A single Proofable job records five things in order: who the human is, which agent ran, what that agent
was allowed to do, the decision to dispatch it, and what it actually returned. Each is signed and
carries a qHash, and the signed decision commits to the delegation and agent-identity that produced
it, so the chain can be rebuilt from the records alone on any machine.
The chain
The joins are hashes
A database row can point at another row only inside that database. These records point at each other
with hashes, so the pointer survives export.
delegationQHash and agentIdentityQHash inside the signed decision name the authority and the
agent that produced it.argsDigest is a sha256 over the request as sent, so a reader holding the decision can recompute
what was authorized without trusting a log.- The job record carries the
terminalQHash of the signed receipt for that execution, and the same
delegationQHash and agentIdentityQHash the decision named.
The decision is recorded before the job exists, so its own jobId is null. The create response
returns the jobId and the decision qHash together, and the two hashes above tie the decision to the
job record without it.
That is what makes the chain checkable by a third party: nothing in it requires reading our database,
which is also why an external reviewer or another agent can audit a run they did not make.
Run it end to end
The reference kit drives all five steps against the hosted service and writes the records to a folder
on your machine. It needs your own access key, because it runs real agent jobs against your plan.
verify needs no network and no account. The eight cases cover an allowed job, an action outside the
delegation, an approval that arrives, an approval that never arrives, revocation before dispatch,
expiry before dispatch, reuse of a revoked grant against a valid control, and revocation while a job is
running. Their expected outcomes are listed in the kit’s README.
The same cases run in CI from the same kit, and fail the build when a record does not verify:
public/evidence/aaif/authority-at-dispatch/action.
Check a record without taking our word for it
One function, no network call, no account:
It recomputes the qHash from the envelope and recovers the signer from the signature, with no
network call and no account. The CAIP-380 profile documents the canonical
form, so you can write the same check in another language, and the signing
format covers wallets that sign with something other than an EOA.
Published runs, with the records and a script that verifies every envelope in them:
authority-at-dispatch evidence.
What the chain does not cover
- The effect at a target you control. Records state effects as the service observed them at the job
boundary. A readback taken at a target outside that boundary is a separate observation, and the kit’s
URL fetch is where to add one.
- How long a revocation takes to reach the check. A revocation lands on the next dispatch. A job
already running is not cancelled mid-flight, and its receipt says so.
Build on it
- MCP setup for an agent that calls the service directly.
- JavaScript SDK for the same calls in your own code.
- Sell access to require a proof before your product serves a request.
Last modified on October 24, 2026
