Every action carries a signed receipt of what your agent planned, what it was allowed to do, and what happened.
One receipt per action
Intent, recorded before
What the agent set out to do is captured before it runs, signed as part of the record.
The policy gate
The receipt names the policy that allowed the action and the decision it reached.
What actually happened
Which tool ran, what it was handed, and what it sent back.
Chained to the past
Each receipt signs the one before it, so history cannot be edited without breaking the chain.
Proof of when
Independent timestamps provide evidence that a recorded digest existed by a particular time.
Verifiable by anyone
Auditors, customers and regulators check the proof themselves, on a public page.
Connect your workflow
Connect your agent through the SDK or an integration. Retain the returned receipt alongside the action result.
Evidence for the questions that matter
What did an AI agent do, and was it allowed?
Keep a signed record of the action, its input and result digests, and the policy decision. Review incidents and approvals in one workspace, then share the evidence behind a decision. Understand agent receipts or see how policy enforcement works.
How do we prepare AI audit evidence?
Export records for your compliance review and map receipt fields to the requirements that apply to your organisation. Your reviewers still assess the system and its controls; a receipt alone does not establish compliance. Prepare a compliance report and explore AI Act audit packs.
Can someone verify our records without an Asqav account?
Yes. A recipient can check receipt signatures and the evidence supplied with them using the public verification tools or SDK. Verification checks the signed record and its integrity; it does not independently establish that a real-world claim in that record is true. Verify evidence independently.
Start with the SDK quick start, find your agent framework, or compare plans.
Recordkeeping across jurisdictions
| Regulation | Jurisdiction | Recordkeeping context | Status |
|---|---|---|---|
| EU AI Act | European Union | Art. 12: automatic logs for high-risk AI systems | From |
| DORA | European Union | ICT risk records and incident reporting | In force |
| SEC 17a-4 | United States | Electronic records: WORM or audit-trail alternative | In force |
| HIPAA | United States | §164.312(b) audit controls | In force |
| NYDFS 500 | New York | §500.06 audit trails | In force |
| CIRCIA | United States | Incident reporting for critical infrastructure | Rulemaking |
| Colorado ADMT Act | Colorado | Documentation and three-year record retention | From |
| Texas TRAIGA | Texas | AI use restrictions and specified disclosure duties | In force |
| NIST AI RMF | United States | Risk-management framework | Voluntary |
| NIST SSDF | United States | Secure development practices | Voluntary |
| ISO/IEC 42001 | International | AI management systems, certifiable | Voluntary |
| OWASP LLM Top 10 | International | Security guidance for LLM systems | Voluntary |
| AIUC-1 | International | AI agent security standard | Voluntary |
Receipts support recordkeeping; they do not by themselves establish legal compliance. Applicability depends on your systems and jurisdiction. EU high-risk timelines differ between Annex III and regulated products. Follow each linked authority for the current requirements.
The receipt format is public and submitted as an IETF Internet-Draft.
Every receipt can be verified independently.
- ML-DSA, NIST FIPS 204
- SHA-256 chaining
- RFC 3161 timestamps
- OpenTimestamps