Actor
The agent or automation that requested the action
Technical guide · Updated October 16, 2026
Published by Permission Protocol. Verification example added October 16, 2026.
Immutable audit receipts for AI agent actions
An immutable audit receipt is a tamper-evident record created for a specific AI agent action. It binds the exact action and payload to the agent, policy decision, named human signer when approval is required, timestamp, and cryptographic signature. It lets an auditor verify who authorized what before execution.
A receipt answers the question a log cannot.
The useful distinction is authorization before execution versus observation after the fact.
EvidenceOrdinary audit logAuthority receipt
Core claimThe action happenedThe exact action was authorized
TimingUsually after executionIssued before execution
Human accountabilityMay show a user or service accountNames the signer who saw the action
Payload bindingOften stores event fieldsCryptographically binds the exact payload
Tamper evidenceDepends on the logging systemSignature verification is part of the artifact
Policy evidenceMay record a resultRecords the policy and decision path
What a verifiable AI agent receipt contains
Intent
The stated purpose and action category
Exact payload
A hash of the command, change, message, or transaction
Scope
The repository, environment, resource, or workflow affected
Policy decision
Cleared, approval required, founder veto, or denied
Signer
The named human who approved a consequential action
Time
Issuance, decision, expiry, and execution timestamps
Signature
Cryptographic proof that detects later modification
The minimum trustworthy flow
The receipt is useful only when enforcement verifies it before the protected action proceeds.
1. Evaluate
Policy evaluates the exact requested action and context.
2. Decide and sign
Low-risk work clears by policy; consequential work routes to a named signer.
3. Verify and execute
The enforcement point verifies the receipt, scope, payload hash, signature, and expiry before execution.
Verify a signed example yourself
This example uses fictional people and a fictional migration. Its Ed25519 signature is real and can be checked against the published demo key.
Download the exact payload bytes, detached signature, and demo issuer key. With curl and an OpenSSL version that supports Ed25519, run:
curl -fSLo demo-payload.json https://permissionprotocol.com/demo-receipt/payload.json
curl -fSLo demo-payload.sig https://permissionprotocol.com/demo-receipt/payload.sig
curl -fSLo demo-issuer.pem https://permissionprotocol.com/demo-receipt/pp-demo-site-1.pub.pem
openssl pkeyutl -verify -rawin -pubin -inkey demo-issuer.pem -in demo-payload.json -sigfile demo-payload.sigA successful check exits with code 0. Change a byte in a copy of the payload and verify that copy with the same signature; verification must fail. Preserve the downloaded original for comparison.
This fixture signs the exact payload bytes. Hosted receipts use their documented canonical payload and signing input; follow the receipt specification for that format.
The check establishes that the key signed these bytes. It does not establish a real human approval in this fictional scenario, successful execution, or coverage of every execution path. For real receipts, authenticate the issuer key and examine how the signer identity was bound to the action.
Frequently asked questions
What is an immutable audit receipt for an AI agent action?
An immutable audit receipt is a tamper-evident record created for a specific AI agent action. It binds the exact action and payload to the agent, policy decision, named human signer when approval is required, timestamp, and cryptographic signature. It lets an auditor verify who authorized what before execution.
How is an authority receipt different from an audit log?
An audit log records that an event occurred. An authority receipt proves that a particular action was evaluated and authorized under a specific policy before execution. The receipt binds the signer and decision to the exact action payload, so a later edit or different action cannot reuse the approval undetected.
Does every AI agent action need a human signature?
No. Low-risk actions can be cleared automatically by policy, while consequential actions route to a named human signer and prohibited actions are denied. Every path should still produce evidence showing which policy made the decision.
Can an approval receipt be reused for another action?
A correctly designed receipt cannot authorize a different payload. The receipt includes a cryptographic hash of the approved action and scope. Verification fails when the payload, commit, repository, environment, or other bound context changes.
See what examiner-ready evidence looks like.
Deploy Gate adds signed authorization receipts to configured GitHub workflows. Inspect the approval record and test the enforcement path your team intends to use.
Watch the blocked-action flow