Notarized Agents: Receiver-Attested Confidential Receipts for AI Agent Actions
2026-06-02 • Cryptography and Security
Cryptography and SecurityArtificial IntelligenceDistributed, Parallel, and Cluster Computing
AI summaryⓘ
The authors explain that current AI agents can hide or change their activity logs because they create their own logs, making it hard to trust them. They propose a new system, called Sello, which makes the receiver of an agent’s actions create a secure, encrypted receipt and publish it publicly. This way, the agent’s owner can verify what actually happened without trusting the agent or its creator. They show how Sello works, its security against bad actors controlling the agent, and how it compares to similar systems, while also noting some challenges like possible collusion and adoption issues.
AI agent observabilityactivity logreceiptspublic transparency logreceiver-side signingHPKE encryptionMerkle logauthorization tokentamper-evidentcollusion attack
Authors
Juan Figuera
Abstract
Current AI agent observability is structurally compromised: the entity producing the activity log is the same entity whose activity is being logged. A compromised or buggy agent can omit, alter, or fabricate its own traces, and the operator running the agent has no independent way to detect tampering. We propose a class of protocols that resolves this by inverting the trust boundary: the service that receives an agent's call signs a receipt of what it observed using its own key, encrypts the receipt to the agent's owner, and publishes it to a public transparency log. The owner reconstructs a tamper-evident trail without trusting the agent or its operator. We instantiate the class as Sello, a protocol combining four properties absent in any current system: (P1) receiver-side signing, (P2) HPKE encryption to an owner public key bound to the authorization token via JWS, (P3) publication to a witness-cosigned Merkle log, and (P4) owner-side discovery by token reference. We describe the protocol, analyze its security under an adversary that controls the agent and its operator, present microbenchmarks of the cryptographic operations, and situate Sello among adjacent receipt-protocol work (Signet, AgentROA, Agent Passport System, draft-farley-acta, SCITT). We discuss known limitations including the suppression attack, service collusion, and the adoption-incentive problem.