# AEF: Attested Execution Framework ## A framework for evidence of work executed by AI agents **AEF 1000. Version 0.2. Published 11 August 2026.** ## 1. Status AEF v0.2 is an early draft and will change in ways that break earlier assumptions. Breaking changes increment the major version. Every version is dated, kept at its own path, and recorded in CHANGELOG.md beside this document, because a framework that overwrites its own history is asking to be trusted rather than checked. The author is a practicing assurance professional at a major firm who is building the reference implementation: signed act-log bundles for agent runs, with a verifier built as a hostile target, where one flipped byte must fail, manifest path collisions are tested rather than assumed impossible, and golden fixtures are re-pinned on every change. The doctrine came from building that system and breaking it. ## 2. The problem Someone asks you to prove a piece of work was done correctly. It was done fourteen months ago, by an agent, across nine steps and four systems. Logs exist. They were written for debugging, so they sit in mutable storage the operator controls, record whatever an engineer thought worth printing, and say nothing about what the agent was permitted to touch or what the person approving actually saw. The person asking does not trust the operator. That is not an accusation. It is the reason they were sent. You cannot answer them. Nothing in that pipeline was built to survive a reader whose job is to disbelieve it. That demand is neither hypothetical nor new. It has arrived for every prior class of consequential automated work, usually after a failure. FDA auditors found 618 of 867 Industrial Bio-Test studies invalid, and the Good Laboratory Practice rule followed in December 1978, specifying how study records must be kept so an outsider could reconstruct them. Enron and WorldCom collapsed, and the Sarbanes-Oxley Act followed in July 2002, requiring management to assess internal control over financial reporting and an independent auditor to attest to that assessment. The SolarWinds compromise surfaced in December 2020, and Executive Order 14028 followed in May 2021, requiring a bill of materials for software sold to federal agencies. The inference is that agent work is exempt because nobody has looked yet, not because it differs in kind. It is an inference, and it fails if agent work turns out to be the first consequential automation that never acquires an evidence requirement. When the exemption ends is unknown. Section 12 says what would prove this premise wrong. ## 3. Why now Agents began executing multi-step work with consequences outside the sandbox: modifying production systems, moving money, filing documents, shipping code other work depends on. The evidence they leave is telemetry built for debugging, which makes it mutable, unsigned, retention-limited, and complete only where somebody instrumented. Sign-off is being given now against that material. ## 4. Scope AEF 1000 defines the artifact as an attested execution record, or aer: the evidence produced by a discrete unit of agent-executed work, called a run. Contents of an aer: - Act log: instructions, tool invocations, and effects, in order. - Input state: what was given and read, by content hash. - Output artifacts: what changed, hash-bound to the record. - Permission surface: what the agent could touch, distinct from what it did. - Approval record: who approved, when, and what was in front of them. - Signature and key binding: what sealed the record, under whose key. - The verifier, treated as an artifact of the framework. Lifecycle: capture, sealing, custody, retention, verification, and re-verification after keys rotate. The assertions an aer supports: that this run occurred under this configuration, that this is what it did within a declared scope, that the record is complete against that scope and unchanged since sealing, and that this person approved after seeing this. ### Adversary The aer is designed against an operator who wants a favorable account of work already done and who controls the systems that produced it. What it survives is a property of the design, not of anyone's intentions. AEF 1100 carries the full model. - Editing a sealed record: survived, detected by the verifier. - Replay against different work: survived, where inputs and outputs are hash-bound. - Deletion inside a sealed record: survived. Deletion of the whole record: not, absent an external index. - Backdating and key compromise: survived only against a time source and key history the operator does not control. - Suppression at the source: not survived. An event never emitted leaves nothing to detect. - Collusion with the approver: not survived. The result is a faithful record of an approved lie. ## 5. Out of scope Every boundary refused now is one nobody has to litigate later. - **Model safety and alignment.** An AEF-conformant record can document, in verifiable detail, a run that should never have been permitted. The framework is indifferent to the agent's merits. - **Agent capability evaluation.** Benchmarking measures capability, not a particular execution. Conflating them makes both unfalsifiable. - **Regulatory compliance mapping for any jurisdiction.** Mapping dates the framework to one regime and one year, and invites the reading that conformance produces compliance. It does not. - **Vendor-specific implementation.** A specification only one implementation can satisfy is that implementation's documentation. - **Substantive correctness of judgment.** The record establishes what was done and what was known at the time; whether the judgment was right is the reviewer's question. - **Security controls and identity infrastructure.** Key management, access control, and platform hardening are prerequisites this depends on and does not redesign. Adjacency, acknowledged once: software supply chain provenance solves an overlapping problem for build artifacts, and the assurance professions already answer many of these questions for human work. Reuse both. Neither is authority here. ## 6. Who this is for These audiences want different things. The framework is the floor between them, not a win for any one. - **The operator** running agent systems. Wants to ship without being blocked by an unanswerable question. Gets a target to build to. - **The reviewer**: auditor, regulator, counterparty, opposing expert, internal quality function. Wants to disbelieve efficiently. Gets a specific thing to ask for and a way to test whether they got it. - **The accountable signer.** Gets a written account of what the signature covers and what they must have been shown for it to mean anything. ## 7. First principles Every future document must trace to one of these. 1. **A control is not evidence until it has been observed enforcing.** Authoring a policy is not implementing it. The artifact is the observed denial: the run blocked, the write refused, the gate failed. 2. **Verification must not depend on the operator, and the trust it does require must be declared.** Zero trust is unavailable: every chain ends in a key, a root of trust, a time source, a compiler, silicon. A framework demanding it would be unimplementable, including by the reference implementation. What can be demanded is that verification never needs the operator's cooperation, explanation, or continued good behavior, and that the remaining trust base is enumerated, external to the operator, and minimal. A record whose trust dependencies are unstated is not verifiable, because the reviewer cannot tell what they are being asked to accept. 3. **Scope must be declared, and absence within it is a finding.** Complete means complete against a stated boundary; without one the word can't be tested and can't be false. Within a boundary, a step that produced no evidence is unsupported rather than presumed fine. 4. **An untested backup, log, or attestation is a claim, not a control.** A restore never performed is a hypothesis about a restore. A verifier that has never rejected a tampered record verifies nothing. 5. **Decision quality and outcome quality are separate.** Evidence must capture what was known at the time, not what turned out to be true. A record assembled afterward gets shaped by the outcome, usually in good faith. 6. **A signature requires a defined referent.** Signing means nothing unless it's established what was signed, what was asserted, what the signer was shown, and when. Most sign-off on agent work fails this today. ## 8. What this is not It is not a trust or safety measure for AI. Conformance says the record can be defended and says nothing about whether the work should have happened. A conformant record of a catastrophic run is an expected output. It is not documentation for one system. The reference implementation exists to prove the specification is buildable and to find where it isn't. ## 9. How this gets built Documents are numbered in blocks: 1000s foundational, 1100s threat and adversary, 1200s verifier and conformance, 1300s the record itself, 1400s custody and time. This charter is AEF 1000. Committed and unwritten: 1001 Terminology, 1100 Threat model, 1101 The trust base, 1200 Verifier requirements, 1201 Conformance and self-test, 1300 Record structure and scope declaration, 1301 Approval and signature semantics, 1400 Sealing, time, and re-verification. Each document answers one open question, is readable by someone who has read nothing else, and folds into a numbered release once it has stopped moving. The open-questions list lives beside this charter and is the roadmap. No requirement ships until something has been built that satisfies it and something has been built that fails it. ## 10. How to disagree A framework nobody argues with is a blog with document numbers. Disagreement goes in the public repository, against the document it concerns. Every substantive objection gets one of three outcomes, in writing, attributed: adopted with the document revised, rejected with the reason stated, or recorded as unresolved and published inside the document itself. Documents ship with their live objections attached. ## 11. Governance The author wrote v0.1. The editor is a seat rather than a person: the editor cuts releases, rules on objections, and can transfer the seat to a named successor in a dated release. A vacant seat is governed by the dormancy clause below. The intent is to move this to a neutral standards body, meaning an open organization with a published process and no single-vendor control. The trigger is two independent conformant implementations plus adoption by at least one organization unconnected to the author. Until then the framework has an editor and no institution, and readers should price that accordingly. If no release ships for eighteen months and the editor does not answer a public request within ninety days, the framework is dormant, and anyone may continue it under the same license without permission. Forking is a right rather than a tolerance. CC BY 4.0 is irrevocable, so nothing here can be withdrawn from anyone who already has it. If the editor goes quiet, changes direction, or is simply wrong, fork it and say what you changed. That right is the reader's insurance against the author, and stating it plainly is what makes the framework safe to build against. There is no certification body, registry, trademark enforcement, or fee. Conformance is a claim an operator makes and a reviewer tests. The author's employer is context for how these problems were learned, is not a party to this framework, does not endorse it, and bears no responsibility for it. ## 12. Falsification This framework is wrong or unnecessary under any of the following. Platform providers ship signed execution records by default, verifiable without trusting the platform. Then the artifact layer here should withdraw to a thin conformance profile. A standards body publishes something better. Then this folds into it and stops. Reviewers accept operator-controlled debug logs indefinitely, and no consequence attaches to being unable to prove agent work was done correctly. Then section 2 described an imagined problem. Verification costs more than proving the work is worth. Then the framework is correct and irrelevant, which is the same as wrong. ## 13. License and citation Licensed under Creative Commons Attribution 4.0 International (CC BY 4.0). An adoptable license is a requirement rather than a courtesy: a framework that can't be copied into someone else's policy or contract never becomes one. Cite as: > Stellmacher, G. (2026). *AEF 1000: Charter*, v0.2. 11 August 2026. https://grantstell.com/aef Cite the version and date, always.