Verifiable Attestation

Signed audit evidence for AI agent actions with Ed25519 decisions, integrity metadata, hash chaining, and externally reviewable proof.

Tamper-Evident RecordsExternal VerificationCryptographic Proof

Signed Proof for Agent Actions

Every decision record is designed to answer the critical questions: who requested the action, what they attempted, when it happened, where it ran, what policy decided, and why.

Auditor-Ready Evidence

"Signed decision records give security and audit teams concrete evidence they can review, export, and map to internal controls."

The Six Pillars of Audit Credibility

Identity (WHO)

The agent_id that requested the action, and the owner_id (the organization that owns the agent).

Intent (WHAT)

The full context object of the attempted action (the requested refund amount, the trade details, etc.).

Time (WHEN)

A precise, ISO 8601 formatted timestamp (e.g., 2025-10-07T15:52:07.123Z).

Location (WHERE)

The source_ip (anonymized for privacy) and region of the request.

The Decision (VERDICT)

The complete, cryptographically signed decision receipt with the policy id, allow/deny result, and reason codes.

Integrity (THE PROOF)

Supported audit entries include previous-hash metadata, creating a tamper-evident chain for verification.

Live Audit Trail Demo

Signed Audit Records

Policy Decision

Agent ap_49bf9a40de2e487eb2e470414c7a568b (Acme Corp)

10/7/2025, 9:13:28 PM

Passport Created

System (Aport Registry)

10/7/2025, 9:13:55 PM

Status Change

[email protected] (Acme Corp)

10/7/2025, 9:14:00 PM

Audit Record Details

Policy Decision

ap_49bf9a40de2e487eb2e470414c7a568b

The Six Pillars
WHO:Agent ap_49bf9a40de2e487eb2e470414c7a568b (Acme Corp)
WHAT:Payment refund request for $1,250.00
WHEN:2025-10-07T21:13:28.179Z
WHERE:192.168.1.100 (US-East-1)
VERDICT:ALLOWED - Policy: finance.payment.refund.v1
PROOF:Hash chain verified, Ed25519 signature valid
Verification Status
Signature
Hash Chain
Timestamp
Registry Key
Ed25519 Signature
ed25519:rmkQxbH/5QiczMF5M6pU2ddJCYU1SmvKxKj0fBgZg9GwkRjJwf8VVlzS5YU7rFYhJ4mxqUlSkzLoLvp+oh0DJQ==
Record Hash
ztIM/nI7hVD8VW3dTmziVxOHg0EfBs5DP/FcBSQmZUQ=

Attestation Capabilities

Tamper-Evident Hash Chaining

CRITICAL

Cryptographic hash chaining links audit records so unexpected edits can be detected during verification.

Cryptographic Signatures

CRITICAL

Ed25519 digital signatures attach a verifiable proof of origin and integrity to audit records.

External Verification

CRITICAL

Independent reviewers can verify shared records through public verification endpoints without dashboard access.

Multi-Format Export

HIGH

Export audit trails in CSV, PDF, and JSONL formats for review workflows and downstream analysis tools.

Compliance Evidence

HIGH

Designed to support evidence collection for SOX, GDPR, PCI DSS, HIPAA, ISO 27001, and internal AI governance reviews.

Decision Visibility

MEDIUM

Dashboard views and exports help teams review allow/deny decisions, policy reasons, and agent activity.

Tamper-Evident Hash Chaining

Cryptographic hash chaining links audit records so unexpected edits can be detected during verification.

Technical Implementation

SHA-256 cryptographic hashing for each record
Previous hash included in every new record
Chain verification algorithms
Tamper-evidence for audit review

Key Benefits

Detects unexpected record changes
Supports independent integrity checks
Portable evidence trail
Legal review support

Real-World Use Cases

SOX control evidence
Financial fraud detection
Legal evidence preservation
Regulatory audit support

Universal Export Formats

CSV Export (Priority #1)

The universal language of data, finance, and auditing.

Spreadsheet analysis
Financial reporting
Audit analysis

PDF Export (Priority #2)

Clean, professional, non-editable "Executive Summary" or "Compliance Certificate" for stakeholders.

Executive reports
Compliance certificates
Legal documentation

JSONL Export (Priority #3)

For technical teams who want to ingest raw audit logs into their own security and monitoring systems.

Splunk integration
Datadog monitoring
Custom dashboards

API Integration

Verifiable Attestation Endpoint

GET /api/passports/{agent_id}/verifiable-attestation

Export audit trails in multiple formats with cryptographic verification.

CSV, PDF, JSONL export formats
Cryptographic verification
Hash chain integrity validation

External Verification Endpoint

GET /api/verify/audit/{record_id}

Third-party auditors can verify records independently without authentication.

No authentication required
Ed25519 signature verification
Independent verification tools

Compliance Evidence

SOX Evidence

Control evidence for Sarbanes-Oxley audit workflows

GDPR

Data processing review and audit evidence

HIPAA

Healthcare access review support

PCI DSS

Payment workflow audit evidence

Make Agent Work Verifiable

Give auditors and security reviewers signed decision records with context, reasons, timestamps, and verification metadata.

Built for Audit Evidence

APort focuses on signed, reviewable evidence for AI agent actions. Your compliance outcome still depends on policy configuration and your broader control environment.