Research note · August 24, 2026
How to prove a human approved an AI agent action
To prove that a named human approved an AI agent action, retain a tamper-evident record that binds the exact action to the signer's authenticated identity, the policy used, the information shown before approval, the decision time, and the execution result. The auditor should be able to verify that record without trusting the agent that requested the action.
Short answer
An approval button or application log is not enough on its own. The evidence must show who decided, what that person reviewed, which action the decision covered, and whether the record changed afterward.
The minimum evidence packet
The table below is a practical control design, not a statement that every regulation requires each field in this exact format. The fields close the common gap between "a human was somewhere in the process" and proof tied to one consequential action.
| Evidence | What the record should contain |
|---|---|
| Exact action | Tool, operation, target, environment, and a digest of the complete payload. |
| Requesting actor | The agent, model, workflow, and run that requested the action. |
| Named signer | The human identity plus the identity provider or authenticated channel used. |
| Information reviewed | The action, consequence, context, and risk information presented before the decision. |
| Policy | The policy identifier, version, decision path, and any limits or expiry. |
| Decision | Approve, deny, or expire, with an unambiguous timestamp. |
| Integrity proof | A signature and published verification key, or another independent tamper-evidence mechanism. |
| Execution result | Whether the authorized action ran, what changed, and the identifier of the resulting event. |
What the auditor should be able to test
- Recompute the action digest and confirm that it matches the payload the signer approved.
- Verify the receipt signature against a published key controlled outside the agent's runtime.
- Confirm that the signer's identity came from the stated identity provider or authenticated approval channel.
- Inspect the policy version and confirm that the decision was valid for the target, environment, amount, or other stated scope.
- Match the receipt to the downstream execution event. An approval that was never used and an action that ran without approval are different findings.
A receipt you can verify
Permission Protocol publishes a demo production-change receipt with a real Ed25519 signature. The page verifies the exact payload bytes in the browser. The payload, signature, and public key are also downloadable for an independent command-line check.
How this relates to SR 11-7
Federal Reserve supervisory guidance SR 11-7 addresses model risk management at banking organizations. It calls for strong governance, clear responsibility for model-related activities, effective challenge, validation, and documentation detailed enough for a party unfamiliar with the model to understand how it operates and its limitations.
A per-action approval receipt can support that governance record by identifying the responsible decision-maker and preserving the decision context. It does not replace model inventory, validation, monitoring, or the rest of the model-risk program.
Primary source: Federal Reserve SR 11-7 (PDF)
How this relates to the EU AI Act
Article 12 requires high-risk AI systems to technically allow automatic event logging. Article 14 requires those systems to support effective oversight by natural persons. Depending on the system and use case, the overseer must be able to understand relevant capabilities and limits, detect anomalies, interpret outputs, override or reverse an output, and stop the system safely.
A signed approval record can show that an oversight step occurred and what it covered. It cannot prove that the overseer was competent, had enough information, or exercised meaningful judgment. Those facts require operating evidence beyond the receipt.
Primary source: Regulation (EU) 2024/1689
Controls a receipt does not replace
- Risk classification and documented control ownership.
- Model testing, validation, monitoring, and change management.
- Training and authority for the people assigned to oversee the system.
- Retention rules, access controls, incident response, and periodic control testing.
- Evidence that the approved action and the executed action were the same.
Frequently asked questions
How can a company prove that a named human approved an AI agent action?
Keep a tamper-evident record binding the exact action to the signer's authenticated identity, the information reviewed, the policy applied, the timestamp, and the execution result. Make the record exportable and independently verifiable.
Does a signed AI approval receipt prove regulatory compliance?
No. It is one evidence artifact. Compliance depends on the system's classification, the organization's obligations, the design of the full control environment, and how those controls operate in practice.
This research note provides technical control-design information, not legal advice. It was last reviewed on August 24, 2026. For implementation details, read the guide to immutable audit receipts for AI agent actions.