AI agent audit trails, answered
Plain-language answers to the questions people ask about proving what an autonomous AI agent did: signed receipts, tamper-evident audit trails, offline verification, and the EU AI Act.
How do you prove what an AI agent actually did?
An AI agent should produce a signed receipt for each action. Before it acts it emits an admission receipt (who is acting, what they intend to do, the authorized scope, and the policy version). After it acts it emits an outcome receipt linked to the admission by a content-derived hash. Both are signed with Ed25519 and canonicalized with JCS (RFC 8785). Anyone can verify a receipt offline with just the agent public key, so the proof does not depend on trusting the operator.
What is an AI agent audit trail?
An AI agent audit trail is a record of what an autonomous agent did, in what order, and under whose authority. A useful trail is tamper-evident and independently verifiable, meaning a third party can confirm it was not altered without trusting the party that produced it. Nobulex produces this as a hash-chained sequence of signed receipts.
Why are normal application logs not enough to audit an AI agent?
A normal log lives in the operator infrastructure and can be edited or deleted by that operator, so an auditor reviewing it has to trust the exact party being audited. Signed, content-addressed receipts remove that trust: deletion shows up as gaps in the hash chain, and an action outside the authorized scope makes the admission and outcome hashes diverge.
Does the EU AI Act require logging for AI agents?
The EU AI Act (Regulation (EU) 2024/1689), Article 12, requires high-risk AI systems to keep automatically generated logs that enable post-hoc verification of how the system operated. An operator-controlled log the operator can rewrite does not satisfy independent verification. Signed receipts that anyone can verify offline are designed for exactly this.
How does Nobulex verify an agent action without trusting the operator?
Verification recomputes the content-derived hash (action_ref) from the record and checks the Ed25519 signature against the agent published public key. If either fails, the receipt is rejected. No call to Nobulex, the operator, or the platform is needed. The bilateral receipt pattern behind this is normative guidance in OWASP AST09, and Nobulex is the reference implementation of it.
Do I need a blockchain for verifiable agent receipts?
No. A signed, content-addressed receipt is verifiable offline against a public key, which gives non-repudiation without a settlement layer. For long-term anchoring you can optionally batch receipts into an RFC 6962 Merkle tree, but the core verification needs no chain and no gas.
What is a bilateral receipt?
A bilateral receipt is a pair: an admission record emitted before an action (carrying who, what, scope, and policy version) and an outcome record emitted after, linked by a content-derived hash. The pair lets a verifier confirm that what was authorized and what was executed are the same action.
Is Nobulex open source, and how do I install it?
Yes. Nobulex is MIT licensed. Install the Python SDK with pip install nobulex or the TypeScript SDK with npm install @nobulex/core. The code and specification are on GitHub.