# Asqav

> Asqav is the evidence layer for AI agents. Every action is signed with ML-DSA-65 (NIST FIPS 204), hash-chained, and anchored to RFC 3161 plus OpenTimestamps. The receipt format is profiled in IETF Internet-Draft draft-marques-asqav-compliance-receipts. Receipts verify offline against the anchors, with no dependency on Asqav infrastructure to validate.

## Spec

- [IETF Internet-Draft draft-marques-asqav-compliance-receipts](https://datatracker.ietf.org/doc/draft-marques-asqav-compliance-receipts/): The canonical Internet-Draft on IETF Datatracker. Independent Submission stream. Profiles the receipt format onto the EU AI Act, DORA, NYDFS Part 500, NIST AI RMF, Colorado AI Act, Texas TRAIGA, CIRCIA, HIPAA Security Rule, and SEC 17a-4.
- [/docs/spec](https://www.asqav.com/docs/spec): Plain-English reference summary of the 17 pinned normative clauses (anchor entry shape, ML-DSA-65 signature, JCS canonicalisation, hash-chain genesis, 300-second clock-skew, counterparty_binding vocabulary).
- [/docs/fingerprint-spec](https://www.asqav.com/docs/fingerprint-spec): How action context is hashed before signing. RFC 8785 JCS + SHA-256, byte-identical across the Python and TypeScript SDKs.
- [/docs/conformance-profile](https://www.asqav.com/docs/conformance-profile): The five testable conformance principles and boundary fixtures for the receipt format.

## Docs

- [/docs/](https://www.asqav.com/docs/): Quick start. Install, register an agent, sign a first action.
- [/docs/api](https://www.asqav.com/docs/api): REST API reference. /sign, /verify, /audit-pack endpoints.
- [/docs/cli](https://www.asqav.com/docs/cli): CLI reference. Local key management and offline verification.
- [/docs/security](https://www.asqav.com/docs/security): Security model. Threat model, signing-key custody, anchor trust.
- [/docs/mcp-security](https://www.asqav.com/docs/mcp-security): MCP-specific security model. Transparent-proxy receipts, counterparty binding.
- [/docs/compliance](https://www.asqav.com/docs/compliance): How to generate compliance reports across the nine profiled regimes.
- [/docs/attestation](https://www.asqav.com/docs/attestation): Portable governance attestations. Self-contained verifier-friendly bundles.
- [/docs/agents](https://www.asqav.com/docs/agents): Agent identity model. Per-agent ML-DSA keys, hash chain per agent.
- [/docs/agent-groups](https://www.asqav.com/docs/agent-groups): Agent grouping for policy and audit grouping.
- [/docs/policies](https://www.asqav.com/docs/policies): Policy primitives. allow / deny / rate_limit / observation decisions.
- [/docs/enforcement](https://www.asqav.com/docs/enforcement): How policy decisions are projected onto receipts.
- [/docs/sessions](https://www.asqav.com/docs/sessions): Audit trails. Session-scoped hash chain.
- [/docs/proofs](https://www.asqav.com/docs/proofs): Receipt-level cryptographic proofs.
- [/docs/webhooks](https://www.asqav.com/docs/webhooks): Webhooks for policy decisions and chain events.
- [/docs/tokens](https://www.asqav.com/docs/tokens): API token model and rotation.
- [/docs/scanning](https://www.asqav.com/docs/scanning): Guardrails. Inline content scanners with policy gating.
- [/docs/observability](https://www.asqav.com/docs/observability): Metrics, traces, log streaming.
- [/docs/approvals](https://www.asqav.com/docs/approvals): Human-in-the-loop approval flows.
- [/docs/replay](https://www.asqav.com/docs/replay): Replay API for forensic analysis.
- [/docs/monitoring](https://www.asqav.com/docs/monitoring): Dashboards and alerting on policy decisions.
- [/docs/siem](https://www.asqav.com/docs/siem): SIEM streaming for Splunk, Sentinel, Elastic.
- [/docs/incidents](https://www.asqav.com/docs/incidents): Incident workflow on policy denials.
- [/docs/a2a](https://www.asqav.com/docs/a2a): Agent-to-Agent governance metadata card.
- [/docs/eu-ai-act-audit](https://www.asqav.com/docs/eu-ai-act-audit): EU AI Act audit pack export.

## Standards mappings

- [/docs/standards-eu-ai-act](https://www.asqav.com/docs/standards-eu-ai-act): EU AI Act receipt-field mapping.
- [/docs/standards-dora](https://www.asqav.com/docs/standards-dora): DORA Art 17 retention and ICT incident reporting.
- [/docs/standards-hipaa-security](https://www.asqav.com/docs/standards-hipaa-security): HIPAA Security Rule audit-control mapping.
- [/docs/standards-sec-17a4](https://www.asqav.com/docs/standards-sec-17a4): SEC Rule 17a-4 records retention mapping.
- [/docs/standards-nist-ai-rmf](https://www.asqav.com/docs/standards-nist-ai-rmf): NIST AI Risk Management Framework mapping.
- [/docs/standards-nydfs-500](https://www.asqav.com/docs/standards-nydfs-500): NYDFS Part 500 cybersecurity mapping.
- [/docs/standards-circia](https://www.asqav.com/docs/standards-circia): CIRCIA cyber-incident reporting mapping.
- [/docs/standards-colorado-ai-act](https://www.asqav.com/docs/standards-colorado-ai-act): Colorado AI Act receipt-field mapping.
- [/docs/standards-texas-traiga](https://www.asqav.com/docs/standards-texas-traiga): Texas TRAIGA receipt-field mapping.

## Blog

- [EU AI Act Audit Trail Requirements: What You Need Before the Deadline](https://www.asqav.com/blog/posts/eu-ai-act-audit-trail-requirements): What the EU AI Act sets out for AI agent audit trails, logging, and record-keeping. Articles 12, 19, and 26 explained, with a practical checklist.
- [DORA AI Compliance: How Financial Services Can Prove Agent Actions Are Tamper-Evident](https://www.asqav.com/blog/posts/dora-ai-compliance): How DORA applies to AI agents in financial services. ICT risk management, audit-trail, and cryptographic duties from Articles 5-12 and 28.
- [The AI Agent Compliance Checklist for 2026](https://www.asqav.com/blog/posts/ai-agent-compliance-checklist): A practical checklist of what teams need for high-risk AI agent compliance. Agent registry, audit trails, policy enforcement, human oversight, revocation, and compliance export.
- [How to Add Governance to LangChain Agents](https://www.asqav.com/blog/posts/how-to-govern-langchain-agents): A hands-on guide to adding audit trails, policy enforcement, and EU AI Act readiness to LangChain agents with Asqav. Includes code examples.
- [Tamper-Evident Logs for AI Agents: How the Proof Survives an Edit](https://www.asqav.com/blog/posts/tamper-evident-logs-for-ai-agents): A tamper-evident log is one where an edit shows. Signed receipts, a per-agent hash chain, and external anchors, plus why verification re-derives every hash rather than trusting a stored column.
- [How Signed Agent Receipts Map to NIST, OWASP, and NSA Frameworks](https://www.asqav.com/blog/posts/agent-receipts-framework-mappings): How Asqav receipt fields provide verifiable evidence for NIST SP 800-53 AU controls, the NIST AI RMF, the OWASP agentic risks, and the NSA MCP security guidance, without leaving the audit chain.
- [Why AI Agent Logs Aren't Enough: Building Cryptographic Proof for Every Action](https://www.asqav.com/blog/posts/why-ai-agent-logs-arent-enough): Why plain logging falls short for regulated AI agents, and what cryptographic proof of every agent action adds for audit trails and compliance.
- [NIST FIPS 204 (ML-DSA) Explained](https://www.asqav.com/blog/posts/quantum-safe-signatures-fips-204-explained): A developer's guide to ML-DSA, the NIST FIPS 204 post-quantum signature standard, and how lattice-based signatures protect AI agent audit trails against quantum threats.
- [An IETF profile for AI agent compliance receipts](https://www.asqav.com/blog/posts/ietf-compliance-receipts-profile): What the Asqav IETF Internet-Draft does, what each binding means, and how every receipt is anchored.
- [ML-DSA receipts in COSE for SCITT](https://www.asqav.com/blog/posts/scitt-cose-receipts): How Asqav exports COSE_Sign1 receipts on demand for SCITT transparency services. ML-DSA-65 over CBOR, parseable with cbor2.
- [AI Agent Security in the MCP Era](https://www.asqav.com/blog/posts/ai-agent-security-mcp-era): MCP gives AI agents access to databases, APIs, and file systems. Why the security model moves from prompt-level guardrails to cryptographic action control.
- [5 Questions Every CISO Should Ask About AI Agent Security](https://www.asqav.com/blog/posts/5-questions-ciso-ai-agents): Five questions a security team should ask about autonomous AI agents making decisions across their infrastructure.

## Integrations

- [/docs/integrations](https://www.asqav.com/docs/integrations): Index of every framework integration, each linking to its repository.

## Source code

- [github.com/jagmarques/asqav-sdk](https://github.com/jagmarques/asqav-sdk): Python SDK (PyPI: asqav) and TypeScript SDK (npm: @asqav/sdk). Byte-identical receipts. Ships the asqav hook CLI for Claude Code enforcement.