Provared is a flight recorder for AI agents. It proves what an agent was allowed to do, and what it then did.
Companies are starting to let AI agents act for them: order, pay, send, change records. When one goes wrong, nobody can prove what it was allowed to do. Provared is the recorder that proves it.
The problem
An AI agent does not just answer. It acts. It books, orders, pays, sends and changes records. A person sets it going and looks away. That is the point of it, and it is also the problem.
When something goes wrong, the question is simple: who allowed that? Today the answer is a log file, written by the same software that is being questioned, which anyone could have edited.
Think of a new hire with the company card, who works at machine speed, never sleeps and keeps no receipts.
Suppose a charity tells an agent: reorder office supplies, up to £500 a month. In June the agent pays a supplier £4,800. In December the auditor asks: who allowed that?
The rules are arriving. Europe's AI law requires high-risk AI systems to keep records of what they do.
What Provared is
Four parts, each with a short name.
- Slip, the permissionA person signs it on their phone, with a fingerprint or face: what the agent may do, how much, with whom, until when. Like a signed school-trip form.
- Stub, the receiptOne for every action, signed by the agent and by whoever it dealt with. Like a ticket stub.
- Seal, the sealed bookThe receipts chained in order and dated by an outside clock, so nothing can be changed or torn out unnoticed. Like a wax-sealed ledger.
- Show, one page with proofThe inspector sees the page they need, with proof that it belongs to the book, and the rest stays closed. Like a certified extract.
And a free checker, which anyone can run on their own device. It answers one question in seconds: did the agent stay within what it was allowed? Yes, or no and where.
Like an aircraft's black box: it records what happened, and it cannot be rewritten after the crash.
How it works
The drawing below follows the sample record that ships with the software: an invented office agent, allowed up to £200 of supplies, which goes over at its fifth order.
Today, the evidence is scattered across several systems, written by the software being questioned, easy to change, and nothing links the payment to what was agreed. It is the company's word against the doubt.
With Provared, the auditor is handed the permission the manager signed, the receipt the supplier countersigned, and the sealed, dated book they sit in. Anyone can check it in seconds.
Why it is different
- Other projects record what an agent did. Provared also records what it was allowed to do, and compares the two automatically.
- The permission has limits a machine can check: £200 in total, five orders, this supplier only, until Friday, never delete.
- The person can cancel at any time. The agent signs that it was told. The book shows if it carried on.
- A permission can be handed on to a helper agent, but never widened.
- The signatures are designed to stay valid for decades, even against quantum computers.
- It is free and open, built on published standards. The core is already a draft at the IETF, the body that sets the internet's standards.
At least four other open projects make signed, time-stamped receipts. Provared adds the permission the person signed, with limits a machine can check, and a checker that says whether each action stayed within it.
Where it is today
Version 0.2.0 is published, for anyone to install, on npm and on the Python Package Index. The core of the format is an Internet-Draft at the IETF; an Internet-Draft is a working document, not a standard. Every line of code and every test is public on GitHub, and the checking page, which also works as one file with no connection, has a sample record to try.
The library has no outside dependencies, sends nothing home, holds no money and starts no payment. It is held to more than 750 automated tests, and to about 10,000 shared test cases that the JavaScript and Python versions must answer alike. It has been through 25 rounds of independent review by fresh reviewers given only the code; every fault was fixed and kept as a test. An add-on for LangChain, one of the most-used toolkits for building agents, is published.
It is one author, in their own time, on their own equipment. Building started on 3 October 2026, with AI tools.
Hard questions
A log file does this already.A log is written by the one being questioned, and can be edited. This is signed by the person, the agent and the other side, and dated by an outside clock. An auditor would rather be handed the second.
One person, in spare time?Yes. That is why it is open, held to 750 tests, reviewed 25 times, and published where anyone can check it. If the author vanishes, the records still check. The standard does not depend on one person.
How long did it take?Building started on 3 October 2026. Published on 6 October. Built with AI tools, reviewed in 25 rounds, every fault turned into a test. Judge the code, not the calendar.
Can it stop a bad agent?Wired in before the action, it refuses anything outside the slip. It cannot judge right from wrong. Evidence, not a verdict.
Does it hold my money or my data?Never. It holds no money, starts no payment, issues no token, and sends nothing home. The checker asks nobody.
Why bother with quantum computers?A record must still check in ten years. Today's signatures may not. It costs the user nothing.
Prove it.The pages linked above are public. Or give a technical person thirty minutes to try to break it; a hole found is fixed in public.
What a record does not prove
- What was left out. An agent that acts and writes no receipt leaves no trace.
- Who was holding the phone when the permission was signed.
- Whether an action was wise, lawful or wanted.
- That a name is right. A name in a record is a label; only the keys are checked.
Dictionary
AI agent: software that does not just answer but acts: it books, orders, pays, sends and changes records.
Passkey: the sign-in built into a phone or computer, unlocked with a fingerprint or face. A person signs a permission with it.
Key: a secret that makes signatures, held by one person, agent or service. Its public half lets anyone check them.
Signature: a mark that only the holder of a key can make, and that anyone with the public half can check. Each record is signed by whoever wrote it.
Countersignature: the other side's signature on a receipt, saying that the action happened.
Fingerprint, or hash: a short code worked out from a file. Change one letter of the file and the code changes, so it shows whether a copy is exact.
Chain: each receipt carries the fingerprint of the one before it, so none can be removed or reordered unnoticed.
Time-stamp, the outside clock: a signed statement from an independent service that a fingerprint existed at a given time.
Recorder: whoever keeps the sealed book.
Checker: the free program that reads a record and says whether it is intact, and whether the agent stayed within its permission.
Quantum-safe signature: a signature method that a future quantum computer is not expected to break. Provared uses two methods side by side, so that a record still checks in decades.
Open source: code published for anyone to read, use and build on. Provared's code is under the Apache 2.0 licence and its documents under Creative Commons Attribution.
IETF: the Internet Engineering Task Force, the body that sets the internet's standards.
Internet-Draft: a working document submitted to the IETF. Not a standard.
npm, Python Package Index: the two main places where developers install ready-made software from.
LangChain: one of the most-used toolkits for building AI agents.
Evidence, not a verdict: a record shows what was signed and by which keys. People decide what it means.
Questions and faults are welcome by email to hello@prova.red or as issues on GitHub.