Verifiable Attestation
Signed audit evidence for AI agent actions with Ed25519 decisions, integrity metadata, hash chaining, and externally reviewable proof.
Signed Proof for Agent Actions
Every decision record is designed to answer the critical questions: who requested the action, what they attempted, when it happened, where it ran, what policy decided, and why.
"Signed decision records give security and audit teams concrete evidence they can review, export, and map to internal controls."
The Six Pillars of Audit Credibility
Identity (WHO)
The agent_id that requested the action, and the owner_id (the organization that owns the agent).
Intent (WHAT)
The full context object of the attempted action (the requested refund amount, the trade details, etc.).
Time (WHEN)
A precise, ISO 8601 formatted timestamp (e.g., 2025-10-07T15:52:07.123Z).
Location (WHERE)
The source_ip (anonymized for privacy) and region of the request.
The Decision (VERDICT)
The complete, cryptographically signed decision receipt with the policy id, allow/deny result, and reason codes.
Integrity (THE PROOF)
Supported audit entries include previous-hash metadata, creating a tamper-evident chain for verification.
Live Audit Trail Demo
Signed Audit Records
Policy Decision
Agent ap_49bf9a40de2e487eb2e470414c7a568b (Acme Corp)
10/7/2025, 9:13:28 PM
Passport Created
System (Aport Registry)
10/7/2025, 9:13:55 PM
Audit Record Details
Policy Decision
ap_49bf9a40de2e487eb2e470414c7a568b
The Six Pillars
Verification Status
Ed25519 Signature
ed25519:rmkQxbH/5QiczMF5M6pU2ddJCYU1SmvKxKj0fBgZg9GwkRjJwf8VVlzS5YU7rFYhJ4mxqUlSkzLoLvp+oh0DJQ==Record Hash
ztIM/nI7hVD8VW3dTmziVxOHg0EfBs5DP/FcBSQmZUQ=Attestation Capabilities
Tamper-Evident Hash Chaining
CRITICALCryptographic hash chaining links audit records so unexpected edits can be detected during verification.
Cryptographic Signatures
CRITICALEd25519 digital signatures attach a verifiable proof of origin and integrity to audit records.
External Verification
CRITICALIndependent reviewers can verify shared records through public verification endpoints without dashboard access.
Multi-Format Export
HIGHExport audit trails in CSV, PDF, and JSONL formats for review workflows and downstream analysis tools.
Compliance Evidence
HIGHDesigned to support evidence collection for SOX, GDPR, PCI DSS, HIPAA, ISO 27001, and internal AI governance reviews.
Decision Visibility
MEDIUMDashboard views and exports help teams review allow/deny decisions, policy reasons, and agent activity.
Tamper-Evident Hash Chaining
Cryptographic hash chaining links audit records so unexpected edits can be detected during verification.
Technical Implementation
Key Benefits
Real-World Use Cases
Universal Export Formats
CSV Export (Priority #1)
The universal language of data, finance, and auditing.
PDF Export (Priority #2)
Clean, professional, non-editable "Executive Summary" or "Compliance Certificate" for stakeholders.
JSONL Export (Priority #3)
For technical teams who want to ingest raw audit logs into their own security and monitoring systems.
API Integration
Verifiable Attestation Endpoint
GET /api/passports/{agent_id}/verifiable-attestationExport audit trails in multiple formats with cryptographic verification.
External Verification Endpoint
GET /api/verify/audit/{record_id}Third-party auditors can verify records independently without authentication.
Compliance Evidence
SOX Evidence
Control evidence for Sarbanes-Oxley audit workflows
GDPR
Data processing review and audit evidence
HIPAA
Healthcare access review support
PCI DSS
Payment workflow audit evidence
Make Agent Work Verifiable
Give auditors and security reviewers signed decision records with context, reasons, timestamps, and verification metadata.
APort focuses on signed, reviewable evidence for AI agent actions. Your compliance outcome still depends on policy configuration and your broader control environment.