A curated list of standards, regulations, and tools for making AI agent behavior verifiable and accountable — proving what an agent actually did, not just what it was allowed to do.
As AI agents begin to move money, call tools, and make changes on their own, two questions matter: who is behind the agent (identity), and what did it actually do, under what authority, and can anyone prove it (accountability). Most of the ecosystem ships the first and the "what it's allowed to do" half of the second (governance, guardrails). This list focuses on the missing piece: evidence — tamper-evident, independently verifiable records of agent behavior.
Contributions welcome — see Contributing. Listing is by relevance, not endorsement; fixes and additions via PR.
- Concepts
- Standards & Specifications
- Regulations
- Tools & Implementations
- MCP Governance & Security Servers
- Trust Scoring & Reputation
- Identity & Provenance
- Research & Reports
- Reading
- Contributing
- Execution / behavioral receipt — a signed record of a single agent action, verifiable by a third party.
- Bilateral receipt pattern — a pair of receipts per action: an admission receipt (intent, authority, authorized scope, policy in effect) before execution, and an outcome receipt (what happened) after, linked by a content-derived hash. Normative guidance in OWASP AST09.
- Offline / trustless verification — checking a record with only the record and a public key, without trusting the operator that produced it.
- Canonicalization — deterministic serialization so any implementation produces identical bytes to sign/verify. See JCS (RFC 8785).
- Hash-chaining — linking records so deletion or reordering is detectable as a gap.
- Identity vs. accountability — identity binds an agent to a party; accountability proves what the agent did. You need both. (primer)
- OWASP Agentic Skills Top 10 — AST09: Missing Execution Receipts — the accountability-gap risk class for agentic skills. The bilateral receipt pattern is its normative guidance (PR #35); the concrete
action_refconstruction is in the solutions catalog (PR #38). - OWASP CheatSheetSeries — practical guidance including JCS canonicalization, cross-agent accountability, and regulatory mapping for agent receipts.
- ISO/IEC 42001 — the AI management system (AIMS) standard; establishes requirements for governance, logging, and accountability of AI systems across their lifecycle.
- W3C Verifiable Credentials & Decentralized Identifiers (DIDs) — the identity layer agent accountability builds on top of.
- JCS — JSON Canonicalization Scheme (RFC 8785) — deterministic JSON serialization used to make signed records reproducible across implementations.
- Ed25519 (RFC 8032) — the signature scheme most receipt implementations use.
- RFC 3161 — Time-Stamp Protocol & RFC 6962 — Certificate Transparency — optional anchoring/timestamping for long-term non-repudiation.
- EU AI Act (Regulation (EU) 2024/1689), Article 12 — Record-keeping — requires high-risk AI systems to automatically record events over their lifetime to enable post-hoc traceability. High-risk obligations enforce from Dec 2, 2027. (mapping)
- NIST AI Risk Management Framework — "Measure" and "Manage" functions call for traceability and documentation of AI system behavior.
- Colorado AI Act (SB 24-205) — US state-level requirements around documentation and consumer impact of high-risk AI systems.
Open-source and commercial tools that produce or verify records of agent behavior.
- Nobulex — Open-source (MIT) reference implementation of the OWASP AST09 bilateral receipt pattern. Signed, hash-chained, offline-verifiable receipts for every agent action; Python (
pip install nobulex) and TypeScript (npm install @nobulex/core) SDKs; six framework integrations. Verify a receipt with just the receipt and a public key — no operator trust. - Microsoft Agent Governance Toolkit — governance and policy tooling for agent deployments, with an adopters registry.
- OpenTelemetry — the de facto standard for traces/metrics/logs; the operator-side observability layer that accountability records complement (traces tell you what your system saw; receipts tell a third party what happened).
Model Context Protocol servers that add policy enforcement, audit, or verification to tool-calling agents. (Discovered via awesome-mcp-servers Security section; descriptions summarized from each project.)
- Nobulex (
@nobulex/mcp-server) — covenant rule-checking + SHA-256 hash-chained, offline-verifiable audit logs for MCP agents. - aegis — policy-based governance for tool calls: YAML policies, approval gates, risk assessment, audit logging.
- agentward — least-privilege permission control plane; classifies sensitive data and generates compliance audit trails.
- agentgraph — trust verification and security scanning for third-party MCP servers with signed attestations (Ed25519/JWS).
- AgentValet — identity/credential governance broker issuing scoped, short-lived credentials per agent, with audit log and approval gates.
- arkforge-mcp — third-party certifying proxy: signs any HTTP call with an independent Ed25519 signature, RFC 3161 timestamp, and Sigstore Rekor anchor.
- kakunin-mcp — compliance and identity: verify an agent's certificate scope, read its behavioral risk score, and append to an immutable audit trail. X.509 identity via AWS KMS; MiCA / EU AI Act aligned.
- agent-os (agentos-mcp-server) — agent governance with policy enforcement, code safety verification, multi-model hallucination detection, and immutable audit trails.
- mcp-guardian — security/governance proxy: YAML policies (blocklists, rate limits, token budgets), OAuth 2.1/OIDC with RBAC, Prometheus metrics, and a formal STRIDE threat model.
- jamjet-policy — MCP stdio interceptor applying one YAML policy file (block / require_approval / audit / budget cap) to tool calls, with a unified audit log across adapters.
- shield — local guardrail proxy that blocks destructive tool calls and adds MCP supply-chain protection (tool-catalog pinning, tool-poisoning and prompt-injection scanning), with approval gates and audit logging.
A verified track record of behavior can become a portable reputation — a "credit score" for agents. Approaches vary in how the score is computed and how portable it is.
- Nobulex trust score — reputation derived from cryptographically signed action receipts; independently reproducible by any verifier from the receipt corpus. (methodology)
- agent-trust-stack-mcp — cryptographic provenance, bilateral blind reputation scoring, and tamper-evident logging; Python and TypeScript, with Bitcoin-anchored provenance chains.
- agentforge-trust-mcp — query an AgentForge Trust Score (0–100 across security, code health, behavioral audit, community trust, and EU compliance) for any MCP server before connecting.
- agentstamp — trust intelligence: identity stamps, reputation scoring, a registry, and forensic audit trails.
Identity answers "who is behind the agent" — the complementary half of accountability. (why you need both)
- Concordium — identity-focused approach using zero-knowledge credentials to verify a real party stands behind an agent.
- Sigstore — keyless signing and a transparency log (Rekor); widely used for software supply-chain provenance and applicable to agent artifacts.
- C2PA — content provenance standard; relevant where agents produce or handle media.
- "Auditable Agents" — defines five dimensions of agent auditability and three mechanism classes (detect, enforce, recover) for keeping harmful agent actions answerable after deployment.
- "Right to History: A Sovereignty Kernel for Verifiable AI Agent Execution" — argues individuals are owed a tamper-evident, independently verifiable record of every AI agent action run on their hardware; implemented as a Rust sovereignty kernel (PunkGo).
- "Verifiability-First Agents" — cryptographic attestations, lightweight audit agents, and challenge-response protocols to detect and remediate misaligned behavior in autonomous LLM systems.
- "Creating Characteristically Auditable Agentic AI Systems" — design characteristics for building agentic AI systems that are auditable by construction (Intelligent Robotics FAIR 2025).
- The AI Agent Accountability Landscape — a one-page map of this whole space (identity, governance, evidence, trust scoring, standards).
- Why evidence, not just governance, for AI agents
- How to build a verifiable AI agent audit trail
- OWASP AST09: execution receipts for AI agents
Additions and corrections welcome. Open a PR that:
- Adds the item to the most relevant section, in the existing format (name → link, then a concise, factual one-line description).
- Keeps descriptions neutral and accurate — no marketing superlatives.
- Links to a real, working project, standard, or regulation.
Listing here is not an endorsement, and inclusion of a project does not imply it is complete or production-ready. Fixes to any description are welcome from the projects themselves.
To the extent possible under law, the contributors have waived all copyright and related rights to this work.