{
 "acronym": "AAT",
 "adoption": {
  "by": null,
  "level": "unmeasured",
  "probe_run": null
 },
 "aliases": [
  "draft-sharif-agent-audit-trail"
 ],
 "analog": "a standardized syslog/audit-log format, but hash-chained like a blockchain for tamper evidence",
 "collisions": [],
 "discovery": {
  "mechanism": "none",
  "path": null
 },
 "dispute": {
  "claims": [
   "Author markets EU AI Act / SOC 2 / ISO alignment; none of those frameworks has adopted or referenced this specific draft as far as could be verified here.",
   "No known implementation exists yet (implementation=none-found); this is a proposal, not a running system."
  ],
  "summary": "This is an individual Internet-Draft, not a Working Group item -- the IETF datatracker explicitly states such drafts are 'not endorsed by the IETF' and have 'no formal standing' in the standards process, and 'Intended status: Standards Track' is only the author's aspiration. No implementation, adopter or third-party citation of AAT was found in the sources checked; it is included here because it is the most complete public account/audit-log spec text found for this step, not because it has traction."
 },
 "evidence": [
  {
   "claim": "IETF Datatracker lists draft-sharif-agent-audit-trail as an active Internet-Draft (individual submission, not IETF-endorsed, no formal standing), authored by Raza Sharif of CyberSecAI Ltd, currently at revision -03 (last updated 2026-09-05, expires 2027-03-09), with prior revisions -00 through -02 dated back to at least March 2026.",
   "date": "2026-09-05",
   "label": "VERIFIED",
   "url": "https://datatracker.ietf.org/doc/draft-sharif-agent-audit-trail/"
  },
  {
   "claim": "The draft text (revision -03) specifies a JSON-based Agent Audit Trail (AAT) with mandatory fields for agent identity, action classification, outcome and trust-level reporting, SHA-256 hash-chained records per RFC 8785, optional ECDSA signatures, JSONL/Syslog/CSV export, and explicitly maps to the EU AI Act (Regulation 2024/1689) high-risk logging mandate (effective August 2026), SOC 2, ISO/IEC 42001, ISO/IEC 24970, prEN 18229-1 and PCI DSS v4.0.1.",
   "date": "2026-09-05",
   "label": "VERIFIED",
   "url": "https://www.ietf.org/archive/id/draft-sharif-agent-audit-trail-03.txt"
  }
 ],
 "form": "document-format",
 "governance": "IETF individual Internet-Draft; not adopted by any IETF working group, 'not endorsed by the IETF' and has 'no formal standing' in the IETF process (datatracker's own disclaimer)",
 "group": null,
 "history": [
  {
   "date": "2026-09-06",
   "note": "new record: found via search for 'agent audit log standard'; verified against datatracker.ietf.org and the archived draft text (revision -03, 2026-09-05); no implementation found"
  }
 ],
 "id": "agent-audit-trail",
 "implementation": "none-found",
 "last_verified": "2026-09-06",
 "name": "Agent Audit Trail",
 "native_status": "Active Internet-Draft (individual submission), Intended status: Standards Track; not a Working Group document",
 "origin": {
  "date": "2026-03",
  "org": "Raza Sharif / CyberSecAI Ltd (individual submitter)"
 },
 "part_of": null,
 "parties": [
  "agent-site"
 ],
 "phase": "draft",
 "probe": {
  "method": "GET",
  "on_absent": "There is no way to detect AAT usage from outside a system -- it describes an internal/exported logging format, not a discoverable service. Absence just means a given agent's logs were not inspected, not that AAT is unused.",
  "parse": "The spec defines a JSON record format, not a network endpoint: each record MUST carry record_id (UUIDv4), timestamp (RFC 3339), agent_id (URI), agent_version (semver), session_id (UUIDv4), action_type (tool_call/tool_response/decision/delegation/escalation/error/lifecycle), action_detail (object), outcome (success/failure/timeout/denied/escalated), trust_level (L0-L4), parent_record_id and prev_hash (SHA-256 of the previous record's RFC 8785 canonical JSON, forming a hash chain), and record_phase (pre_execution/post_execution/concurrent). The RECOMMENDED export format is JSONL. A conforming log is one where every line validates against these mandatory fields and the hash chain verifies.",
  "path": "{log_export_endpoint}"
 },
 "question": "Is there a standard, tamper-evident log format any autonomous AI agent can write its actions to, so a regulator, auditor or victim can later reconstruct exactly what it did and why?",
 "scope": "general",
 "spec_url": "https://datatracker.ietf.org/doc/draft-sharif-agent-audit-trail/",
 "step": "account",
 "summary_md": "Agent Audit Trail (AAT) is an individual IETF Internet-Draft proposing a standard JSON logging format for autonomous AI agent systems: each record must carry an agent identity (URI), a session id, an action type (tool_call, decision, delegation, escalation, error, lifecycle, etc.), an outcome (success, failure, timeout, denied, escalated), and a trust level (L0 no verification through L4 full mutual authentication with revocation checking) [1][2]. Records are linked into a tamper-evident hash chain -- each record stores the SHA-256 hash (per RFC 8785 canonical JSON) of the immediately preceding record -- with optional ECDSA signatures for non-repudiation, and a record_phase field (pre_execution/post_execution/concurrent) that distinguishes a log written before an action is allowed to run from one written after it completes [2]. This is a direct fit for this site's 'account' step: it is explicitly a logs/audit-trail format for reconstructing and judging what an agent did.\n\n**What it solves.** It gives autonomous-agent operators a single, exportable record format (JSONL is the recommended primary export, with Syslog and CSV also supported) intended to satisfy several overlapping compliance regimes at once: the EU AI Act's Article on automatic event recording for high-risk AI systems (effective August 2026), SOC 2 Trust Services Criteria, ISO/IEC 42001 and 24970, prEN 18229-1, and PCI DSS v4.0.1 [2]. Later revisions add a 'Decision Reproducibility' section distinguishing record reproducibility (available for any model) from full decision reproducibility (only for open-weight models run at temperature zero in an attested environment), and, in the current -03 revision, an 'Attestation Closure' requirement that the digests recorded cover the entire inference stack (model weights, tokenizer, chat template, inference-engine build, decoding configuration, numeric environment) to close forgery gaps [2].\n\n**What it does not do.** AAT does not define a discovery mechanism, a transport, or a place logs must be published -- it is a record format for whatever storage/export pipeline an operator already has. It does not define agent identity or authentication itself (trust_level is self-reported by the logging system, referencing an external identity mechanism such as the also-draft 'MCPS'/Agent Passport concept).\n\n**Current state.** As of 2026-09-05 this is revision -03 of an individual (not Working-Group) draft, authored solely by Raza Sharif of CyberSecAI Ltd, with 'Intended status: Standards Track' -- an author aspiration, not a Working Group adoption. The IETF datatracker's own boilerplate states individual drafts are not endorsed by the IETF and have no formal standing [1].\n\n**Who implements it.** No implementation, pilot, or third-party adopter was found in the sources checked; implementation is marked none-found and adoption unmeasured.\n\n**Disputed / unknown.** Whether this draft will be adopted by any IETF working group, referenced by an actual EU AI Act compliance guidance document, or implemented by any agent framework, is unknown. It is listed here as the most complete public spec text found for the 'account' step, explicitly flagged as early-stage and unimplemented rather than as an established standard.",
 "track": "ietf",
 "version": {
  "date": "2026-09-05",
  "label": "draft-sharif-agent-audit-trail-03"
 }
}