# Asqav > Asqav is the evidence layer for AI agents. Every action is signed with ML-DSA-65 (NIST FIPS 204), hash-chained, and anchored to RFC 3161 plus OpenTimestamps. The receipt format is profiled in IETF Internet-Draft draft-marques-asqav-compliance-receipts. ## Spec - [IETF Internet-Draft draft-marques-asqav-compliance-receipts](https://datatracker.ietf.org/doc/draft-marques-asqav-compliance-receipts/): The canonical receipt format profile. - [/docs/spec](https://www.asqav.com/docs/spec): Reference summary of the normative clauses. - [/docs/fingerprint-spec](https://www.asqav.com/docs/fingerprint-spec): How action context is hashed before signing. - [/docs/conformance-profile](https://www.asqav.com/docs/conformance-profile): The five testable conformance principles and boundary fixtures for the receipt format. ## Docs - [/docs/](https://www.asqav.com/docs/): Quick start. - [/docs/agent-receipts](https://www.asqav.com/docs/agent-receipts): What a verifiable agent receipt is and how a customer or auditor verifies one against the public key. - [/docs/key-custody-and-disclosure](https://www.asqav.com/docs/key-custody-and-disclosure): WebAuthn co-sign, customer-managed KMS keys, hash-only signing, post-quantum SD-JWT selective disclosure, and threshold signing. - [/docs/api](https://www.asqav.com/docs/api): API reference. - [/docs/cli](https://www.asqav.com/docs/cli): CLI reference. - [/docs/security](https://www.asqav.com/docs/security): Security model. - [/docs/mcp-security](https://www.asqav.com/docs/mcp-security): MCP-specific security model. - [/docs/compliance](https://www.asqav.com/docs/compliance): How to generate compliance reports. - [/docs/attestation](https://www.asqav.com/docs/attestation): Portable governance attestations. ## Blog - [EU AI Act Audit Trail Requirements: What You Need Before the Deadline](https://www.asqav.com/blog/posts/eu-ai-act-audit-trail-requirements): What the EU AI Act sets out for AI agent audit trails and record-keeping, Articles 12, 19, and 26, with a practical checklist. - [DORA AI Compliance: How Financial Services Can Prove Agent Actions Are Tamper-Evident](https://www.asqav.com/blog/posts/dora-ai-compliance): How DORA applies to AI agents in financial services, the ICT risk-management and audit-trail duties from Articles 5-12 and 28. - [The AI Agent Compliance Checklist for 2026](https://www.asqav.com/blog/posts/ai-agent-compliance-checklist): A practical checklist for AI agent compliance, agent registry, audit trails, policy enforcement, human oversight, revocation, and compliance export. - [How to Add Governance to LangChain Agents](https://www.asqav.com/blog/posts/how-to-govern-langchain-agents): A hands-on guide to adding audit trails and policy enforcement to LangChain agents with Asqav, with code examples. - [Tamper-Evident Logs for AI Agents: How the Proof Survives an Edit](https://www.asqav.com/blog/posts/tamper-evident-logs-for-ai-agents): How signed receipts, a per-agent hash chain, and external anchors make any edit to an AI agent record show. - [How Signed Agent Receipts Map to NIST, OWASP, and NSA Frameworks](https://www.asqav.com/blog/posts/agent-receipts-framework-mappings): How Asqav receipt fields provide verifiable evidence for NIST SP 800-53 AU controls, the NIST AI RMF, the OWASP agentic risks, and the NSA MCP guidance. - [Why AI Agent Logs Aren't Enough: Building Cryptographic Proof for Every Action](https://www.asqav.com/blog/posts/why-ai-agent-logs-arent-enough): Why plain logging falls short for regulated AI agents, and what cryptographic proof of each action adds. - [NIST FIPS 204 (ML-DSA) Explained](https://www.asqav.com/blog/posts/quantum-safe-signatures-fips-204-explained): A developer's guide to ML-DSA, the NIST FIPS 204 post-quantum signature standard, and how it protects AI agent audit trails. - [An IETF profile for AI agent compliance receipts](https://www.asqav.com/blog/posts/ietf-compliance-receipts-profile): What the Asqav IETF Internet-Draft does, what each binding means, and how every receipt is anchored. - [ML-DSA receipts in COSE for SCITT](https://www.asqav.com/blog/posts/scitt-cose-receipts): How Asqav exports COSE_Sign1 receipts for SCITT transparency services, ML-DSA-65 over CBOR. - [AI Agent Security in the MCP Era](https://www.asqav.com/blog/posts/ai-agent-security-mcp-era): Why MCP access to databases, APIs, and file systems moves the security model from prompt-level guardrails to cryptographic action control. - [The Unsigned Agent Is the Incident](https://www.asqav.com/blog/posts/unsigned-agent-is-the-incident): How enforcing signing at an egress chokepoint turns shadow AI agent traffic into something you can block or log. - [5 Questions Every CISO Should Ask About AI Agent Security](https://www.asqav.com/blog/posts/5-questions-ciso-ai-agents): Five questions a security team should ask about autonomous AI agents operating across their infrastructure. ## Integrations - [/docs/integrations](https://www.asqav.com/docs/integrations): Index of every framework integration (LangChain, CrewAI, LlamaIndex, Dify, KaibanJS, LiteLLM, Haystack, OpenAI Agents, PydanticAI, DSPy, Instructor, Letta, and more), each linking to its repository. ## Source code - [github.com/jagmarques/asqav-sdk](https://github.com/jagmarques/asqav-sdk): Python and TypeScript SDKs, plus the asqav hook CLI for Claude Code enforcement.