Compliance evidence your auditors can check themselves.

What "evidence" means here

Strip away the frameworks and the acronyms and every governance obligation about AI agents reduces to the same three questions:

1. What did the agent do? Which tools it called, what data it touched, what it decided, in what order.
2. Can you prove it? Not assert it, not summarize it from memory. Prove it with records an outsider can check.
3. Was the proof itself tampered with? A record the audited party can silently rewrite is testimony, not evidence.

Most teams answer the first question with logs and stop. Logs answer "what do you say happened." Evidence answers "what can anyone verify happened." Auditors know the difference, and the gap between the two is where findings live.

Why the usual artifacts fail

• Dashboards. Pretty, proprietary, and controlled by the vendor whose work is being assessed. An auditor cannot recompute anything from a dashboard.
• Exported logs. Written by the system under review. Editable after the fact with no trace. Sequence gaps are invisible.
• Model cards and system descriptions. Useful context about intended behavior. They say nothing about what actually happened in any specific run.
• Vendor attestations. "We confirm our agents behaved correctly" is a promise with the vendor's own signature on it. It is the thing being audited, restated as the evidence.

The pattern: each artifact requires trusting the party being evaluated. Evidence that survives distrust is the only kind that matters, because distrust is the auditor's job.

What evidence that survives looks like

The unit is the verifiable execution receipt: one record per agent tool execution, carrying a stable ID, timestamp, tool and caller, the canonical bytes of the observed result, and a SHA-256 commitment over them. The open format is AER-1, an IETF Internet-Draft (draft-zambo-aer1).

What makes a stack of these "evidence" rather than "logs":

• Captured at execution. Each receipt is generated as the action happens, bound to that moment's exact inputs and outputs. Nothing is reconstructed later.
• Independently checkable. The auditor recomputes the hash from the canonical bytes. No vendor dashboard, no account, no trust in the operator. The public verifier at zambo.dev/verify does this with no signup.
• Tamper-evident. Alter one byte after the fact and verification fails. History cannot be quietly rewritten.
• Complete by construction. Every consequential action gets a sequence position, so an omitted action is a visible gap, not an invisible absence.

What to hand an auditor

When the request comes in, assemble this packet. It answers the three questions above with nothing left to interpretation:

1. The receipt set for the period under review. One JSONL file, one receipt per tool execution, in sequence. This is the trail itself.
2. A verification report. Run every receipt through an independent check and include the pass/fail output. The auditor can re-run it; the procedure is public.
3. The format reference. Point at the open draft (draft-zambo-aer1), not at a vendor doc. An open format means the evidence does not depend on any company's survival or goodwill.
4. Your policy mapping. Which of your governance controls each receipt field satisfies. This is the one document you write yourself; the receipts do the rest.

Notice what is not on the list: screenshots, dashboard exports, vendor attestations. If your packet needs any of those, the receipts are not complete yet.

Start in an afternoon

Pick one agent, one workflow, one day. Emit receipts for every tool call it makes. The framework packages do this with no new infrastructure:

pip install smolagents-aer1   # smolagents
pip install crewai-aer1       # CrewAI
pip install agno-aer1         # Agno

With smolagents, the integration is a callback:

from smolagents import CodeAgent, InferenceClientModel
from smolagents_aer1 import AER1Recorder

recorder = AER1Recorder()
agent = CodeAgent(tools=[], model=InferenceClientModel(),
                  step_callbacks=[recorder])
agent.run("your real task here")
recorder.save("receipts.jsonl")   # your first evidence file

Verify a receipt yourself before you show anyone: zambo.dev/verify takes a receipt and tells you whether the bytes match the commitment. Then hold one in your hands with no setup at all: the 30-second demo issues a real receipt from a free anonymous call.

One afternoon gives you the packet, the verification procedure, and the answer to the only question that matters: can someone check this without our help? When the answer is yes, you are ready for the auditor, the buyer, and the regulator alike.