Every action carries a signed receipt of what your agent planned, what it was allowed to do, and what happened.
One receipt per action
Agent and tool
The receipt records which agent acted and which tool it called.
Intent
Before the tool runs, the receipt records what the agent intends to do.
Policy decision
The receipt records the policy decision for the action.
Outcome
After the tool runs, the receipt records a fingerprint of the result.
Quantum-safe signature
Each receipt is signed with ML-DSA-65, so an edited receipt fails verification.
Linked receipts
Each receipt is linked to the one before it, so changing an earlier one breaks the chain.
Evidence for the questions that matter
How is this different from our logs?
Your logs are records your own system keeps. An admin can usually edit them, and an outsider has no way to tell. Each receipt is signed when the action is sent to Asqav. If anyone edits it afterwards, the signature check fails, and anyone holding the receipt can run that check themselves. Compare logs and receipts.
What did an AI agent do, and was it allowed?
Keep a signed record of the action and the policy decision, with fingerprints of the input and result when you send them. Review incidents and approvals in one workspace, then share the evidence behind a decision. Understand agent receipts or see how policy enforcement works.
How do we prepare AI audit evidence?
Export records for your compliance review and map receipt fields to the requirements that apply to your organisation. Your reviewers still assess the system and its controls; a receipt alone does not establish compliance. Prepare a compliance report and explore AI Act audit packs.
Can someone verify our records without an Asqav account?
Yes. A recipient can check receipt signatures and the evidence supplied with them using the public verification tools or SDK. Verification checks the signed record and its integrity; it does not independently establish that a real-world claim in that record is true. Verify evidence independently.
Start with the SDK quick start, find your agent framework, or compare plans.
Recordkeeping across jurisdictions
| Regulation | Jurisdiction | Recordkeeping context | Status |
|---|---|---|---|
| EU AI Act | European Union | Art. 12: automatic logs for high-risk AI systems | From |
| DORA | European Union | ICT risk records and incident reporting | In force |
| SEC 17a-4 | United States | Electronic records: WORM or audit-trail alternative | In force |
| HIPAA | United States | §164.312(b) audit controls | In force |
| NYDFS 500 | New York | §500.06 audit trails | In force |
| CIRCIA | United States | Incident reporting for critical infrastructure | Rulemaking |
| Colorado ADMT Act | Colorado | Documentation and three-year record retention | From |
| Texas TRAIGA | Texas | AI use restrictions and specified disclosure duties | In force |
| NIST AI RMF | United States | Risk-management framework | Voluntary |
| NIST SSDF | United States | Secure development practices | Voluntary |
| ISO/IEC 42001 | International | AI management systems, certifiable | Voluntary |
| OWASP LLM Top 10 | International | Security guidance for LLM systems | Voluntary |
| AIUC-1 | International | AI agent security standard | Voluntary |
Receipts support recordkeeping; they do not by themselves establish legal compliance. Applicability depends on your systems and jurisdiction. EU high-risk timelines differ between Annex III and regulated products. Follow each linked authority for the current requirements.
The receipt format is public and submitted as an IETF Internet-Draft.
Every receipt can be verified independently.
- ML-DSA, NIST FIPS 204
- SHA-256 chaining
- RFC 3161 timestamps
- OpenTimestamps