Your customer’s reviewer asks what your agent did. Hand them a record they can check.
This page is for teams shipping agentic AI products into financial services and insurance, at the moment a customer’s third-party-risk, model-risk, or internal-audit review asks what the agent did and how anyone would know.
The reviewer pack
Two pages you can forward without editing. It states what a pass proves, what it does not, and how to check a bundle in five minutes with no account. Written for the reviewer, not for you.
SHA-256 d48a620207f32445, full digest at aga-reviewer-pack.sha256.
The review is where the deal slows down.
The reviewer is not asking whether your product is good. They are asking what happens when it acts on their data, and what they will be able to show their own regulator afterwards. What most vendors can offer is an export from their own logs. That answers the question only for someone who already trusts the vendor, which is precisely the person the reviewer is paid not to be.
The alternative most teams already have is write-once storage. It is genuinely good at retention, and it is worth keeping. What it does not do is bind a record to the decision: nothing signs at the moment the call was permitted or denied, so an entry written late, or written wrong, is preserved as faithfully as a correct one. We compare the two honestly on the comparison page.
Three things, and none of them is a promise.
The evidence bundle
A portable file covering the decisions in scope. Each decision is a signed receipt, hash-chained in order, committed to a Merkle tree, and bound by a signed checkpoint over the count, head, and root.
The published format
The construction is specified, so the reviewer or their engineers can re-implement the check against the downloadable conformance vectors. The verifier to run for a verdict is the one whose command this page prints; it is published separately from the system that produced your bundle.
A verifier they run themselves
One command, or a browser page that works with the network off. Nothing calls back to you, and nothing calls back to us. That is the property that makes the record worth anything to them.
What it proves, and what it does not.
Both halves are on this page on purpose. A reviewer who discovers the limit on their own, later, stops believing everything above it.
The integrity of every receipt present
Each receipt is authentic, correctly ordered, and Merkle-included, and none has been added, altered, reordered, or truncated since it was signed.
Who issued it, when the key is pinned out of band
Provenance holds only if the reviewer pins your gateway public key from a channel other than the bundle. Without that pin the result is integrity-only, and the tools label it that way. A bundle re-signed under a different key is internally consistent too.
Not that every action was recorded
A pass says nothing about decisions never written down. Completeness is bounded by the tamper-evidence of the interception point, which sits outside the bundle. Expect the question and answer it with your deployment, not with the format.
Not that a permitted call executed, or was blocked
A receipt records the governance decision. Whether a denied action was actually stopped is a property of how the gateway is wired in your deployment, and it is an integration point, not a product promise.
Check it before you believe any of this.
The verifier is a standalone package that does not depend on the system which produced the bundle. Run it against a sample we publish, then against a bundle of your own:
npx -y @attested-intelligence/aga-verify@2.2.0 evidence-bundle.json
It answers VERIFIED, FAILED, or UNSUPPORTED_PROFILE. There is no partial pass: an algorithm it does not recognise is reported as FAILED rather than as a qualified success. Then do the check that actually matters. Change one byte in the bundle and run it again. It has to fail.
What a first engagement looks like.
A design partner puts the gateway in front of one agent, in one workflow, and produces an evidence bundle from real traffic. The output is something you can put in front of the reviewer who started this: a record, the format, and a verifier they run. It is founder-operated and scoped in weeks, not quarters.
Where this honestly stands: a reference implementation, a published standard candidate, and a working sealing tool, before the first pilot. Nobody outside the company has run the evaluation kit yet. If that matters to you, it should, and it is the reason a first engagement is priced and scoped as one. Pilot terms on request.
If a customer review is already on your calendar
Tell us the date and what the reviewer asked for. That is enough to say whether this is useful to you before either of us spends a meeting on it.