Execution Verification

Did the agent actually do what the system says it did? Execution verification answers that question with cryptographic or infrastructure-level mechanisms that produce independently verifiable evidence of what an AI agent’s systems executed and what state changed. Instead of asking what the agent was allowed to do, it asks what actually happened, and whether a third party can check that history.

How It Works

Agent security stacks separate a few jobs that are easy to confuse. Identity establishes who or what is acting. Authorization determines what an actor may do. Runtime controls decide whether a given execution should proceed. Observability monitors behavior while it happens. Execution verification proves what actually executed, and makes that history independently checkable.

Permission management and policy enforcement sit on the authorization side: they judge an action before it runs. Agent firewalls, for example, vet tool calls inline. Sandboxing contains the blast radius of a bad action but does not prevent it. Verification is the evidence side: it records what happened in a form that outlives the agent’s own memory of events.

The basic unit is a signed execution event. Each event identifies the actor, the action, the state before, the state after, and a cryptographic signature. Events link together into a verifiable execution record that preserves state lineage: the chain from execution to the state it produced. Downstream systems, from audit to incident response, can then verify the record instead of trusting a summary.

Enforcement and verification are complementary. The Open Agent Passport paper describes pre-action authorization: tool calls are intercepted before execution, evaluated against a declarative policy, and given a cryptographically signed audit record. That settles what may happen. Verification settles what did.

Take a finance agent that pays invoices under a spending cap. Policy enforcement approves or blocks each payment before it goes out. Execution verification produces a signed record binding that specific transfer to the agent’s identity and to the balances before and after. An auditor can confirm the payment happened exactly as recorded without trusting the agent’s own logs, and gaps in the record stay visible instead of being smoothed over.

Logs Are Not Evidence

The most common confusion: a log is not proof. Logs are usually produced by the same system being audited, and they can be edited, truncated, or lost. Execution verification captures evidence when execution happens and makes it cryptographically verifiable afterward. As Archipelo CEO Matthew Wise put it, “Powerful AI should not be responsible for establishing the history of its own execution.”

Why It Matters

As agents act across credentials, tools, and production systems, often without direct human oversight, trust cannot rest on what a model was instructed to do, permitted to do, or says it did. The category took shape publicly in September 2026, when Archipelo announced Salmon, an Execution Verification Infrastructure (EVI) that captures execution as signed events and records the state transitions they produce, across humans, AI agents, and automation. For the surrounding defenses, see AI agent security, the agent harness pattern, and sandbox escapes.