Verifiable Agent Receipts

An agent receipt is a signed record of one thing an AI agent did: the principal, the action, the request and result digests, the time, and the policy decision that gated it. Asqav signs that record so the person who later reads it can verify it themselves, without an Asqav account and without taking anyone's word for it.

What it is: a signed record of one agent action.

What it proves: the action happened as recorded, at the recorded time, under the recorded decision.

Why it matters: someone other than the agent can check it.

The point of a receipt is not that it exists. The point is that someone other than the agent can check it. A record the agent vendor signs over its own actions is the vendor's own narrative. A receipt that an outside party can verify against a published format and a public key is evidence.

Hand your customer a file they can verify themselves

Every Asqav receipt verifies on its own. The verify key is published at GET /.well-known/jwks.json. The wire format is published as an IETF Internet-Draft. The reference verifier is the open asqav SDK on PyPI and @asqav/sdk on npm. So a customer, an auditor, or a regulator can take a receipt and check it against the public key without an account and without calling Asqav.

Anyone holding a signature_id can ask the public verify endpoint for a granular outcome, with no auth:

bash
curl https://api.asqav.com/api/v1/verify/sig_a1b2c3
typescript 
import { init, Agent, verifySignature } from "@asqav/sdk";

init({ apiKey: "sk_..." });

const agent = await Agent.create({ name: "my-agent" });

// Sign an action - produces a verifiable receipt
const sig = await agent.sign({
  actionType: "api:openai:chat",
  context: { model: "gpt-4" },
});

// Verify the receipt (public endpoint, no auth)
const result = await verifySignature(sig.signatureId);

console.log(result.verificationDetail.signatureValid);  // true
console.log(result.algorithm);                          // ML-DSA-65
console.log(result.verificationUrl);                    // shareable proof page

For an audit, the whole evidence set ships as one offline file:

bash
asqav audit-pack export --start ISO --end ISO --output-file FILE

The pack verifies against the same public key, offline, after the fact. The reader does not need Asqav running to trust it.

If it cannot be verified after we are gone, it was never evidence

A receipt is only worth keeping if it survives the tools that made it. Asqav builds for that on three deployed properties:

Signed by an unaffiliated party, the property an auditor checks

Several record-retention rules do not just ask for a tamper-evident record. They ask for one a party other than the regulated entity can verify:

Asqav signs as that unaffiliated party. The signer is operated by Asqav, not by the agent vendor and not by the regulated entity, and the customer cannot retroactively change or suppress a receipt Asqav has issued. That separation is the property an inbound auditor checks before treating the receipt log as evidence rather than as the vendor's account of itself. The full regulation-by-regulation walkthrough lives in the third-party notary docs.

The "when" is witnessed, not asserted

A receipt's time is not Asqav's word alone either. Each receipt carries an anchors[] array with two witnesses: a quantum-safe RFC-3161-shaped timestamp token Asqav signs with ML-DSA-65, which makes the receipt's own time tamper-evident, and an OpenTimestamps proof folded into the Bitcoin blockchain, which is independent of both the operator and Asqav. An auditor checks the claimed time by checking the witnesses. See multi-witness anchoring for the detail on which witness is independent of Asqav and which is tamper-evident.

What is inside a receipt

Each signed receipt carries:

The governance posture that produced it is published at /.well-known/governance.json, so a reviewer can see the rules the signer ran under.

Related