The Agent Audit Trail: a tamper-evident record format for AI agents, now royalty-free.
Your AI agent's logs are not evidence. A trace with forty seven steps tells you what the framework did. It does not prove the record was not changed afterwards, and it does not let anyone re-derive the decision the agent actually made. When the EU AI Act logging duty under Article 12 starts to bite, that difference stops being academic. Regulated users need a record that holds up, not a log file that anyone with write access can quietly edit.
That is the problem the Agent Audit Trail draft sets out to fix. It is an individual IETF Internet-Draft, first published on 29 March 2026, and it defines one thing well: a standard record format for what an autonomous agent did, built so that tampering is detectable by construction.
What it actually specifies
The draft is deliberately small. It defines a JSON record with twelve mandatory fields covering agent identity, the action taken, the outcome, and the trust level the agent held at the time. Records are canonicalised with JCS (RFC 8785) so that the same logical record always produces the same bytes, then linked with a SHA-256 hash chain. Each record carries the hash of the one before it, so removing or altering any entry breaks every record downstream. Signatures (ECDSA) are supported for non-repudiation.
The point worth sitting with: tamper-evidence is a technical property, not a policy one. A log in a writable database is not tamper-evident no matter who controls access to it. Hash-chaining plus canonicalisation makes a changed history mathematically visible, which is what an evidentiary record needs and an ordinary log cannot give.
There is a second idea in the design that most audit work skips. If the record captures the inputs a decision was made from, then at temperature zero you can re-derive that decision and check it against the record. The question stops being "do we have a log" and becomes "was this action the deterministic result of the recorded context, or was the record forged". That is the difference between storing what happened and being able to prove it.
Who is building on it
A record format is only real if other people implement it independently. Several have and the list continues every few days.
Mindburn Labs implemented the format in their helm-ai-kernel, a
fail-closed execution firewall for AI agents that emits signed
receipts and verifies evidence offline. Their code targets the draft
by name, and uses append-only, content-addressed, hash-chained
evidence storage. Independent work, not a partnership.
https://github.com/Mindburn-Labs/helm-ai-kernelJirka Borovec, an engineer at Lightning AI, built a second
independent implementation of the twelve-field record and shipped a
verifier, so a separate implementation can produce records the
verifier accepts. https://github.com/BordaThe Agentic AI Foundation, hosted by the Linux Foundation, references
the draft in its observability and governance working groups as the
record-shape standard that sits under the general logging duty.
https://github.com/aaif
Independent teams are arriving at the same shape from scratch, which is the strongest signal a design is right. Practitioner write-ups from Kiteworks and pattern catalogues like agentpatterns.ai describe the same primitives, hash-chained signed receipts with policy and approver metadata, without any coordination. When people who have never seen your draft reconstruct your design from the requirements, the design is doing its job.
It is royalty-free
As of this week, the IPR terms for the draft are updated to royalty-free, reasonable and non-discriminatory for all conformant implementers, with a defensive-suspension clause. In plain terms: build on it, ship it, sell your product on top of it, and pay nothing for the record format itself. The standard is meant to be adopted, not taxed. That is how a format becomes infrastructure rather than a paper nobody uses.
If you are shipping agents in a regulated setting
Define your receipt schema before you pick your runtime, so you can change tools later without tearing out your audit layer. Capture the inputs, not just the outputs, so decisions can be re-derived rather than only replayed. Chain and canonicalise, so the record is evidence and not just a log. For the wider agent and MCP threat surface around this, the OWASP MCP Security Cheat Sheet documents the controls that sit alongside a record format like this one.
The draft is here: https://datatracker.ietf.org/doc/draft-sharif-agent-audit-trail/
The updated royalty-free IPR declaration: https://datatracker.ietf.org/ipr/7559/
Raza Sharif is the founder of CyberSecAI Ltd, author of Breach 20/20, and works on identity, accountability, and evidence for autonomous AI agents. Contact: contact@agentsign.dev
Top comments (0)