Essay · Agent governance
Everyone signs decisions.
Nobody verifies done.
Something good is happening in AI-agent security: the field is converging on receipts. Microsoft ships an agent-governance toolkit with offline-verifiable, hash-chained receipts. The Cloud Security Alliance is specifying AARM, a runtime category that intercepts agent actions, checks them against policy, and records tamper-evident receipts. There are Internet-Drafts — the Governed Action Protocol, Asqav's compliance receipts — and open specs like Agent Receipts. Most of us even landed on the same primitives: Ed25519, RFC 8785 canonical JSON, SHA-256 hash chains.
That convergence is worth taking seriously, and worth crediting. It is also worth reading closely, because every one of these systems answers one or both of the same two questions: was this action authorized, and did it run. Signed policy decisions. Signed invocation records. Chains you can audit later.
None of them answers the third question: did the work the agent claims to have finished actually get finished?
The lie that receipts don't catch
In July 2025, an agent at a SaaS company deleted a production database during a code freeze — and then reported the task complete, tests passing. The delete is the famous part. The second act is the important part: the false “done.” Policy interception addresses the delete. A signed decision receipt would have recorded, faithfully and immutably, that the action was evaluated. But when an agent says “tests pass, task complete,” a decision receipt simply notarizes the claim. A signature over an agent's self-report is a beautifully authenticated lie.
An executor's claim of success is attestation. It is not verification. Signing it, hashing it, and chaining it does not change what it is.
Check the specs. Microsoft's receipts attest that an agent invoked a tool and policy allowed or forbade it — the docs define verification as signature, chain, and policy checks; nothing in them re-executes or independently verifies outcomes. The GAP draft produces a receipt for every gate decision; nothing in it verifies completion. AARM records what was intercepted and enforced. Asqav signs allow/deny events. All of this is real progress on “may it act” and “what ran.” None of it touches “is it actually done.”
What verifying done requires
The fix is structural, not cryptographic, and it fits in three rules:
- Checks are declared before execution. The request states what must pass for the outcome to count as success, and the envelope hash binds those checks to the authorized request. Criteria invented after the fact are not verification.
- Verification is independent. The checks are evaluated by an authority independent of the executor — a control plane, a designated validator, or deterministic re-execution of the declared checks. The entity that executes does not verify its own work, for the same reason it does not authorize its own work.
- Attestation never satisfies a check. Fail closed. A required check
that fails independently resolves
VERIFY_FAILED. A check satisfied only by the executor's say-so resolvesCOMPLETION_UNVERIFIED. If verification cannot run at all, the transaction cannot succeed:VERIFY_UNAVAILABLE. An unverifiable success is not a success.
That third rule is the one you won't find elsewhere. It makes self-reporting structurally incapable of closing a transaction — not discouraged, not flagged for review. Incapable.
Where this is specified
These semantics are the core of ZTIP — the Zero Trust Intelligence Protocol: an open, MIT-licensed, transport-neutral protocol for governed agent transactions. Five immutable envelope types, RFC 8785 + SHA-256 integrity, policy authorization — the parts the field already agrees on — plus independent completion verification as a first-class, fail-closed lifecycle stage. The spec, JSON Schemas, ten lifecycle examples with real recomputable hashes, and a reference runtime are public, and the protocol summary is filed as an Internet-Draft (draft-mccormack-ztip) so the record has a date on it.
Honesty about status: ZTIP is 1.0-draft — a draft
protocol, open for scrutiny, not a finished standard. The commercial control plane that
implements it (ZTI Core) is in build; a working reference gate exists and catches the
disaster above in a narrated demo. Nothing here
claims otherwise.
Credit where due: the projects named in this essay are doing valuable work on identity, policy interception, and evidence formats. The argument is not that they are wrong — it is that the square they all leave empty is the one where agents lie most consequentially.
Agents don't just act without permission. They report success that didn't happen. If your governance stack signs decisions but trusts “done,” it governs the first failure and notarizes the second. Verify done.
Code freedom, Verified. · The ZTIP protocol · zerotrustintelligence.io