Illustration of blank cards laid in a row on a wooden desk, each marked with an embossed or wax seal and tied to the next by string. At one point the row breaks, loose strings hang over an empty slot, and a hand holds a magnifying glass over the gap.
AI-generated editorial illustration of a chain of sealed records with a missing link under an auditor's lens, the kind of gap the drafts' hash-chained records are meant to expose. Conceptual scene; it does not depict any draft's format or a real agent run. Reuse license pending. Audit Commons (AI-generated editorial illustration) · Original AI-generated editorial illustration; reuse license pending

Four Drafts Submitted October 19 to 23

Between October 19 and 23, 2026, authors submitted four individual Internet-Drafts to the IETF that propose record formats relevant to auditing AI agents. All four are version -00. The Datatracker lists each with no stream, no intended status, and the IESG state "I-D Exists", its label for a draft outside IESG processing. In the order discussed below, the draft headers claim Standards Track, Experimental, and Informational status (the last for both evaluation drafts).

Execution receipts. draft-thaha-scitt-agent-execution-evidence-00 (October 19) comes from Shameer Thaha and Shaibi Shamsudeen, listed as individual contributors. It profiles the SCITT architecture (Supply Chain Integrity, Transparency, and Trust). The draft defines eleven signed statement types, among them an Execution Receipt: a hash-chained record of every model or tool call at a decision point, blocked calls included, with digests of the policy and configuration in force. Its introduction states the aim: a third party should be able to establish "what the agent did, under which rules, and with which configuration, without trusting the operator's own logs."

Continuity records. draft-watts-agent-continuity-evidence-00 (October 21) is by Deonté Watts of GoodShyt Group Inc. It specifies a JSON envelope signed with a JSON Web Signature over a canonical form of the statement, with nine event types that run from session-start to session-end and include delegation, action-attempt, gate-decision, and effect. Each statement carries separate identifiers for model, agent, runtime instance, execution, and authority grant, plus the digest of its predecessor record. A verifier returns VERIFIED, INVALID, or INDETERMINATE, and the draft text states that "VERIFIED never means authorized or true in a wider factual sense."

Evaluation logs. Two companion drafts dated October 23 come from Yu Han, Meiling Chen, and Qiguang Fan of China Mobile and Qin Wu of Huawei: Benchmarking Terminology for AI Agent Security Evaluation and Evaluation Profiles for AI Agent Security Assessment. The terminology draft defines four evaluation dimensions, 55 metrics, and three risk levels. Under the profiles draft, every test case must record, among other fields, the session and principal, the input as served, the declared boundary, and the outcome. A metric whose fields cannot be recorded is to be reported as instrumentation-dependent "rather than recording a pass." Both headers carry a "Benchmarking & Performance Measurements" line, yet the Datatracker shows no working group for either.

Status and Limits

Each draft carries the IETF notice that Internet-Drafts should be cited only as "work in progress." No working group has adopted any of the four, so they are proposals, and none is an IETF standard.

Tested implementation is thin. The SCITT draft describes a system called Sijil as a prototype and says "no export to the encoding defined here exists yet"; it lists epochs, bundles, and assurance-statement checks as not implemented. In the continuity draft, the author states that "No conformance test has been executed against an RFCXML-derived reference implementation in this document." Neither evaluation draft contains an implementation-status section. The SCITT authors' GitHub repository describes a -01 revision that we did not find in the IETF archive.

Signed records leave gaps by the drafts' own account. The SCITT draft says a PASS "does not establish that the Harness recorded every call," and the continuity draft concedes that "A malicious agent can sign false descriptions of its own activity." In the evaluation drafts, the terminology draft maps a comprehensive score to three risk levels, labeling a score of 80 or higher Low, while the profiles draft warns that scores can lead users to believe "the score equals absolute security."

Questions an Auditor Would Ask

  • Who operates the component that writes the records, and what independent observation shows that it wrote one for every call?
  • Which transparency service, registration authority, or trusted key would a verifier rely on, and who runs it? The continuity draft returns INDETERMINATE when a trusted key or predecessor record cannot be resolved.
  • Does an evaluation report state its boundary and the fields it logged, so that two scores can be compared?

See also Audit an agent action, Why a benchmark score does not establish agent safety, and NIST examines identity and authorization for AI agents.