MAREF × 414 Policy
AI Service Provider Governance Compliance Guide
Policy Basis: MIIT Document 414 (2026) — Notice on Carrying Out Special Actions for Cultivating AI Application Service Providers
Core Requirement: National provider pool exceeding 2000 by end of 2026, 3000+ by end of 2027. Governance is one of four core capabilities.
Key Metrics
Three Critical Gaps
Have Agents, No Governance
Multi-agent systems running naked — no approval gates, circuit breakers, or audit chains
Have Security Awareness, No Baseline
OWASP Agentic Top 10 published, but few frameworks in China provide full coverage
Have Compliance Needs, No Tools
SOE procurement requires evidence for Class 2 compliance, Critical Infrastructure protection, and Data Security Law
MAREF Solutions
10-State Gray Code Governance State Machine
Hamming distance = 1 design ensures no security gates are skipped during transitions
- Auto-HALT after 3 consecutive failures
- 30s cooldown prevents cascade failures
- Mathematically provable safety guarantees
OWASP Agentic Top 10 Full Coverage
8-layer defense architecture with 10/10 risk coverage
- Input sanitization + permission checks
- Tool call auditing + sandbox isolation
- Security gates + policy decision trees
Verifiable Audit Chain + Chinese Crypto
Ed25519 signatures + Merkle tree aggregation with offline verification
- Native SM2/SM3/SM4-GCM support
- Cross-organization federated audit
- Tamper-proof evidence chain
Code Example
from maref.loop import GovernedLoop
# 5-line integration with any Agent framework
loop = GovernedLoop(governance=MAREF_OVERLAY)
result = await loop.run(agent=my_crewai_crew)
# One-command security audit
maref audit --level L3
# Emergency response
maref halt --scope all-agents --reason "suspicious-tool-chain"Policy Timeline
Governance Maturity Model
Run maref audit --level L3 to auto-generate pool entry assessment report
Less than 100 Days Until Deadline
Governance capability is not a bonus — it's a prerequisite. MAREF is open source, free, and Apache 2.0 licensed.