I build Asqav — cryptographically signed, independently verifiable receipts for AI agent actions.
When an AI agent takes an action on your behalf, Asqav issues a signed receipt for it: what was decided, under which policy, at what time, bound to the payload it acted on. An auditor can verify those receipts without trusting us, without an account, and without network access — which is the only kind of audit evidence worth having.
Signatures are post-quantum by default (ML-DSA / FIPS 204).
Asqav is the compliance profile built on top of draft-farley-acta-signed-receipts-03 (ACTA), published as draft-marques-asqav-compliance-receipts. We run the two registries the profile needs, because RFC 8726 bars the Independent Submission stream from creating IANA registries.
The verifier and the conformance corpus are open and offline-capable. You do not need our service to check our claims:
python -m asqav.verifier.verify_receipt \
--receipt receipt.json --jwks jwks.json --offline
- asqav-sdk — client SDK, the open verifier and the cross-language conformance vectors
- asqav-registry — the two registries for the IETF profile
- execution-boundary-spec — co-authored normative spec for agent execution boundaries
Source-available client SDK under Elastic License 2.0; open verifier and conformance vectors under Apache-2.0; commercial signing service.