Assay

1. Status#

Assay v0.1 is an early draft and will change in ways that break earlier assumptions. It changes through numbered section drafts: each answers one open question, is published alone, and is argued with in public before folding into a release. Breaking changes increment the major version.

The author is a practicing assurance professional at a major firm who is building the reference implementation: signed act-log bundles for agent runs, with a verifier built as a hostile target, where one flipped byte must fail, manifest path collisions are tested rather than assumed impossible, and golden fixtures are re-pinned on every change. The doctrine came from building that system and breaking it. The author's employer is context for how these problems were learned, is not a party to this standard, and does not endorse it.

2. The problem#

Someone asks you to prove a piece of work was done correctly. It was done fourteen months ago, by an agent, across nine steps and four systems. Logs exist. They were written for debugging, so they sit in mutable storage the operator controls, record whatever an engineer thought worth printing, and say nothing about what the agent was permitted to touch or what the person approving actually saw. The person asking does not trust the operator. That is not an accusation. It is the reason they were sent.

You cannot answer them. Nothing was built to survive a reading by someone whose job is to disbelieve it. The record can't be checked without the operator's cooperation, shown to be unaltered, or shown to be complete, because completeness was never defined against a declared boundary. The work may have been done correctly. There is no way to establish it.

3. Why now#

Two things changed together. Agents began executing multi-step work with consequences outside the sandbox: modifying production systems, moving money, filing documents, shipping code other work depends on. The evidence they leave is telemetry built for debugging, which makes it mutable, unsigned, retention-limited, and complete only where somebody instrumented. Sign-off is being given now against that material, using a mental model of what the signature covers that nobody has written down.

4. Scope#

The standard makes claims about evidence produced by a discrete unit of agent-executed work, called a run.

Artifacts:

• Act log: instructions, tool invocations, and effects, in order.
• Input state: what was given and read, by content hash.
• Output artifacts: what changed, hash-bound to the record.
• Permission surface: what the agent could touch, distinct from what it did.
• Approval record: who approved, when, and what was in front of them.
• Signature and key binding: what sealed the record, under whose key.
• The verifier, treated as an artifact of the standard.

Lifecycle: capture, sealing, custody, retention, verification, and re-verification after keys rotate.

Assertions:

• This run occurred, at this time, under this configuration.
• This is what it did, within a declared scope.
• This record is complete with respect to that scope.
• This record has not changed since sealing.
• This person approved, and this is what they were shown.

5. Out of scope#

Every boundary refused now is one nobody has to litigate later.

• Model safety and alignment. A conformant record can document, in verifiable detail, a run that should never have been permitted. The standard is indifferent to the agent's merits.
• Agent capability evaluation. Benchmarking measures capability, not a particular execution. Conflating them makes both unfalsifiable.
• Regulatory compliance mapping for any jurisdiction. Mapping dates the standard to one regime and one year, and invites the reading that conformance produces compliance. It does not.
• Vendor-specific implementation. A specification only one implementation can satisfy is that implementation's documentation.
• Substantive correctness of judgment. The record establishes what was done and what was known at the time; whether the judgment was right is the reviewer's question.
• Security controls and identity infrastructure. Key management, access control, and platform hardening are prerequisites this depends on and does not redesign.

Adjacency, acknowledged once: software supply chain provenance solves an overlapping problem for build artifacts, and the assurance professions already answer many of these questions for human work. Reuse both. Neither is authority here.

6. Who this is for#

These audiences want different things. The standard is the floor between them, not a win for any one.

• The operator running agent systems. Wants to ship without being blocked by an unanswerable question. Gets a target to build to.
• The reviewer: auditor, regulator, counterparty, opposing expert, internal quality function. Wants to disbelieve efficiently. Gets a specific thing to ask for and a way to test whether they got it.
• The accountable signer whose name goes on the work. Gets a written account of what the signature covers and what they must have been shown for it to mean anything.

7. First principles#

Every future section must trace to one of these.

1. A control is not evidence until it has been observed enforcing. Authoring a policy is not implementing it. The artifact is the observed denial: the run blocked, the write refused, the gate failed. Until then you have an intention with good documentation.

1. Evidence must be verifiable by someone who trusts neither the operator nor the system that produced it. Verification requiring the operator's cooperation or explanation is not verification. It has to be checkable offline, by an adversary, against material the operator cannot silently revise.

1. The absence of a record is a finding, not a gap. A step that produced no evidence is unsupported, not presumed fine. Conformant records declare their boundaries so a reviewer can tell absence from omission.

1. An untested backup, log, or attestation is a claim, not a control. A restore never performed is a hypothesis about a restore. This binds the standard's own machinery: a verifier that has never rejected a tampered record verifies nothing.

1. Scope must be declared before completeness can be asserted. Complete means complete against a stated boundary; without one the word can't be tested and therefore can't be false. Asserting completeness without declaring scope is the unfalsifiable option.

1. Decision quality and outcome quality are separate. Evidence must capture what was known at the time, not what turned out to be true. A record assembled after the outcome is known gets shaped by it, usually in good faith.

1. A signature requires a defined referent. Signing means nothing unless it's established what was signed, what was asserted, what the signer was shown, and when. Most sign-off on agent work fails this today, because nobody wrote down what the signature was supposed to mean.

8. What this is not#

It is not a trust or safety measure for AI. Conformance says the record can be defended and says nothing about whether the work should have happened. A conformant record of a catastrophic run is an expected output.

It is not a certification. No body, no seal, no registry, no fee. Conformance is a claim an operator makes and a reviewer tests.

It is not documentation for one system. The reference implementation exists to prove the specification is buildable and to find where it isn't.

9. How this gets built#

Sections are numbered from 001 and published on a regular cadence, each readable by someone who has read nothing else. This charter is 001. The open-questions list lives beside it in the same repository and is the roadmap.

Sections fold into numbered releases once they've stopped moving. No requirement ships until something has been built that satisfies it and something has been built that fails it.

10. How to disagree#

A standard nobody argues with is a blog with section numbers.

Disagreement goes in the public repository, against the section it concerns. Every substantive objection gets one of three outcomes, in writing, attributed: adopted with the section revised, rejected with the reason stated, or recorded as unresolved and published inside the section itself. Sections ship with their live objections attached.

11. Falsification#

This standard is wrong or unnecessary under any of the following.

Platform providers ship signed execution records by default, verifiable without trusting the platform. Then the artifact layer here should withdraw to a thin conformance profile.

A standards body publishes something better. Then this folds into it and stops.

Reviewers accept operator-controlled debug logs indefinitely, and no consequence attaches to being unable to prove agent work was done correctly. Then section 2 described an imagined problem.

Verification costs more than proving the work is worth. Then the standard is correct and irrelevant, which is the same as wrong.

12. License and citation#

Licensed under Creative Commons Attribution 4.0 International (CC BY 4.0). An adoptable license is a requirement rather than a courtesy: a standard that can't be copied into someone else's policy or contract never becomes one.

Cite as:

Stellmacher, G. (2026). Assay v0.1, Section 001: Charter. 11 August 2026. https://grantstell.com/assay

Cite the version and date, always. Claims here are expected to be contradicted by later versions.