grc.store

Search / finos-ccc/ccc.marefarc.cp / v2026.06-rc1

Release · v2026.06-rc1

FINOS-CCC/CCC.MARefArc.CP Capability Catalog

FINOS-CCC/CCC.MARefArc.CP

Capabilities for Multi-Agent Reference Architecture technologies, as defined by the FINOS Common Cloud Controls project.

Published by FINOS Common Cloud Controls

License No license declared

Install

OCI v1.1
$grcli unpack --repository finos-ccc/ccc.marefarc.cp --version v2026.06-rc1

grcli unpack verifies this signature against the recorded identity below and fails closed before writing any files — no separate verify step needed. Pass --no-verify to skip.

Coordinate
oci.grc.store/finos-ccc/ccc.marefarc.cp:v2026.06-rc1
Manifest digest
sha256:3a53ab746a0ef385ab1c02dc85b578de2d4ab88b0dff55e3a3f1e1e091b86b48
Signed by
no signature recorded

Identity recorded by this hub when the version was published; unpack (above) checks the signature against it.

Verify in CI — check the signature without downloading
$grcli verify --repository finos-ccc/ccc.marefarc.cp --version v2026.06-rc1

Read-only: downloads nothing and exits non-zero if the signature or the recorded identity doesn't match — use it as an admission/policy gate.

Provenance

1 layer
Digest Media type Size
c24923da2440… application/vnd.gemara.artifact.v1+yaml 8.9 KiB
Bundle config blob 
{
  "bundle-version": "1.0",
  "gemara-version": "v1.2.0",
  "metadata": {
    "provenance": {
      "buildDefinition": {
        "buildType": "https://grc.store/grcli/buildtype/v0",
        "externalParameters": {
          "artifact": {
            "id": "CCC.MARefArc.CP",
            "type": "CapabilityCatalog"
          },
          "target": {
            "registry": "oci.grc.store",
            "repository": "finos-ccc/ccc.marefarc.cp",
            "tag": "v2026.06-rc1"
          }
        },
        "internalParameters": {
          "CI": "true",
          "GITHUB_ACTIONS": "true",
          "GITHUB_ACTOR": "eddie-knight",
          "GITHUB_REF": "refs/heads/main",
          "GITHUB_REPOSITORY": "eddie-knight/common-cloud-controls",
          "GITHUB_RUN_ATTEMPT": "1",
          "GITHUB_RUN_ID": "27958837352",
          "GITHUB_SHA": "65b6844e7d4361034aac75cde94963f5e9d73820",
          "GITHUB_WORKFLOW": "Release Catalog",
          "RUNNER_OS": "Linux"
        },
        "resolvedDependencies": [
          {
            "name": "artifacts/ai-ml/multi-agent-refarch/capabilities.yaml",
            "uri": "file://artifacts/ai-ml/multi-agent-refarch/capabilities.yaml",
            "digest": {
              "sha256": "c24923da2440a40d8eae61388114a9aa4c550673176870f4f1e587a8ef02cf1b"
            }
          },
          {
            "name": "source",
            "uri": "git+https://github.com/eddie-knight/common-cloud-controls@65b6844e7d4361034aac75cde94963f5e9d73820",
            "digest": {
              "gitCommit": "65b6844e7d4361034aac75cde94963f5e9d73820"
            }
          }
        ]
      },
      "runDetails": {
        "builder": {
          "id": "https://github.com/eddie-knight/common-cloud-controls/actions/runs/27958837352",
          "version": {
            "go": "go1.25.0",
            "go-arch": "amd64",
            "go-os": "linux",
            "grcli": "v0.2.2"
          }
        },
        "metadata": {
          "invocationId": "27958837352-1",
          "startedOn": "2026-06-22T14:09:30.38990994Z",
          "finishedOn": "2026-06-22T14:09:31.09486749Z"
        },
        "byproducts": [
          {
            "name": "capabilities.yaml",
            "digest": {
              "sha256": "c24923da2440a40d8eae61388114a9aa4c550673176870f4f1e587a8ef02cf1b"
            }
          }
        ]
      }
    }
  },
  "artifacts": [
    {
      "name": "capabilities.yaml",
      "type": "CapabilityCatalog",
      "id": "CCC.MARefArc.CP",
      "role": "artifact"
    }
  ]
}

CCC Multi-Agent Reference Architecture Capabilities

Capabilities for Multi-Agent Reference Architecture technologies, as defined by the FINOS Common Cloud Controls project.

ID
CCC.MARefArc.CP
Version
v2026.06-rc1
Gemara version
v1.2.0
Author
FINOS Common Cloud Controls

User Interaction Layer

The entry point of the system, providing the interface through which users express intent, submit inputs, and review agent outputs.

  1. CCC.MARefArc.CP01 User-facing application surface

    Presentation and orchestration surface (web, mobile, chatbot, workflow tool, or integrated enterprise system) that captures user intent, forwards requests to the agent layer, and returns agent outputs.

  2. CCC.MARefArc.CP02 Human-in-the-loop output review

    Application-embedded controls that allow users to review, approve, or modify agent outputs before they are executed or shared.

Agent Gateway Layer

The controlled entry point into the agent layer, governing how applications discover, reach, and are policed before invoking agents.

  1. CCC.MARefArc.CP03 Agent registry and lifecycle management

    Catalog of available agents with their capabilities, metadata, and configuration, supporting versioning, lifecycle management, and controlled onboarding of new agents.

  2. CCC.MARefArc.CP04 Agent request routing

    Validates incoming application requests and routes each to the correct agent or agent group, abstracting agent-layer complexity behind a consistent interface.

  3. CCC.MARefArc.CP05 Agent-ingress zero-trust guardrails

    Treats all inputs as untrusted and enforces authentication, authorization, input validation, content filtering, access control, rate limits, and dynamic policy before any request reaches an agent.

Agent Layer

The core reasoning, coordination, and task-execution subsystems, including the sandboxed runtime, tools, memory, and learning.

  1. CCC.MARefArc.CP06 Agent collaboration and orchestration patterns

    Supports supervisor/worker decomposition, skills-based routing, and agent-as-a-tool handoff for decomposing and executing complex tasks across multiple agents.

  2. CCC.MARefArc.CP07 Unified sandboxed agent runtime

    Secure, sandboxed environment where all agentic reasoning and execution occurs, providing task state management for pause/resume/handoff and intercepting and validating tool calls with credentials handled securely within the sandbox.

  3. CCC.MARefArc.CP08 Built-in trusted tools

    A collection of bundled, trusted tools providing fundamental capabilities: the MCP client bridge to the external MCP layer, a sandboxed shell, workspace I/O, and web search.

  4. CCC.MARefArc.CP09 Agent memory

    Short-term in-session context management (trimming and summarization to control length, cost, and latency) and durable long-term memory across sessions, including session summaries and user/task personalization.

  5. CCC.MARefArc.CP10 Sandboxed workspace file system

    A sandboxed, persistent file system that agents use to read and write files, enabling work with large artifacts.

  6. CCC.MARefArc.CP11 Adaptive learning

    Generates learning signals based on execution outcomes to refine prompts, adjust agent configurations, or improve tool-selection strategies.

Knowledge Layer

The information foundation that grounds agent reasoning through authoritative source repositories and semantic retrieval.

  1. CCC.MARefArc.CP12 Authoritative knowledge source bases

    Internal and external repositories of structured data, unstructured documents, and graph-based representations that provide authoritative information for grounding.

  2. CCC.MARefArc.CP13 Vector-based semantic retrieval

    Vector databases providing semantic search and grounding so agents can find relevant information from large text corpora.

LLM Layer

The governed interface for accessing approved large language models, including registry, routing, and model-interaction guardrails.

  1. CCC.MARefArc.CP14 Approved-model registry and lifecycle

    Catalog of approved models with metadata, version information, configuration parameters, and usage constraints, ensuring agents access only models meeting organizational, regulatory, and security standards.

  2. CCC.MARefArc.CP15 LLM inference gateway routing

    Validates inference requests and routes each to the correct model instance, abstracting model hosting behind a consistent interface.

  3. CCC.MARefArc.CP16 Model-interaction zero-trust guardrails

    Enforces authentication and authorization for every inference request and applies input validation against prompt injection, output filtering and redaction, access control, rate limits, and cost management before and after model execution.

MCP Layer

The governed interface for accessing approved MCP servers, including registry, routing, and tool-interaction guardrails.

  1. CCC.MARefArc.CP17 Approved MCP server registry and lifecycle

    Catalog of approved MCP servers with metadata, capabilities, configuration, and usage constraints, ensuring agents connect only to servers meeting organizational, security, and compliance requirements.

  2. CCC.MARefArc.CP18 MCP connection gateway routing

    Validates MCP connection requests and routes each to the correct server instance, abstracting MCP connectivity behind a consistent interface.

  3. CCC.MARefArc.CP19 MCP-interaction zero-trust guardrails

    Enforces authentication and authorization for every MCP request and governs which agents may use which tools, applying rate limits and validating tool-call parameters.

Evaluation Layer

Continuous oversight, quality assurance, and adaptive improvement through feedback, human supervision, and runtime protection.

  1. CCC.MARefArc.CP20 Feedback engine

    Collects and aggregates structured and unstructured feedback from users, evaluators, and automated systems, including correctness assessments, preference signals, and quality ratings, to inform system improvement.

  2. CCC.MARefArc.CP21 Human supervision and oversight

    Mechanisms for human reviewers to inspect, approve, correct, or override agent outputs, supporting human-in-the-loop and human-over-the-loop workflows for sensitive or high-impact tasks.

  3. CCC.MARefArc.CP22 Runtime protection

    Monitors agent actions and model outputs during execution to detect unsafe, non-compliant, or anomalous behavior, enforcing constraints, blocking disallowed actions, or triggering escalation.

Observability Layer

End-to-end visibility into system behavior, collecting and correlating telemetry emitted by every other layer.

  1. CCC.MARefArc.CP23 Cross-layer telemetry collection

    Captures logs, traces, metrics, and events emitted by every layer to support debugging, auditability, distributed tracing, and operational monitoring across the request lifecycle.

  2. CCC.MARefArc.CP24 Anomaly detection

    Identifies unusual or unexpected patterns across telemetry to surface failures, regressions, misuse, or emerging risks before they impact performance or compliance.

  3. CCC.MARefArc.CP25 Signal correlation

    Correlates signals across logs, traces, metrics, and events into a unified view, connecting symptoms to root causes across cross-layer dependencies.