Standards Participation

Design decisions are published as RFCs before the implementation exists, with a discussion period set by the version impact of the change: seven days for a non-breaking schema change, fourteen for a major version or a new enforcement contract. Audit event format changes are decided in bh-audit-schema and nowhere else, so a downstream project that needs a field it lacks files upstream and waits for a version bump. RFC 0003 arrived that way.

Regulatory Comment

• Public Comment 26 August 2026

  Public comment, FDA Docket FDA-2026-N-7874

  U.S. Food and Drug Administration, Digital Health Center of Excellence and CDRH. Comments close 19 October 2026.

  The FDA opened a request for feedback on 18 August 2026, Considerations for the Regulation of Generative AI-Enabled Medical Devices. Question 1 asks whether traceability of output belongs as a dimension of the risk framework.

  A comment was submitted on 26 August 2026 addressing discussion questions 1, 19, 20, 21, and 26. It argues that the distinction the proposed framework draws between an action-taking function under professional supervision and one operating autonomously is not verifiable from the records a clinical system currently produces, and that traceability of attribution is therefore a precondition for the machine-based supervisory agents contemplated in question 20 and a testable acceptance criterion for the agentic devices addressed in question 26.

  Comment Tracking Number mta-231v-wyip. Comments on this docket had not been posted publicly at the time of writing.

HL7 Engagement

• Membership 23 August 2026

  HL7 International

  Individual member.

  Participating in the Security Work Group.

• Change Request 26 August 2026

  Change requests filed with HL7 International

  HL7 Security Work Group. Both awaiting disposition.

  Two change requests were filed against the auditevent-OnBehalfOf extension in the FHIR Extensions Pack, following the work group discussion of 22 August 2026.

  FHIR-58715. The extension's description names the case of an agent acting on behalf of another agent, while Extension.value[x] binds to Reference(Organization | Patient | Practitioner | PractitionerRole | RelatedPerson | CareTeam). AuditEvent.agent.who permits Device. A device can therefore be named as an acting agent but not as the entity acted for, and the case the description names cannot be expressed. The request proposes either widening the binding or narrowing the description.

  FHIR-58716. AuditEvent.agent.requestor is a sibling of agent.who, and the extension declares Extension.extension as 0..0. Applied to an agent action, requestor remains on the acting entity, so a requestor = true access review returns the acting entity rather than the party acted for. The request proposes documenting the limitation.

• Work Group 22 August 2026

  auditevent-OnBehalfOf and the agent-acting-for-agent case

  HL7 Security and Privacy work group, chat.fhir.org

  The published auditevent-OnBehalfOf extension is described as covering an agent acting on behalf of another agent. Its value[x] binds to Reference(Organization | Patient | Practitioner | PractitionerRole | RelatedPerson | CareTeam) while agent.who permits Device, so a device can act but cannot be acted for, and the described case does not resolve.

  FHIR-40293 accounts for the shape. The 2023 use case was two practitioners each working on behalf of a different organization, resolved non-substantive and modeled on Provenance to keep the two resources consistent. The option that would have carried a chain of two agents was set aside because nothing in front of the work group at the time needed it. The post asks whether the Device exclusion is deliberate, and whether a tracker item is the right next step for the sub-agent case.

• Submission July 2026

  2026 HL7 AI Challenge

  HL7 International. Under review, with results expected by 23 September 2026.

  A proposed AI agent attribution profile for FHIR R5 AuditEvent, entered as independent open source work under bh-healthcare. Intention to submit was registered on 12 June 2026 and the entry went in on 13 July 2026, two days before the extended 15 July deadline.

  The submission carries a gap analysis of R5 AuditEvent for agent-mediated actions, a profile and extension set closing those gaps through attribution-typed agent slices, delegation and supervision-state semantics, and PHI-minimization invariants, and a working translator from bh-audit-schema to conformant AuditEvent resources. A private harness accompanies it so a reviewer can run the demonstrated behavior cold from source against a translator vendored byte-for-byte from bh-audit-schema at tag v2.0.0, and answer one compliance question a stock R5 AuditEvent cannot: every autonomous agent action on PHI where a named clinician was the authorizing human.

RFC Series

An RFC lives in the repository whose artifact it changes, which is why the series spans two repositories.

• RFC 0001 June 2026

  AI Agent Attribution and the Human-Agent Delegation Chain

  Implemented in bh-audit-schema v2.0, released 2 July 2026. Tracking: bh-audit-schema#6

  Replaces the single actor field with three attribution roles, authenticating, acting, and authorizing, adds a delegation object and an extended actor taxonomy, and uses conditional validation to make an unattributed agent action invalid by construction. Ships as a JSON Schema producer contract and as a FHIR R5 AuditEvent profile, with a working translator between the two.

  Section 3 is normative and states the limit: this is a reporting mechanism and cannot make a non-cooperating agent identify itself. Section 11 defines three emission tiers so a deployment can state which guarantee it actually provides.

• RFC 0002 23 August 2026

  Enforced Attribution Emission for MCP Tool Calls

  Draft, discussion closes 2026-09-06. Target bh-mcp-attribution v0.1.0. Tracking: bh-mcp-attribution#1

  RFC 0001 named the enforced emission tier without saying how to build it. This specifies a middleware layer that resolves the identities behind a Model Context Protocol tool call, refuses the call when it cannot name an authorizing human, and emits bh-audit-schema v2.0 events. The guarantee rests on a durable local write that precedes the upstream call, an assurance level recorded alongside the identity so a weak binding never reads downstream as a strong one, and a record that never carries argument or result content.

  Five of the six decisions in section 13 are open. The repository and the RFC were published ahead of the implementation, because keeping the work private until release would have collapsed the design into a single timestamp.

• RFC 0003 23 August 2026

  Attribution Assurance and the Unattributed Agent

  Draft, discussion closes 2026-09-06. Target bh-audit-schema v2.1. Tracking: bh-audit-schema#13

  Two gaps in v2.0 became visible once the enforcement layer was built against it. A token-derived attribution and an agent-supplied one serialize to byte-identical events, so the strongest and the weakest binding are indistinguishable in the record and unrecoverable from it. Separately, an event stating that an agent acted and no authorizing human could be named is rejected by v2.0 validation, which makes the enforced tier's denial record the one event the format forbids.

  The fix is a single top-level attribution object carrying a closed level enum, verified, bound, asserted, and unattributed, alongside an open method string, plus four conditional validation rules.

FHIR R5 Profile Work

• Working Draft June 2026

  FHIR R5 AuditEvent for AI Agent Attribution: Gap Analysis and Proposed Profile

  Companion to RFC 0001. Not balloted.

  Enumerates nine gaps in stock R5 AuditEvent for agent-mediated access and closes them with three attribution-typed agent slices, two profile invariants, and a bounded extension set covering three of the nine. The G3 gap is the one raised with the Security and Privacy work group above. A reference translator renders bh-audit-schema v2.0 events into the profile and is checked in CI against a corpus of seven positive and thirteen negative examples.

  The positioning section states the limit directly: a solo schema does not out-standard HL7 and should not try.

Working On

A FHIR Connectathon track proposal on agent attribution, not yet submitted. What would make the track worth running is implementers willing to exercise the profile against their own agent traffic. If your team is building in this direction, I would like to hear from you before the proposal goes in: tanmaya@tanmayakumar.com.