Research

Aqta Research (2026). Decision Receipts: A Verifiable Primitive for AI Evidence That Survives a Challenge. Working paper v0.1, Aqta Technologies, Dublin. https://aqta.ai/research/working-paper/

@techreport{aqtaresearch2026receipts,
  title       = {Decision Receipts: A Verifiable Primitive for AI Evidence That Survives a Challenge},
  author      = {{Aqta Research}},
  institution = {Aqta Technologies},
  address     = {Dublin, Ireland},
  year        = {2026},
  month       = {6},
  type        = {Working paper},
  number      = {v0.1},
  url         = {https://aqta.ai/research/working-paper/}
}

Page last updated 2026-08-12.

Our thesis

The core claim

AI made decisions cheap. Evidence is becoming expensive.

ATTESTATION-v1 is an open protocol; Seal is the reference implementation. Three pillars follow.

What a verified receipt proves, and against whom. A valid signature proves the receipt was produced by the holder of the issuer key and has not been altered since, and the key record tells you which key was the issuer's when. It does not prove the computation behind the decision ran as described: today the issuer is the root of trust, and Q1 below is the research programme to shrink that assumption. We state this here because pages like this one usually promise more.

Verify the primitive yourself

Verify a receipt

Four commands, no account. Once the key and the pack are on disk, nothing calls back to us:

$ pip install aqta-verify-receipt

$ curl -sL https://app.aqta.ai/security/issuer-keys.txt -o keys.txt

$ curl -sL https://app.aqta.ai/samples/sample-evidence-pack.zip -o pack.zip
$ unzip -oq pack.zip -d pack

$ python <<'PY'
import json
from aqta_verify_receipt import verify_receipt
# The pack's receipt is from 24 Jul 2026: pin the key that was current then.
key = next(l.split()[1] for l in open("keys.txt") if "2026-04-21" in l)
print(verify_receipt(json.load(open("pack/receipt.json")), trusted_public_key=key))
PY

VerifyResult(valid=True, reason=None, key_source='pinned', envelope='ATTESTATION-v1')

The pack holds a receipt the production gateway emitted and signed on 24 July 2026, plus the policy text in force at that moment. The key it is pinned against is fetched separately from the issuer key record at app.aqta.ai/security/issuer-keys.txt, not read out of the zip. Keys rotate; receipts do not: the record lists every signing key with its validity window, permanently, so a receipt always verifies against the key that was current when it was signed. The cryptographic work is 751 µs at the median (signing 238 µs, roughly 4,200 receipts per second per core, measured over 10,000 iterations); the CLI takes about a second because a Python interpreter starts. The benchmark script is published, so the numbers are yours to reproduce or refute. Change one character in pack/receipt.json and the signature stops matching. To sign a receipt yourself in the browser, use aqta.ai/verify, which runs on a separate demo key rather than the production one.

Selective disclosure preview. BN254 Schnorr verification is live; a Groth16 verifier runs over a fixed demo circuit. Early research, not a shipped feature.

Where this sits

Neighbouring work

This is a crowded, fast-moving neighbourhood, and the honest map matters more than a category claim. IETF SCITT (RFC 9943, June 2026) defines receipts as proof of registration on a transparency log; ATTESTATION-v1 is a payload-level format for the decision itself, and the repository documents the relationship. C2PA signs provenance for media; sigstore signs artefacts, and since model-signing v1.0, ML model files. Hardware-attested inference has shipped commercially: TEE-based serving now issues per-response attestations, and the hyperscaler trajectory points the same way. Those systems attest the serving environment, and they relocate trust to the hardware vendor's attestation chain rather than removing it. Zero-knowledge proofs of full LLM inference exist in production at small-model scale, and the Hollow-LLM result (arXiv:2607.28884) shows why the binding problem stays open even there: proof of correct inference is not proof of which model did the work. Replication-based verification (TOPLOC, DiFR) binds computation but needs a re-executing verifier. At the IETF, other individual drafts describe signed receipts for machine decisions from different angles.

Our position on this map is deliberately narrow: an open payload format for the decision record, signed in-path before the action, with two independently implemented offline verifiers that agree on every conformance vector, running in production since April 2026. Q1 below is where this map's hardest open problem lives, and it is ours too.

Proof

The dated public artefact

The same signing pipeline that produces Seal receipts demonstrates the mechanism on a dated prediction. The primitive does not care whether the decision is a policy call or a forecast.

The ladder

Five questions, in order of difficulty

Evidence about an AI decision is not one property but five, and they stack: each question is only worth asking once the one beneath it holds. Naming where we actually stand on the ladder is more useful than a claim to have solved evidence, so here it is.

The order is the roadmap. We are not trying to solve trust in AI in one leap; we are answering progressively harder evidence questions, and saying out loud which ones are still open.

Open questions

Open research questions

If any of these resonate, email hello@aqta.ai with subject prefix [research].

Support

Infrastructure

Auth0 is the identity vendor for enterprise SSO (SAML/OIDC). Selected for WeBuild Cohort 2 under the Shared Island Enterprise Scheme (programme selection, not institutional backing).