Verified Digital Agents → C2MD → Generate a compliance bundle

Generate Compliance Bundle

The governance an agent actually follows, generated for one specific agent and written in plain Markdown — so a compliance officer can read it, git can version it, and the agent can evaluate it at runtime.

Live · starter and pro tiers

What lands

File	Contains
`AGENTS.md`	Identity, scope, and RACI — who is accountable for this agent, and what it is and is not for.
`SOP.md`	The operating rules as `MUST` / `MUST NOT` / `MAY` clauses, each carrying its framework citation at clause level.
`SKILL.md`	Permitted capabilities with the conditions attached to each — what the agent may do, and under what circumstances.

Why Markdown, and why that is the point

Governance in plain Markdown is readable by the person accountable for it and diffable by the system that stores it. That combination is what makes the rest of the cycle possible:

A compliance officer reviews the actual rules, not a summary of them.
ACP versions the bundle in git, runs it through a Compliance Guard and an adversarial test suite, and signs it before any agent receives it.
A change to governance is a diff with review provenance — which is what "show me what changed and who approved it" actually looks like.
Because the format is framework-agnostic, the same governance applies to agents built on different providers or stacks.

Clause-level citation is what makes it auditable. Each rule points at the control it implements, so the question "why does the agent do this?" has an answer that terminates in a regulation rather than in someone's judgement.

Worked example

Northwind Bank — credit-decision agent governance bundle Demo data — AGENTS.md, SOP.md and SKILL.md as generated.

Ask for it in plain language

"Generate the governance bundle for our credit-decision agent."
"Produce AGENTS.md, SOP.md and SKILL.md for an agent that screens CVs, citing the EU AI Act and GDPR clauses."

Where it goes next

The bundle is genesis — the first version. ACP owns the lifecycle from there: author changes against a Compliance Guard, test them adversarially, raise anything needing human ratification to HITL, then sign and activate, sealing the activation to Witness against the git commit hash. Agents fetch the signed bundle, verify it offline, and evaluate locally.