Attested Governance Artifacts · AGA
Signed evidence for agent tool decisions.
Give a technical reviewer a signed export of recorded tool decisions. They can inspect the decisions and check the record against an expected issuer key without connecting to your service.
Reference implementation. Static verification is available; runtime use requires a separate deployment review.
The handoff
Evidence the reviewer can keep.
Share the bundle, an expected signing key through a trusted channel, and the verifier. The recipient can inspect the record outside the environment that produced it.
AGA provides a published format, a reference gateway and verification tools for that handoff. Your traces, policy controls and retention system continue to serve their own purposes.
For vendors facing a customer evidence reviewInside a receipt
A decision with an inspectable structure.
The sample records a denied request to write_file. These fields explain what is committed, and what still needs evidence outside the record.
- tool_name · decision
write_file· DENIED. The recorded policy decision is signed. A permitted decision would not prove execution.- reason
- Synthetic allowlist disallows this named tool. This reason is readable in the record; argument hashes do not make every field private.
- policy_reference
- The receipt commits to the reference for the included policy. Inspect it beside the two requests. The hash alone does not establish correct policy evaluation.
- arguments_hash
- A commitment to arguments, not their full contents. Hashing alone does not guarantee confidentiality of values that can be guessed.
- previous_receipt_hash · checkpoint
- Receipts are linked in order. The signed checkpoint commits to the count, head and Merkle root of this export. An earlier genuine export can still verify.
Check and challenge
See the check pass.
Then change the evidence.
Verify the fixture against its expected key. Change a signed decision or supply the wrong key and inspect the failed check. Compare an unsigned metadata change to see the boundary of the signature.
The same published fixture is available with a standalone verifier for local reproduction. No account or live gateway is needed.
Fit and boundary
One part of the evidence workflow.
1. Record a policy decision
The producer evaluates a covered tool request. Its gateway holds the signing key and records the decision. Capture and bypass resistance depend on deployment.
2. Export signed receipts
The bundle contains hash-linked receipts, Merkle proofs and a signed checkpoint. Tool execution and returned results are separate from this record.
3. Check against an expected key
The reviewer verifies locally with a key obtained through a trusted channel. The key holder can sign another history. The check does not prove that every action was captured or that the export is fresh.
The public proxy uses a raw-TCP agent interface and has known deployment risks. It is not a drop-in stdio or Streamable HTTP bridge. Start with static verification before considering runtime integration.
Technical evaluation
What does your reviewer need to establish?
Describe the tool workflow, the evidence you need to retain and the question the record should answer. We can assess the fit and define a focused evaluation.