AI agent identity vs. accountability: you need both
As AI agents start moving money and calling tools on their own, two questions matter: who is behind this agent, and what did it actually do? Identity answers the first. It does not answer the second — and the second is the half almost everyone skips.
What identity gives you
Agent identity binds an agent to a real, accountable party. Decentralized identifiers (DIDs), verifiable credentials, KYC/KYB, and zero-knowledge attestations all answer the same question: is there a real entity standing behind this agent, and can I confirm it? That matters — an anonymous agent with no accountable owner is a dead end for trust, and identity closes that gap.
But identity is bounded. It tells you who. It says nothing about what the agent did once it started acting, and it gives you no record that a third party can check afterward.
The gap identity leaves
An agent can be fully identified and still take an action it was never authorized to take. Knowing a verified party is behind it does not tell you whether a specific tool call was in scope, what its result was, or whether the log describing it was quietly edited afterward. Identity authenticates the actor; it does not produce tamper-evident, independently verifiable proof of the act.
For software that moves money, reads records, or executes changes, that is the question an auditor, a regulator, or a counterparty actually asks after something goes wrong: not "who owns this agent," but "what exactly did it do, under what authority, and can you prove it without me trusting you?"
Evidence: the second half
The answer is a verifiable record of behavior, not just identity. Each agent action produces a pair of signed receipts:
- Admission receipt (before the action): the agent, what it intends to do, the authorized scope, and the policy in effect — so out-of-scope actions are visible as a mismatch.
- Outcome receipt (after the action): what actually happened, linked to the admission by a content-derived hash.
Both are canonicalized with JCS (RFC 8785) and Ed25519-signed, then hash-chained. Anyone can verify a receipt offline with just the receipt and a public key — no trust in the operator, and deletion leaves a detectable gap.
Identity + evidence, side by side
| Question | Identity | Evidence (receipts) |
|---|---|---|
| Who is behind the agent? | Yes | Binds to the agent's key/operator |
| What did the agent actually do? | No | Yes — per-action record |
| Was the action in authorized scope? | No | Yes — admission receipt pins scope |
| Can a third party verify it without trusting the operator? | Partly (the credential) | Yes — offline, any verifier |
| Is tampering or deletion detectable? | No | Yes — signatures + hash chain |
They are complementary, not competing. Bind the agent to an accountable party with identity, then produce a verifiable record of each action bound to its authorized scope with evidence. Skip the second and "accountability" stops at knowing whom to blame, with no way to prove what happened.
Where Nobulex fits
Nobulex is the evidence layer. The bilateral receipt pattern it implements is normative guidance in the OWASP Agentic Skills Top 10 (AST09), and Nobulex is its open-source (MIT) reference implementation. The same records map onto EU AI Act Article 12 record-keeping. It works alongside whatever identity layer you use.
from nobulex.agent import Agent
agent = Agent("billing-bot")
receipt = agent.act("charge", scope="invoice:042")
assert receipt.verify() # recomputes action_ref, checks the signature, offlineGet started
pip install nobulex
# or
npm install @nobulex/coreFor the fuller argument, see why evidence, not just governance; for the standard behind it, OWASP AST09 execution receipts; and the audit-trail guide for a step-by-step build.