📋 RFC: TealTiger v1.4.0 — Zero-Config Adoption, A2A Governance & EU AI Act Compliance

[nagasatish007]

📋 RFC: TealTiger v1.4.0 — What's Coming Next

We're sharing our v1.4 roadmap for community feedback. This is a Request for Comments — we want your input on priorities, missing features, and what matters most for your use case.

Target: Q3 2026
Theme: Zero-Config Adoption, Protocol Governance (MCP + A2A), EU AI Act Compliance

---

🎯 The Big Ideas

1. Zero-Config Entry Point (observe())

One line to get instant visibility into your AI agents — no policies, no configuration:

from tealtiger import observe
client = observe(openai)  # That's it. Cost tracked. Tools logged. PII detected.

Progressive path: Observe → Suggest → Enforce → Govern

2. A2A Protocol Governance (First-to-Market)

Google's A2A protocol is GA with 50+ enterprise partners — but has no built-in security layer. TealTiger v1.4 adds:

• Agent-to-agent message policy enforcement
• Agent Card verification (capability allowlisting)
• Cross-agent delegation governance
• Unified MCP + A2A governance in a single policy DSL

3. MCP Security (In-Process, <5ms)

• Per-identity grants (TealGrant) — scoped access per agent/user
• Tool auto-discovery and catalog (TealCatalog)
• Argument-level policy conditions (regex, range, pattern matching)
• Human approval workflows (TealApproval)
• Pre-built policy packs (Stripe, AWS, GitHub, Postgres, Slack, Supabase)

4. Framework Adapters (≤5 lines)

First-class packages for:

• langchain-tealtiger (P0)
• langgraph-tealtiger (P0)
• crewai-tealtiger (P1)
• autogen-tealtiger (P1)
• llamaindex-tealtiger (P2)

Each works in dual mode: zero-config (observe) or policy-driven (enforce).

5. EU AI Act Runtime Compliance

High-risk obligations activate August 2, 2026. TealTiger v1.4 ships:

• Pre-built EU AI Act policy pack (Articles 8-17 mapped to modules)
• Automated compliance evidence generation
• NIST AI RMF alignment
• tealtiger.compliance.enable('eu-ai-act') — one line

6. TEEC v2.1 — Execution Receipts

Evolved evidence contract with:

• Decision validity, expiry, and supersession
• JCS canonicalization for deterministic hashing
• Receipt invalidation on argument mutation
• REVISE decision route (in addition to ALLOW/DENY/REQUIRE_APPROVAL)
• Action sequence scoring (detect kill chains across multiple actions)

7. NVIDIA Ecosystem Integration

• NeMo Guardrails integration (probabilistic safety + deterministic governance)
• NIM governance adapter (TealNIM)
• TensorRT-accelerated TealClassifier (<2ms GPU inference)

---

🗳️ We Want Your Feedback

1. What's most important to you? Which features would you use first?
2. What's missing? Any governance scenarios we haven't covered?
3. Framework priority? Which adapter do you need most urgently?
4. A2A governance — are you deploying A2A in production? What governance gaps do you see?
5. EU AI Act — are you affected by the August 2 deadline? What compliance evidence do you need?
6. Policy packs — which MCP servers should we prioritize policy templates for?

---

📐 Architecture Constraints (Non-Negotiable)

All v1.4 features MUST be:

• In-process — no external service dependency
• <5ms overhead — deterministic, no LLM in governance path
• Zero network hop — no proxy, no sidecar required
• Offline capable — works air-gapped

---

🔗 Links

• Current v1.3 release: npm | PyPI
• OWASP Agentic Top 10 coverage: zero-config policy pack
• NVIDIA Inception member
• Contributing: CONTRIBUTING.md

---

How to Contribute to v1.4

• 💬 Comment on this discussion with feedback
• 🐛 Open issues for specific feature requests
• 🔧 Pick up a "good first issue" to start contributing
• 📝 Help write policy packs for MCP servers you use

---

Drop a 👍 on the features you want most, or comment with what's missing.