; conformance does not substitute for them.
+
+Verifying that the bootstrap and any claimed delegation chain were authorized through an accountable process is deferred; see [§15 Out of Scope](./instrument/specification.md#15-out-of-scope-deferred).
+
 ## ACS-Trace
 
 Adds deterministic Trace event emission per [Trace Events](./trace/events.md). A deployment claiming ACS-Trace MUST:

docs/spec/instrument/specification.md

@@ -429,6 +429,7 @@ A liveness method is required for connection-health checks, transport-debugging,
 | Sensitivity / four-level timeout model | v0.2 | Categorization-from-facts is non-trivial; v0.1 uses a single handshake-negotiated default timeout |
 | Recursive ASK + quorum | v0.2 | Bounded delegation and tie-breaking need careful spec |
 | Multi-tenant isolation rules | v0.2 | Touches policy, SessionContext, audit, A2A |
+| Bootstrap authority and delegation-chain attestation | v0.2 | Whether Guardian policy, initial Intent, and Approver configuration were adopted through an accountable process, and whether a claimed human or institutional authority is backed by a documented delegation chain, is verified outside the protocol in v0.1. ASK intent-extension (§9.1) can widen `Intent.parsed` in-session but cannot create the source of that authority. The policy-author attestation profile (§16) is the first step; ACS-Trace and ACS-Audit can record the result where it exists |
 | `protocols/A2A/*` wrapping specification | v0.2 | A2A hook wrapping is reserved (namespace exists); detailed method mapping waits |
 | AgBOM federation across A2A peers | v0.2 | Single-agent AgBOM is in v0.1; federated views need an A2A-side discovery method first |
 | gRPC, unix_socket transports | v0.2+ | HTTP + stdio cover IDE/SaaS/on-prem in v0.1 |