Proof of what an agent did. A tamper-evident, content-private, independently verifiable record of a single agent action — checkable by anyone, without trusting the operator.
Created and stewarded by Action State Group — an open standard built to be donated to a neutral home. Its canonical home is agentactioncapsule.org.
We don't just describe the standard — we build it, run it, and prove it in public. The record:
Proposed the Canonical Payload Binding and presented interop results at the SCITT Working Group session in Vienna.
7 groups engaged in interop composing with the Agent Action Capsule as the record, run at the IETF 126 Hackathon.
Our cross-implementation test vectors were merged into the working group's own examples repo — a merged contribution, not a WG endorsement.
An independent IETF Internet-Draft (Rampalli / Glyphzero) extends the capsule with provenance binding.
Five open Internet-Drafts: the capsule, bilateral attestation, payload binding, accountability composition, and selective disclosure.
One capsule verified against our RFC 9162 log and a Microsoft CCF node — tested against CCF, not a Microsoft endorsement.
A public transparency log and a hosted verifier, live and Apache-2.0.
A log entry isn't proof. The system that ran the action is not a disinterested witness, and a log is only as good as the party that keeps it. Logs are mutable, operator-controlled, and offer no cryptographic guarantee that what you read reflects what actually happened.
The Agent Action Capsule is a signed, digest-committed record that anyone can verify independently — without trusting the operator or any single layer in the stack. It moves the evidentiary bar from "the operator says so" to "the math says so."
Traditional audit trails require trusting the infrastructure that generated them. A capsule inverts this: the cryptographic binding is the evidence, and the operator is not in the verification path.
Every verdict — including refusals — produces a capsule. A blocked or denied capsule is auditor-grade evidence that a gate worked.
This is a summary — the normative field-by-field definition lives in the spec at agentactioncapsule.org.
The action itself and its verdict-level disposition: executed, blocked, denied, errored, or timed out. The disposition is not inferred — it is explicitly recorded at verdict time.
The constraints that were evaluated before the action was dispatched. The capsule records what rules were in scope, so an auditor can reconstruct the gate logic applied at the moment of decision.
The effect that was committed, with a confirmed-effect binding that distinguishes a dispatched attempt from an observed result. Dispatch and confirmation are separate fields — neither implies the other.
An honest flag recording whether a human was in the loop for this action. The flag is part of the signed payload — it cannot be added or removed after signing without invalidating the capsule.
Approved is not the same as executed, and executed is not the same as confirmed.
The capsule keeps these three states strictly distinct, so the record reflects what actually happened — not what was attempted, not what was authorized, not what was assumed. This distinction is critical for post-incident review, regulatory inquiry, and any audit that must answer: did it actually run, and did it actually take effect?
Capsules are SCITT Signed Statements (COSE_Sign1), made transparent by registration in a SCITT Transparency Service. The format is deterministic and self-describing — a verifier needs only the capsule bytes and the public key to check the signature.
The profile builds on the neutral scitt-cose substrate, which verifies anyone's SCITT statements and treats the payload as opaque bytes. No vendor lock-in is introduced at the substrate layer.
Cryptographic signing envelope from the COSE family of standards
Supply-chain integrity, transparency, and trust statement format
Append-only log for public registration of signed statements
Neutral verification layer — payload-agnostic, operator-independent
Canonicalization, content-addressing, and digest-based referencing for capsule payloads — draft-mih-sokolov-scitt-payload-binding
Class-1 verification is reproducible from the capsule bytes alone — no keys, no network, no clock. Clone the repository and run against the included test vectors:
git clone https://github.com/action-state-group/agent-action-capsule
cd agent-action-capsule
pip install -e python
agent-action-capsule verify test-vectors/pos-executed-confirmed/input.json
# ok: True
agent-action-capsule verify test-vectors/neg-capsule-id-mismatch/input.json
# ok: False (capsule_id mismatch)Full quickstart and adapter guides live at agentactioncapsule.org.
Class-1 verification covers structural integrity and cryptographic correctness. It does not require a live transparency service, a network connection, or a trusted clock — making it suitable for offline audits, air-gapped environments, and forensic review long after the fact.
This is an individual IETF Internet-Draft, not a Working Group document and not an RFC. The SCITT and COSE substrate it builds on are themselves Internet-Drafts. No RFC number or WG adoption is claimed. The specification is intended for contribution to an appropriate standards body as the ecosystem matures. The standard is stewarded openly by Action State Group today and is built to be donated to a neutral home; its canonical home is agentactioncapsule.org.
For auditors and standards professionals, the capsule addresses a long-standing gap: how do you verify that an autonomous agent behaved correctly after the fact, without relying on the operator's own testimony?
Capsules are immutable records. Retrieve any capsule by its ID and verify it deterministically — the signed payload cannot be altered without breaking the signature, regardless of how much time has passed.
Every blocked or denied action produces its own capsule. A regulator or auditor can demonstrate that a gate fired — not just that the gate existed — by presenting the signed capsule with a blocked or denied disposition.
Because verification requires only the capsule bytes and the public key, audits are portable across operators, environments, and time. No proprietary toolchain or operator cooperation is required to check a capsule.
The Agent Action Capsule specification is developed in the open. Review the draft, open issues, and submit pull requests on GitHub. For questions about integration, standards strategy, or the broader Action State Group work, reach out directly.
The canonical home of the standard — overview, docs, verifier, and adoption guides.
The individual IETF Internet-Draft is published on the IETF Datatracker. Review the full specification, header claims, and verification algorithm.
The reference implementation, test vectors, and specification source are all open. Issues and pull requests are welcome.
For integration questions, standards discussion, or to learn how Action State Group stewards and intends to donate this open standard, reach out directly.
Agent Action Capsule