Provared

Proof of what an AI agent was allowed to do, and what it then did.

A person signs the permission with a passkey. The agent signs a receipt for each action. A free checker says whether the agent stayed within the permission, and where it did not.

For anyone who runs an agent for other people, or has to check one. Evidence, not a verdict.

What the free checker prints for the sample record that comes with the library: an invented office agent that went over its limit at its fifth order.

Summary
  Is the record intact?                 yes
  Was every signature checked?          yes
  Did the agent stay within its slip?   NO: first at entry 5
  Time-stamped in a way you trust?      yes: the first 9 entries existed by 2026-10-05T10:16:00Z
  Checked against keys you named?       yes: the passkey you trust, and the recorder you expect
npm install provared
pip install provared
npx provared-check --sample

The third command prints the answer above in full. Or try it in your browser, with nothing to install: an agent orders under a limit, and the checker finds where it went over. The library needs Node.js 24.7 or later, or Python 3.11 or later; it has no dependencies, sends nothing anywhere, holds no money and starts no payment. If you do not write code, start with Provared in plain words.

What is new

Version 0.8.0, published on 1 November 2026: signing in a small window. The Provared application now signs nothing itself. To make, renew or cancel a permission, it opens sign.prova.red in a small window. That page shows what the new permission changes against the earlier one, and asks for a second press before a new passkey is made or an agent's keys are signed for the first time on that device. It then hands the signed record back. Nothing in a record and no rule of the checker changes: a book checks with 0.8.0 exactly as with 0.7.0.

Version 0.7.0, published the same day:

Then, also on 1 November, provared-mcp-executor 0.2.0: rules on the content of a tool call (for example, which paths a file tool may touch), tested before the call is passed on. The executor is listed in the official MCP Registry as io.github.provared/mcp-executor, and has a demonstration that runs with no settings, in front of a made-up tool server.

In the repository, not yet in a published version: a reader that judges the receipts of another open project, Agent Middleware, against a Provared permission.

The draft, explained. Inside the Provared draft is a guide to the Internet-Draft for a reader who does not write code: seventeen short chapters in the draft's own order, with drawings, questions to check yourself, a dictionary and every error code. It opens on claude.ai.

Four parts

An AI agent that orders, books, sends or changes things for someone leaves a trail of logs. Whoever runs the agent can edit a log. Provared adds signed records that a stranger can check later, and a free checker that reads them. Each part has a short name, used throughout.

The checker answers two questions and keeps them apart: is the record intact, and did the agent stay within its permission. Going over a limit is not a fault in the record. It is what a sound record shows.

A first record of your own

Three commands, in JavaScript. The permission is signed with a development stand-in for a passkey: a key made in memory, which no person confirmed. Every permission it signs says so in its issuer's name, and the checker prints that name. A real permission is signed by a person, in a browser, with a real passkey.

npm install provared
node first-record.mjs
npx provared-check book.jsonl --issuer <the thumbprint it prints>

And first-record.mjs, which is in the repository:

import { writeFileSync } from 'node:fs';
import { developmentRecorder } from 'provared/dev';

const SEND = 'provared.message.send';

// A permission: the agent may send messages, at most two.
const { recorder, issuerKeys } = await developmentRecorder({
  actions: [SEND],
  limits: [{ action: SEND, count: 2 }],
  purpose: 'Send a few messages, to make a first record.',
});

// Each action is asked for first, taken only if the permission allows it,
// and receipted after. The third message is outside it, so it is not sent.
for (let i = 1; i <= 3; i++) {
  const outcome = await recorder.act({ action: SEND }, async () => console.log(`message ${i} sent`));
  if (!outcome.done) console.log(`message ${i} not sent: ${outcome.answer.breaches[0].message}`);
}

writeFileSync('book.jsonl', recorder.book());
console.log(`npx provared-check book.jsonl --issuer ${issuerKeys[0]}`);

The same in Python, with from provared.dev import development_recorder, is in the repository too. For a LangChain agent, one package puts every tool call behind the same check, with no change to the tools (and another does the same for Pydantic AI):

pip install provared-langchain
from langchain.agents import create_agent
from provared_langchain import ProvaredMiddleware

agent = create_agent(model, tools=[order_supplies, send_message],
                     middleware=[..., ProvaredMiddleware(writer, {
                         'order_supplies': {'action': 'supplies.order', 'with': 'supplier',
                                            'amount': lambda a: {'unit': 'GBP', 'value': a['total_gbp']}},
                         'send_message': 'provared.message.send',
                     })])   # last among the middleware that wrap tool calls

A call the permission does not allow is not run, nothing is written, and the model is told why. The package is listed among the middleware in LangChain's own documentation. The guide covers the stub writer, the connector for an agent's tools, seals, time-stamps, cancelling, passing a permission on, and covered names.

What the checker says

This is the command-line checker's answer for the sample record, run on 10 October 2026 with Node.js 24.19 (npx provared-check --sample prints it in full). The entries are summarised here; the findings are the checker's own words, unshortened. The people, the supplier and the orders are invented.

A real record is at prova.red/records/: the coding agent the author runs to build Provared, kept day by day under a permission signed with the author's own passkey, with the checker's answer and the files to check it yourself.

The permission (the slip), signed with a passkey by "Sam Example (invented)" for the "Office agent" (names in a record are labels; only keys are checked).

May do
place orders, send messages
Limits
no more than 200 GBP of orders in total; no single order above 100 GBP; no more than 2 messages in any hour
Conditions
every order needs the supplier's countersignature; an order above 60 GBP needs the person's own approval
Never
destroy data; claim to be a human being; go around an access control, a block or a refusal
With
"Example Stationery (invented)", the supplier
From, until
5 October 2026, 08:00 to 12 October 2026, 08:00 (UTC)
Purpose
"Keep the office stocked with paper, pens and toner, and tell the office what was ordered."

What the agent did on 5 October, one receipt to a step:

  1. 1. Orders printer paper, 45 GBP. The supplier countersigns.Within the slip. Running total: 45 of 200 GBP.
  2. 2. Tells the office that the paper is ordered.Within the slip. No other party is named: this shows what the agent's side said.
  3. 3. Orders a toner cartridge, 80 GBP, after asking the person, who approves with the passkey. The supplier countersigns.Within the slip. Approved by the person, with the passkey the slip names: valid. Running total: 125 of 200 GBP.
  4. 4. Orders envelopes, 25 GBP. The supplier never confirms.OUTSIDE THE SLIP [countersignature-missing] The slip asks for the other side to countersign this action, and there is no countersignature.
  5. 5. Orders a second toner cartridge, 80 GBP, without asking. The supplier countersigns.OUTSIDE THE SLIP [over-limit] With this stub the total is 230 GBP. The slip's limit is 200 GBP: over by 30.
    OUTSIDE THE SLIP [approval-missing] The slip asks for the person's own approval of this action, and there is none.
  6. 6. Asks for 500 GBP of goods. The supplier refuses, and signs its refusal: "The action would pass a limit of the slip."A refusal is shown as the service's statement, not as what the agent did. It is not counted against the agent.
  7. 7. Deletes the old order files.OUTSIDE THE SLIP [action-not-allowed] The slip does not allow the action "provared.data.delete".
    OUTSIDE THE SLIP [prohibited] The slip says the agent must never do an action of the kind "destroys", and "provared.data.delete" is of that kind.

The sealed book (the seal), by "Example recorder (invented)", covers the nine entries before it. Sealed at 10:15 by the recorder's own word; time-stamped at 10:16 by an outside service the person checking named as trusted. Three signatures, two of them quantum-safe, all valid.

The checker's summary, exactly as printed:

Summary
  Is the record intact?                 yes
  Was every signature checked?          yes
  Did the agent stay within its slip?   NO: first at entry 5
  Time-stamped in a way you trust?      yes: the first 9 entries existed by 2026-10-05T10:16:00Z
  Checked against keys you named?       yes: the passkey you trust, and the recorder you expect
  Slips 1, stubs 6 (countersigned 3, one-sided 3), seals 1
  Approved by the person 1, refusals 1, terms for agents 1

What this check does not show

The checker says this itself at the end of every answer:

The worked example, for developers, shows the code that made the record above and what the checker said about it. Or check it in a browser: the checking page checks the sample at a click and any record you choose, and loads nothing from anywhere. You can also download it as one file and open it from your disk. The page uses only the signing methods your browser has built in. Tried on the author's computer on 13 October 2026: Chrome 155, Edge 155 and Brave 155 each check the quantum-safe signatures on receipts. None of the three has the further quantum-safe method that a seal is also signed with, so for this sample each of them says that the check was not complete and gives no pass. The command-line checker checks everything.

What the author found nowhere else (October 2026)

Signed, chained and time-stamped receipts for an agent's actions exist in other open projects too, some with quantum-safe signatures. As far as the author knows, in October 2026, three things are only here:

If you know of another project that does any of these, write to the author: this list is kept honest.

How it is built

Built from published standards only, with nothing hand-made: JSON Web Signature, one canonical form of JSON, Ed25519 and ML-DSA-87 (FIPS 204) side by side on every receipt, RFC 3161 time-stamps, and the tree of RFC 9162. The format is described exactly in one document, and shared test files hold another implementation to the same answers.

It is one author's work, in their own time, built with AI tools since 3 October 2026. The code has been through more than 80 rounds of review by AI reviewers, each a fresh session given the code, the documents and a brief of what to look at; every fault was fixed, or stated as a limit, and kept as a test. No person other than the author has reviewed it yet. That is an invitation.

Where it is

Status: version 0.8.0, a draft, published as it is by one author in their own time, with fixes as time allows. The format may still change. Every published version stays on npm and the Python Package Index, so a record made with one version can always be checked by that version. What a record does not prove is stated beside what it does.

Write to the author

Nothing is sold here. A hosted service that keeps, seals and time-stamps records for you is being designed with its first users. If you run an agent and would want such a record of it, if you would like to be told when the service exists, or if you have a question, send an email to hello@prova.red. Say in a line what your agent does and what you would want kept. Every email is read by the author and answered within a few days. Faults and suggestions are also welcome as issues on GitHub.