Every action carries a signed receipt of what your agent planned, what it was allowed to do, and what happened.
One receipt per signed action
Intent, recorded before
Sign before the tool runs, and what the agent set out to do is sealed into the receipt.
The policy gate
The receipt records the policy decision for the action. If no policy covers it, compliance mode records an observation.
The result, when you sign it
A result receipt seals a digest of what the tool sent back. A decision receipt on its own records no outcome.
Chained to the past
In compliance mode, each receipt signs a hash of the one before it, so editing an earlier receipt breaks the chain.
Proof of when
Independent timestamps provide evidence that a recorded digest existed by a particular time.
Verifiable by anyone
Auditors, customers and regulators check the proof themselves, on a public page.
Connect your workflow
Connect your agent through the SDK or an integration. Retain the returned receipt alongside the action result.
Evidence for the questions that matter
How is this different from our logs?
Your logs are records your own system keeps. An admin can usually edit them, and an outsider has no way to tell. A receipt is sealed when the action is signed: edit the sealed record and the check fails, and anyone holding the receipt can run that check themselves. Compare logs and receipts.
What did an AI agent do, and was it allowed?
Keep a signed record of the action and the policy decision, with input and result digests when you send them. Review incidents and approvals in one workspace, then share the evidence behind a decision. Understand agent receipts or see how policy enforcement works.
How do we prepare AI audit evidence?
Export records for your compliance review and map receipt fields to the requirements that apply to your organisation. Your reviewers still assess the system and its controls; a receipt alone does not establish compliance. Prepare a compliance report and explore AI Act audit packs.
Can someone verify our records without an Asqav account?
Yes. A recipient can check receipt signatures and the evidence supplied with them using the public verification tools or SDK. Verification checks the signed record and its integrity; it does not independently establish that a real-world claim in that record is true. Verify evidence independently.
Start with the SDK quick start, find your agent framework, or compare plans.
Recordkeeping across jurisdictions
| Regulation | Jurisdiction | Recordkeeping context | Status |
|---|---|---|---|
| EU AI Act | European Union | Art. 12: automatic logs for high-risk AI systems | From |
| DORA | European Union | ICT risk records and incident reporting | In force |
| SEC 17a-4 | United States | Electronic records: WORM or audit-trail alternative | In force |
| HIPAA | United States | §164.312(b) audit controls | In force |
| NYDFS 500 | New York | §500.06 audit trails | In force |
| CIRCIA | United States | Incident reporting for critical infrastructure | Rulemaking |
| Colorado ADMT Act | Colorado | Documentation and three-year record retention | From |
| Texas TRAIGA | Texas | AI use restrictions and specified disclosure duties | In force |
| NIST AI RMF | United States | Risk-management framework | Voluntary |
| NIST SSDF | United States | Secure development practices | Voluntary |
| ISO/IEC 42001 | International | AI management systems, certifiable | Voluntary |
| OWASP LLM Top 10 | International | Security guidance for LLM systems | Voluntary |
| AIUC-1 | International | AI agent security standard | Voluntary |
Receipts support recordkeeping; they do not by themselves establish legal compliance. Applicability depends on your systems and jurisdiction. EU high-risk timelines differ between Annex III and regulated products. Follow each linked authority for the current requirements.
The receipt format is public and submitted as an IETF Internet-Draft.
Every receipt can be verified independently.
- ML-DSA, NIST FIPS 204
- SHA-256 chaining
- RFC 3161 timestamps
- OpenTimestamps