Introducing OpenSAFR

[TODO: review and finalise the launch post before publishing publicly.]

Financial institutions are moving AI from recommending to executing: payments, trades, credit decisions, filings. The SAFR whitepaper identifies three gaps in how that is governed today: no pre-execution assurance, no human-agent interface, and fragmentation.

OpenSAFR is an open schema, conformance suite, and reference implementation for SAFR, the industry reference approach for governing agentic AI in financial services at the point of action.

Why the schema comes first

The SAFR whitepaper defines what should hold for every agent action: it is declared, its agent is verified, it is assessed against controls, it receives one of four outcomes, and it is recorded. It deliberately leaves the form of implementation to each institution.

That flexibility has a cost. If every institution designs its own envelope and log format, the fragmentation problem the whitepaper describes simply moves one layer down. OpenSAFR's first priority is a shared, language-agnostic schema for the Governance Envelope and the Audit Log record, with a conformance suite to check implementations against it. The disposition engine is where institutions differentiate. The record format is where they should agree.

We're following the pattern of OpenTelemetry and OAuth: a spec repository, separate SDK repositories, and a public conformance suite. See the specification for the current status of each artefact.

What OpenSAFR is not

• Not official. OpenSAFR is not affiliated with, or endorsed by, the Monetary Authority of Singapore, BuildFin.ai, or any organisation that contributed to the whitepaper.
• Not regulation. SAFR itself is an industry reference approach, not regulatory guidance or a supervisory expectation.
• Not a certification. The planned conformance suite tests against the OpenSAFR schema, not an official MAS standard.

Get involved

SAFR's authors describe it as a starting point that should evolve through implementation experience. OpenSAFR is where that experience can become shared, testable artefacts. We're looking for engineers building agent platforms, risk and compliance teams at financial institutions, and auditors who will have to read these records. Here's how to help.