The thesis
AI has learned to act. Now it needs authority.
The first wave of AI produced intelligence. This one hands systems the power to do things: approve credit, flag a patient, move money, change production. Every one of those is an exercise of authority somebody delegated.
People have delegated authority for centuries. Machines have a config file.
Every instrument on the left binds a decision to somebody who answers for it, and each one can be produced later and checked by a person who was not there.
For people
Binds a person to a document.
Binds an agent to a principal.
Binds a representative to a scope.
Binds a decision to a ceiling.
Binds a commitment to an approval.
For autonomous systems
Binds a system to rules, not an action to an authority.
Binds a record to its own author.
Identity infrastructure answers which agent is acting, and answers it well. What a specific action was authorised to do, under which instruction and which rule, is a separate question, and it is the one still open.
Four things happen before the action, and one after.
The fifth is the only one that matters when the decision is challenged.
The instruction the session is bound to. Immutable once registered.
The rules the organisation wrote, evaluated against the declared action.
Cleared or refused, before the model or the tool is reached.
Signed either way. A refusal is a record, not an absence.
Verified offline against a published key, by someone who need not trust the operator and never contacts us.
Authority can be scoped, time-bounded, and consumed.
Seal enforces finite-use grants at the action boundary. Each use is claimed atomically, and a grant the requester signs for itself is refused by name.
Signed by the approver: scope, window, uses.
Checked against the grant before anything runs.
One use claimed; the record is signed either way.
The next attempt is refused, and the refusal is signed.
Allowances and refusals are committed to Seal Transparency, an append-only public log, so the history of issued records can be monitored by someone who never contacts us.
The signer is not the subject.
A record is worth something to a reviewer only because the party that made the decision is not the party vouching for it, and because none of the three can quietly do the others' job.
| Party | Can | Cannot |
|---|---|---|
| Sealissues the record |
|
|
| The operatorholds the record |
|
|
| The reviewerchecks the record |
|
|
An argument you can check in two commands.
Everything above is a claim. This is a real record from the production gateway: an AI agent proposed a push to production, and policy refused it before anything ran.
curl -sL https://app.aqta.ai/samples/sample-action.json -o record.json npx aqta-verify-receipt record.json --profile action-1 --key 9Y3Eiq6V8QjRDUM5nPqSwKIOPQaoEU4SbagfYFdvWa4
It reports valid. Change one character of the file and the signature fails. The key comes from the published key endpoint, and the format, both verifier implementations and every published conformance vector are public to inspect, run or reimplement.
The record formatThe Refusal LedgerWhat it does not proveCheck one in your browserHow independent the evidence isRun a pilot