An agentic dataset is a dataset that carries a machine-readable descriptor of itself, advertises a bounded set of capabilities, declares prohibitions, and is reached through a control plane that decides whether a requested action is admissible before that action runs.
The unit of governance is the decision to act, not the query. A conventional dataset answers or fails to answer. An agentic dataset additionally produces a verdict — approved, refused, or indeterminate — and an evidence record naming the descriptor clause that produced it.
This repository describes the programme. It contains no code. The contract, the conformance suite and every measurement live in the repositories below.
Five elements, with the same meaning everywhere in the programme:
| Element | Definition |
|---|---|
| Descriptor | The dataset's declaration of itself: identity, capabilities, prohibitions. |
| Capability | A bounded action the dataset advertises. Advertised, not guaranteed. |
| Verdict | Approved, Refused or Indeterminate, each with a typed reason. |
| Approval token | Minted only by Approved. Execution requires one. |
| Evidence record | Append-only and hash-chained; one entry per decision. |
The decision path is fixed:
interpret -> discover -> resolve -> admit -> { execute | refuse | indeterminate }
Refusal is not a message. After a refusal there is no token to execute with, and that absence — not the wording of the refusal — is what the conformance suite asserts.
| Repository | Contents |
|---|---|
agentic-datasets/programme (this one) |
Programme description. Prose only. |
agentic-datasets/reference |
The 15-assertion behavioural contract, its language-neutral executable vectors, a reference control plane, the conformance suite, Authorized Recall@K, and all measurements. |
Every figure below is reproducible from the reference repository, and each is carried in its frozen claims table with its own caveat.
- 15 normative assertions, expressed as 85 language-neutral vector steps in JSON, evaluated without access to any implementation's internals.
- 15/15 assertions portable through the public interface alone.
- 4 agent runtimes x 2 dataset boundaries = 8 configurations, 15/15 each.
- An implementation sharing no code with the reference: 15/15.
- 17/17 targeted violations detected by their named assertion; 15/15 assertions exercised as the assertion under test.
- 0 prohibited executions across the measured matrix.
- Authorized Recall@5 of 0.853 against 0.960 when the authorization filter precedes truncation rather than following it, on one synthetic corpus.
- The conversion to language-neutral vectors exposed two real defects, F-010 and F-011, the first of them invisible to the implementation-internal suite.
- No security guarantee. A subject's capability report is its own account of itself. A subject that under-reports passes the discovery assertion while concealing a tool. Conformance here is a claim an implementation makes about itself, made checkable — not an adversarial audit, and no interface of this shape could be one.
- Interpretive independence is unclaimed. The independent implementation is independent of the reference code, not of its author's reading of the specification, because one person wrote both. Establishing it requires somebody else, and is the next validation threshold.
- The retrieval magnitude belongs to its corpus. The sign of the Authorized Recall gap is proved for every ranking, K and predicate; the size is measured on one synthetic corpus with relevance by construction and a TF-IDF retriever.
- Not measured at all: latency, cost, concurrency, throughput, and semantic answer quality beyond the evaluators in the reference repository.
MCP is one of the two dataset boundaries the contract has been measured across — the other is local, in-process. It is a transport the model has been shown to survive, not a requirement of the model. An implementation over a different boundary is expected to satisfy the same 15 assertions, and the executable vectors are what turn that expectation into something checkable.
You need no permission from anybody to implement agentic datasets, to publish an implementation, or to sell one. The concept is published here, and the conformance contract and its vectors are openly licensed in the repository that carries them. A second implementation, written from the specification by somebody who did not write it, is the contribution this programme most needs.
Agentic Datasets is an independent technical project initiated and maintained by Alexander Chernov. The reference implementation is a release candidate: nothing is archived or minted yet, so a finding can still change the artifact rather than becoming errata against a published record.
This repository's documentation is CC BY 4.0. The commercial boundary in this programme sits around executable implementation code, not around the prose describing it; see LICENSE.md and NOTICE.md.
Alexander Chernov ORCID: 0009-0007-3198-2712 GitHub: @doytsujin · LinkedIn: @thedoytsujin
© 2026 Alexander Chernov. Documentation licensed CC BY 4.0.
Rewritten 2026-09-02. The previous version described datasets as "self-aware digital actors" that "manage themselves", and asserted operational benefits — reduced operational drift, accelerated innovation — that nothing in the programme measures. Every claim above is checkable against the reference repository's frozen claims table.