AEF: Attested Execution Framework

1. Status#

AEF v0.3 is an early draft and will change in ways that break earlier assumptions. Breaking changes increment the major version. Every version is dated, kept at its own path, and recorded in CHANGELOG.md beside this document, because a framework that overwrites its own history is asking to be trusted rather than checked.

The author is a practicing assurance professional at a major firm who is building the antecedent system: signed act-log bundles for agent runs, with a verifier built as a hostile target, where one flipped byte must fail, manifest path collisions are tested rather than assumed impossible, and golden fixtures are re-pinned on every change. The doctrine came from building that system and breaking it. That system is not published and is not the reference implementation of this series; AEF 1900 section 5 states which is and why the two are named apart.

2. The problem#

Someone asks you to prove a piece of work was done correctly. It was done fourteen months ago, by an agent, across nine steps and four systems. Logs exist. They were written for debugging, so they sit in mutable storage the operator controls, record whatever an engineer thought worth printing, and say nothing about what the agent was permitted to touch or what the person approving actually saw. The person asking does not trust the operator. That is not an accusation. It is the reason they were sent.

You cannot answer them. Nothing in that pipeline was built to survive a reader whose job is to disbelieve it.

That demand is neither hypothetical nor new. FDA auditors found 618 of 867 Industrial Bio-Test studies invalid, and the Good Laboratory Practice rule followed in December 1978. Enron and WorldCom collapsed, and the Sarbanes-Oxley Act followed in July 2002. The SolarWinds compromise surfaced in December 2020, and Executive Order 14028 followed in May 2021. Each had a party positioned to demand proof: an agency reviewing a submission, an auditor signing an opinion, a government buying software.

The demand is not universal, though, and the exceptions are more instructive. Algorithmic content moderation and ranking have been consequential since roughly 2010 and acquired no United States requirement at all. The European Union imposed independent audits only from 2024, and in the first cycle nineteen platforms drew one negative opinion and four disclaimers of opinion. Automated hiring is stranger still: applicants have had standing under Title VII since 1964 and adverse impact guidelines since 1978, and algorithmic screening still ran for decades producing nothing. New York City required posted bias audits from July 2023, and in December 2025 the State Comptroller found the city's enforcement of them ineffective. Automated claims adjudication acquired nothing at all. What eventually compelled production there was a single magistrate judge, in March 2026, ordering UnitedHealth to disclose how its tool worked.

Two cases break the easy explanation that standing is what matters. Industrial control systems run the same technology under two regimes: on the bulk electric system, critical infrastructure standards have been mandatory and enforceable since July 2008, carrying penalties of up to a million dollars per violation per day and a ten million dollar settlement against Duke Energy in 2019, while on municipal water systems the same equipment carries guidance and no comparable enforcement. Same technology, same severity, different examination authority, opposite outcome. The Consolidated Audit Trail cuts the other way. The Securities and Exchange Commission had complete standing throughout, adopted the rule in 2012, and the self-regulatory organizations represented the system as fully implemented only in July 2024. Twelve years, with a determined regulator, because the evidence had to be built collectively before anyone could demand it.

So severity is not the discriminator, and standing alone does not carry it either. Three conditions have to hold together. A party has to be able to detect that something went wrong, which rejected applicants and denied patients never could. That party has to be able to compel production, which advertisers achieved with no statute at all, by making independently accredited measurement a contractual precondition of payment. And producing the evidence has to cost less than the harm it addresses, which is where the Consolidated Audit Trail sat for a decade.

Agent-executed work is already being deployed where the first two conditions hold: work done for a paying client, work inside an audited process, work a regulator examines, work a counterparty tests against a contract. The third is the open one, and it is the one this framework is for. Standing and detection arrive from outside and cannot be engineered. Production cost can be, and making proof cheap at the time of the run is how a demand that arrives years later gets met at all. Where agent work produces diffuse harm and no counterparty can detect it, the same reasoning predicts that no requirement will attach and that this framework will not be adopted there. Section 12 states what would show this wrong.

3. Why now#

Agents began executing multi-step work with consequences outside the sandbox: modifying production systems, moving money, filing documents, shipping code other work depends on. The evidence they leave is telemetry built for debugging, which makes it mutable, unsigned, retention-limited, and complete only where somebody instrumented. Sign-off is being given now against that material.

4. Scope#

AEF 1000 defines the artifact as an attested execution record, or aer: the evidence produced by a discrete unit of agent-executed work, called a run.

Contents of an aer:

• Act log: instructions, tool invocations, and effects, in order.
• Input state: what was given and read, by content hash.
• Output artifacts: what changed, hash-bound to the record.
• Permission surface: what the agent could touch, distinct from what it did.
• Approval record: who approved, when, and what was in front of them.
• Signature and key binding: what sealed the record, under whose key.
• The verifier, treated as an artifact of the framework.

Lifecycle: capture, sealing, custody, retention, verification, and re-verification after keys rotate.

The assertions an aer supports: that this run occurred under this configuration, that this is what it did within a declared scope, that the record is complete against that scope and unchanged since sealing, and that this person approved after seeing this.

Adversary#

The aer is designed against an operator who wants a favorable account of work already done and who controls the systems that produced it. What it survives is a property of the design, not of anyone's intentions. AEF 1100 carries the full model.

• Editing a sealed record: survived, detected by the verifier.
• Replay against different work: survived, where inputs and outputs are hash-bound.
• Deletion inside a sealed record: survived. Deletion of the whole record: not, absent an external index.
• Backdating and key compromise: survived only against a time source and key history the operator does not control.
• Suppression at the source: not survived. An event never emitted leaves nothing to detect.
• Collusion with the approver: not survived. The result is a faithful record of an approved lie.

5. Out of scope#

Every boundary refused now is one nobody has to litigate later.

• Model safety and alignment. An AEF-conformant record can document, in verifiable detail, a run that should never have been permitted. The framework is indifferent to the agent's merits.
• Agent capability evaluation. Benchmarking measures capability, not a particular execution. Conflating them makes both unfalsifiable.
• Regulatory compliance mapping for any jurisdiction. Mapping dates the framework to one regime and one year, and invites the reading that conformance produces compliance. It does not.
• Vendor-specific implementation. A specification only one implementation can satisfy is that implementation's documentation.
• Substantive correctness of judgment. The record establishes what was done and what was known at the time; whether the judgment was right is the reviewer's question.
• Security controls and identity infrastructure. Key management, access control, and platform hardening are prerequisites this depends on and does not redesign.

Adjacency, acknowledged once: software supply chain provenance solves an overlapping problem for build artifacts, and the assurance professions already answer many of these questions for human work. Reuse both. Neither is authority here.

6. Who this is for#

These audiences want different things. The framework is the floor between them, not a win for any one.

• The operator running agent systems. Wants to ship without being blocked by an unanswerable question. Gets a target to build to.
• The reviewer: auditor, regulator, counterparty, opposing expert, internal quality function. Wants to disbelieve efficiently. Gets a specific thing to ask for and a way to test whether they got it.
• The accountable signer. Gets a written account of what the signature covers and what they must have been shown for it to mean anything.

7. First principles#

Every future document must trace to one of these.

1. A control is not evidence until it has been observed enforcing. Authoring a policy is not implementing it. The artifact is the observed denial: the run blocked, the write refused, the gate failed.

1. Verification must not depend on the operator, and the trust it does require must be declared. Zero trust is unavailable: every chain ends in a key, a root of trust, a time source, a compiler, silicon, and a framework demanding otherwise would be unimplementable, including by the reference implementation. What can be demanded is that verification never needs the operator's cooperation, explanation, or continued good behavior, and that every remaining trust dependency is external to the operator, enumerated, and stated together with what fails if that trust is misplaced. Either that failure consequence is written down or it is not, which a reviewer settles in one pass; a record whose dependencies go unstated is not verifiable, because the reviewer cannot tell what they are being asked to accept. Whether a trust base is irreducible is a different question, and this principle does not ask it, because AEF 1101 is where it can be tested.

1. Scope must be declared, and absence within it is a finding. Complete means complete against a stated boundary; without one the word can't be tested and can't be false. Within a boundary, a step that produced no evidence is unsupported rather than presumed fine.

1. An untested backup, log, or attestation is a claim, not a control. A restore never performed is a hypothesis about a restore. A verifier that has never rejected a tampered record verifies nothing.

1. Decision quality and outcome quality are separate. Evidence must capture what was known at the time, not what turned out to be true. A record assembled afterward gets shaped by the outcome, usually in good faith.

1. A signature requires a defined referent. Signing means nothing unless it's established what was signed, what was asserted, what the signer was shown, and when. Most sign-off on agent work fails this today.

8. What this is not#

It is not a trust or safety measure for AI. Conformance says the record can be defended and says nothing about whether the work should have happened. A conformant record of a catastrophic run is an expected output.

It is not documentation for one system. The reference implementation exists to prove the specification is buildable and to find where it isn't.

9. How this gets built#

Documents are numbered in blocks: 1000s foundational, 1100s threat and adversary, 1200s verifier and conformance, 1300s the record itself, 1400s custody and time, 1900s records about the framework itself. This charter is AEF 1000. Published: 1001 Terminology, 1100 Threat model, 1101 The trust base, 1200 Verifier requirements, 1300 Record structure and scope declaration, 1900 Provenance findings. Committed and unwritten: 1201 Conformance and self-test, 1301 Approval and signature semantics, 1400 Sealing, time, and re-verification.

Each document answers one open question, is readable by someone who has read nothing else, and folds into a numbered release once it has stopped moving. The open-questions list lives beside this charter and is the roadmap. No requirement ships until something has been built that satisfies it and something has been built that fails it.

After v0.3, AEF 1000 is frozen. It changes only for cross-references to later documents and for errata. Substantive work moves to the numbered series, where it can be argued with one question at a time. A cornerstone that keeps moving is not a cornerstone.

10. How to disagree#

A framework nobody argues with is a blog with document numbers.

Disagreement goes in the public repository, against the document it concerns. Every substantive objection gets one of three outcomes, in writing, attributed: adopted with the document revised, rejected with the reason stated, or recorded as unresolved and published inside the document itself. Documents ship with their live objections attached.

11. Governance#

The author wrote v0.1. The editor is a seat rather than a person: the editor cuts releases, rules on objections, and can transfer the seat to a named successor in a dated release. A vacant seat is governed by the dormancy clause below.

The intent is to move this to a neutral standards body, meaning an open organization with a published process and no single-vendor control. The trigger is two independent conformant implementations plus adoption by at least one organization unconnected to the author. Until then the framework has an editor and no institution, and readers should price that accordingly.

Dormancy is declared rather than inferred, because a condition with no observer is not a condition. Anyone may open a dormancy notice as an issue in the framework's public repository, titled as such. A notice must state the date it is filed, the most recent release it can find, and the basis for believing the framework has been abandoned. Anything less is not a notice, because a reader cannot check it.

A notice opens a ninety-day response window, long enough to outlast an ordinary absence and short enough that a framework cannot sit abandoned while everyone waits to be sure. Any substantive response from the editor, in the repository and within the window, closes the notice and the framework continues. Silence through the full window completes the notice, and the framework is dormant from the date the window closed. Anyone may then continue it under the same license without permission.

The notice and everything filed against it stay public whichever way it resolves. A notice the filer withdraws stays in the record as well, marked withdrawn rather than deleted, on the same reasoning that keeps superseded versions readable: a record that retains only the exchanges that went somewhere is not a record.

If the editor reappears after a notice has completed, the fork that resulted is legitimate and stays legitimate. The original editor may resume publishing under the original line, and both lines then exist. What the original editor cannot do is unwind work done in good faith during dormancy, or revoke what the license already granted, because CC BY 4.0 does not permit it.

Forking is a right rather than a tolerance. CC BY 4.0 is irrevocable, so nothing here can be withdrawn from anyone who already has it. If the editor goes quiet, changes direction, or is simply wrong, fork it and say what you changed. That right is the reader's insurance against the author, and stating it plainly is what makes the framework safe to build against.

There is no certification body, registry, trademark enforcement, or fee. Conformance is a claim an operator makes and a reviewer tests.

The author's employer is context for how these problems were learned, is not a party to this framework, does not endorse it, and bears no responsibility for it.

12. Falsification#

This framework is wrong or unnecessary under any of the following.

Platform providers ship signed execution records by default, verifiable without trusting the platform. Then the artifact layer here should withdraw to a thin conformance profile.

A standards body publishes something better. Then this folds into it and stops.

Agent work runs for a sustained period in settings where a counterparty can detect a bad outcome, can compel production, and where producing an aer costs less than the exposure, and no demand for evidence follows. That is the direct test of section 2's three conditions, and it does not require agent work to be anyone's first exception. The discriminator is equally wrong if requirements attach reliably where none of the three hold, or if the third condition turns out not to bind, meaning cheap evidence gets demanded no more often than expensive evidence.

Verification costs more than proving the work is worth. Then the framework is correct and irrelevant, which is the same as wrong.

13. License and citation#

Licensed under Creative Commons Attribution 4.0 International (CC BY 4.0). An adoptable license is a requirement rather than a courtesy: a framework that can't be copied into someone else's policy or contract never becomes one.

Cite as:

Stellmacher, G. (2026). AEF 1000: Charter, v0.3. 11 August 2026. https://grantstell.com/aef

Cite the version and date, always.