Verifiable Agent Receipts

An agent receipt is a signed record of one thing an AI agent did: the principal, the action, the request and result digests, the time, and the policy decision that gated it. Asqav signs that record so the person who later reads it can verify it themselves, without an Asqav account and without taking anyone's word for it.

What it is: a signed record of one agent action.

What it proves: the record was signed by the stated key and has not been altered. Its chain and time evidence can be checked separately; a signature does not establish that every claim in the record is true.

Why it matters: someone other than the agent can check it.

The point of a receipt is not that it exists. The point is that someone other than the agent can check it. A record the agent vendor signs over its own actions is the vendor's own narrative. A receipt that an outside party can verify against a published format and a public key is evidence.

Hand your customer a file they can verify themselves

Every Asqav receipt verifies on its own. The verify key is published at GET /.well-known/jwks.json. The wire format is published as an IETF Internet-Draft. The reference verifier is the open asqav SDK on PyPI and @asqav/sdk on npm. So a customer, an auditor, or a regulator can take a receipt and check it against the public key without an account and without calling Asqav.

Anyone holding a signature_id can ask the public verify endpoint for a granular outcome, with no auth:

bash
curl https://api.asqav.com/api/v1/verify/sig_a1b2c3
typescript 
import { init, Agent, verifySignature } from "@asqav/sdk";

init({ apiKey: process.env.ASQAV_API_KEY });

const agent = await Agent.create({ name: "my-agent" });

// Sign an action - produces a verifiable receipt
const sig = await agent.sign({
  actionType: "api:openai:chat",
  context: { model: "gpt-4" },
});

// Verify the receipt (public endpoint, no auth)
const result = await verifySignature(sig.signatureId);

console.log(result.verificationDetail.signatureValid);  // true
console.log(result.algorithm);                          // ML-DSA-65
console.log(result.verificationUrl);                    // shareable proof page

For an audit, the whole evidence set ships as one offline file:

bash
asqav audit-pack export --start ISO --end ISO --output-file FILE

The pack verifies against the same public key, offline, after the fact. The reader does not need Asqav running to trust it.

If it cannot be verified after we are gone, it was never evidence

A receipt is only worth keeping if it survives the tools that made it. Asqav builds for that on three deployed properties:

Signed by an unaffiliated party, the property an auditor checks

Several record-retention rules do not just ask for a tamper-evident record. They ask for one a party other than the regulated entity can verify:

Asqav signs as that unaffiliated party. The signer is operated by Asqav, not by the agent vendor and not by the regulated entity, and the customer cannot retroactively change or suppress a receipt Asqav has issued. That separation is the property an inbound auditor checks before treating the receipt log as evidence rather than as the vendor's account of itself. The full regulation-by-regulation walkthrough lives in the third-party notary docs.

The "when" is witnessed, not asserted

A receipt's time is not Asqav's word alone either. Each receipt carries an anchors[] array with two witnesses: a quantum-safe RFC-3161-shaped timestamp token Asqav signs with ML-DSA-65, which makes the receipt's own time tamper-evident, and an OpenTimestamps proof folded into the Bitcoin blockchain, which is independent of both the operator and Asqav. An auditor checks the claimed time by checking the witnesses. See multi-witness anchoring for the detail on which witness is independent of Asqav and which is tamper-evident.

What is inside a receipt

Each signed receipt carries:

An exported receipt also carries plain copies of some of these values, such as the agent, the action and the time. The signature does not cover the copies, so they are convenience only: the verifiers compare each one with the signed value and fail the receipt if one differs. Members that nothing signed are listed as not signed, and a few copies are listed instead of compared when the signed value is withheld or the signature did not verify. Independent verification lists which members are signed.

The governance posture that produced it is published at /.well-known/governance.json, so a reviewer can see the rules the signer ran under.

Questions

What is an agent receipt?

An agent receipt is a signed record of one action an AI agent took: the principal, the action, the request and result digests, the time and the policy decision that gated it. Anyone holding it can check it against a public key, without an Asqav account.

How is an agent receipt different from a log entry?

Whoever runs a logging system can edit its entries, and nothing in an entry shows the edit. A receipt is signed, so changing one byte makes its signature check fail, and each agent's receipts are linked in a hash chain, so a removed receipt shows. A receipt proves the record was not altered; it does not prove that every claim in it is true.

Who can verify an agent receipt?

Anyone who holds it. The verify keys are published at /.well-known/jwks.json, the format is published as an IETF Internet-Draft and the reference verifier is the open asqav SDK, so a customer, an auditor or a regulator can check a receipt without calling Asqav.

Which algorithm signs an Asqav receipt?

ML-DSA-65, the post-quantum signature scheme standardized in NIST FIPS 204. Ed25519 is available for shorter retention windows, and the algorithm identifier sits inside the signed envelope.

Is the receipt format an IETF standard?

No. It is profiled in the Internet-Draft draft-marques-asqav-compliance-receipts, which is a draft and not an adopted IETF standard.

Related

References