Action signing
Every automated action is digitally signed with the agent's private key, and logged with who authorised it and when. This is what turns a log line into evidence.
Non-repudiation, concretely
A conventional log entry says an event happened. It is a claim made by the system about itself, written to storage that an administrator can edit.
A signed action carries a cryptographic proof that this specific agent produced this specific outcome. Verify it against the issuing CA and you get a yes or a no. Nobody — including Automentic — can later produce a different version that also verifies.
That property has a name in evidence terms: non-repudiation. It is the difference between "our records show" and "here is the proof".
What gets signed
An action is a single committed change to a downstream system: an approval, a write, a state transition. The signed record binds together:
| Field | Why it is in the signature |
|---|---|
| Agent identity | Which agent acted |
| Action and target | What it did, and to what |
| Authorising principal | The human whose authority permitted it |
| Policy | The rule that was evaluated |
| Timestamp | When, to the second |
| Outcome | Whether it succeeded, was denied, or failed |
Because all of it is inside the signature, none of it can be altered afterwards without breaking verification. Changing the timestamp invalidates the record as surely as changing the amount.
What does not get signed
Reads, retries and failed authorisations are recorded but are not signed actions — nothing was committed, so there is nothing to be held to.
This distinction also matters commercially: signed actions are the billing unit, so a retry storm does not become an invoice.
Verification
Anyone holding the record and the issuing CA's public certificate can verify it. No call to Automentic is required, which is the point — evidence that depends on the vendor confirming it is weaker evidence.
The signature algorithm and serialisation format are product decisions not yet finalised. This page describes the model; the exact wire format will be documented in Reference once it is fixed.
Related
- Agent identity — the key that does the signing
- The audit trail — where signed actions land