AGAATTESTED INTELLIGENCE USPTO Application No. 19/433,835 | Patent Pending
Format of record: Decision Receipt v1.0 · Evidence Bundle Canonicalization RFC 8785 Signature Ed25519 Algorithm Ed25519-SHA256-JCS Frozen

Verifiable decision records for AI agents

Every log asks to be believed. These records ask to be checked.

AGA turns each governed decision an AI agent makes into a signed Decision Receipt: tamper-evident, hash-chained, sealed under a signed checkpoint, exported as one portable Evidence Bundle. Verify it offline against a published format with the gateway's public key. No account. No callback. No faith in the vendor required, including this vendor.

Try to break a receipt ↓ Run the 60-second evaluation or request info

The bench · the one you run

Watch it verify. Then try to break it.

Below is this site's real sample Evidence Bundle: four Decision Receipts and a signed checkpoint, the same file /verify-sample ships. Nothing here is a screenshot of verification. Your browser runs the site's own verifier, recomputing every hash and re-checking every Ed25519 signature in this tab, every time you change anything. Pull a lever and watch which check catches it.

sample-bundle.json·loading…·demonstration gateway key

Verifier console · runs in this tab

RUNNING…
computing on the real sample bundle

Scope of proof

A verified bundle proves the integrity of every receipt present. It does not prove the operator recorded every action.

This bench runs the site's shipped verifier (compiled from lib/verifier.ts, the same code path behind /verify-sample) against /sample-bundle.json, with no network calls after the file loads. The verdict and every check are computed here, not asserted. The downloadable zero-dependency verifier runs the same published checklist offline.

“Policy without proof is just a suggestion.”

The position, in one sentence

The argument

You deploy agents. Your customers' auditors want to know what those agents did, and under which policy. Today the answer is a log: rows in a store the operator controls, exported by the party with the most to lose from what they say. However honest the operator, a log is testimony. It asks to be believed.

We think the answer should be evidence: records built so that believing them is unnecessary. Six claims follow. Each comes with an exhibit, and one exhibit is the bench you just used.

An agent cannot vouch for itself.

Agents act through a gateway, a runtime boundary process. The agent holds no signing keys and cannot self-authorize. Each decision that passes through emits a Decision Receipt: exactly fifteen canonical string fields, signed Ed25519 over RFC 8785 canonical JSON. The receipt states what was decided, PERMITTED or DENIED, for which tool call, why, and under which sealed Policy Artifact.

Exhibit A · the receipt, anatomized. Fifteen fields, no more, no less.

receipt_id
one record, one identity
receipt_version
the format, pinned in-band
algorithm
Ed25519-SHA256-JCS, stated where it can be checked
timestamp
when the gateway decided
request_id
ties the receipt to the request
method
the protocol method invoked
tool_name
the tool the agent asked for
decision
PERMITTED or DENIED, no third state
reason
why, in plain text
policy_reference
the sealed Policy Artifact consulted
arguments_hash
SHA-256 of the arguments. Never the arguments.
previous_receipt_hash
the chain link, inside the signed body
gateway_id
which boundary produced this
public_key
the key the record must answer to
signature
Ed25519 over the canonical body

Order is part of the record.

Each receipt carries the SHA-256 leaf of the receipt before it, inside its own signed body. Reorder two receipts and verification stops passing. There is no quiet way to resequence this history. There is a detected way.

Exhibit B · the chain, drawn live from the sample bundle above

loading the chain from /sample-bundle.json…

Because the link sits inside the signed body, swapping two receipts is not a formatting change. Use the reorder lever on the bench above and watch chain integrity and the Merkle root stop matching.

The story cannot end early without saying so.

Every leaf commits to a Merkle tree, and a mandatory gateway-signed checkpoint binds the root, the leaf count, and the chain head under one signature. Drop the last receipts and the checkpoint contradicts what remains. Truncation is not prevented. It is detectable, and detectable is the property a reviewer can actually use.

Exhibit C · the signed checkpoint from the sample bundle. Three bindings, one signature.

loading the checkpoint…

Proof does not require disclosure.

Raw tool arguments never enter the record. A receipt carries arguments_hash, a SHA-256 commitment, and nothing else of the payload. Hand an Evidence Bundle to whoever is checking you without handing over customer data. Verification never requires disclosing argument contents.

Exhibit D · what a receipt carries in place of the arguments

At runtime (arguments, never stored in the record)

{ "query": "site status", "max_results": 5 }
SHA-256

In the record (arguments_hash, receipt 1)

loading…

The preimage on the left is illustrative; the hash on the right is the real arguments_hash of receipt 1 from the bundle. What ships in the record is the digest, never the arguments.

Verification owes the vendor nothing.

The recorded history exports as one portable Evidence Bundle file, and the bundle verifies offline. A verifier needs the published format and the gateway's public key. No account, no network callback, no permission from Attested Intelligence. If we vanished tomorrow, every bundle ever issued would still verify, or still fail, on its own.

Exhibit E · what the verifier checks, in order

  1. 01Strict schema, field by field.
  2. 02Every signature, receipt by receipt.
  3. 03Hash chain and ordering, link by link.
  4. 04Every Merkle proof to the signed root, with a complete index bijection.
  5. 05The signed checkpoint: root, leaf count, chain head.
  6. 06Envelope consistency.
  7. 07Provenance, additionally, when a gateway key is pinned. A pass means the record is intact. What a pass does not mean is stated plainly below.

Agreement is measured, not promised.

Three verifier implementations, written in three languages, return one verdict on all 57 classical cases in the downloadable zero-dependency verifier. Separately, 28 post-quantum cases are specified and reference-verified: an ML-DSA-65 plus Ed25519 hybrid, implemented and cross-verified. Classical Ed25519 is the live profile. When the format is the product, disagreement between verifiers is a defect, so we count it in public.

Exhibit F · the verification corpus, counted the way we count it

57
classical cases, runnable in the downloadable zero-dependency verifier, on your machine, offline.
28
post-quantum cases, specified and reference-verified. ML-DSA-65 plus Ed25519 hybrid, implemented and cross-verified. Classical Ed25519 is the live profile.
3×1
verifier implementations in three languages, returning one verdict. A split verdict is a bug, and we treat it as one.

The boundary

What we will not claim.

A confident argument states its own limits before you find them. Here are ours, in the plainest words we have.

Limit 01 · coverage

“A verified bundle proves the integrity of every receipt present. It does not prove the operator recorded every action.”

Coverage is an operational property of a deployment. Integrity is what the math gives you. We prove integrity, and we say the coverage limit out loud.

Limit 02 · the record, not the act

AGA records and proves. As shipped, it does not enforce, block, or authorize anything.

A Decision Receipt is the record of a decision. Acting on that decision is wired per deployment, by you, and we will not pretend otherwise in a sales conversation.

Limit 03 · tamper-evident, not tamper-proof

Anyone can alter a receipt. No one can alter one and leave verification passing.

You watched this on the bench. The red verdict is not a failure of the product. It is the product.

If a pitch in this category claims more than the above, ask for the verifier and run it offline. You now know what it should check.

Distribution · named, fetchable objects

/technologyThe published construction: fields, canonicalization, the seven verification requirements, the security argument for the prefix-free Merkle. /verifyThe in-browser verifier. Load any Evidence Bundle and check it here, with nothing sent anywhere. /sample-bundle.jsonThe bundle this bench runs on. The same file, byte for byte, that the verifier above checks. /verify-sampleDownload the zero-dependency verifier and the sample bundle. One command, offline, on your machine.

The invitation

The invitation stands.

You have read the argument and pushed on a live exhibit. Two ways to keep pushing, both built for people who do not take vendors at their word.

60 seconds · your machine · no network

Run the 60-second evaluation.

Download the zero-dependency verifier and a sample Evidence Bundle. One command. 57 classical cases. If the verdicts disagree with this page, we want the bug report more than you do.

Run the 60-second evaluation

Bring your skepticism

Request info.

Ask us the question you would ask a vendor you do not trust yet. That is the correct posture. We answer with the format, the corpus, and the checkpoint math, not adjectives.

Request info