Summary

  • The October 24 revision of an individual IETF proposal deleted “evidentiary-grade” from its title and body. The author now calls the proposed AI decision trail auditable and assigns acceptance as evidence to the competent authority or court.
  • The revised draft can describe detection of changes and omissions after a batch is anchored. It cannot reveal an event that was never submitted and left no other trace. Its implementation section lists no known external implementation and no Evidence Pack accepted in a regulatory, judicial or audit proceeding.

The adjective that went missing

Two words vanished between versions of an Internet-Draft. Revision 01 called its proposal a framework for “Evidentiary-Grade AI Decision Trails.” Revision 02, published on 24 October, says “Auditable AI Decision Trails.” Its change log explains the edit with an unusually useful admission: a competent authority or court decides whether a record is accepted as evidence. A protocol author cannot award that status by writing it on the cover.

The distinction matters long before any hearing. A buyer might be shown an immaculate cryptographic diagram and told it produces evidence-grade records. An auditor might then inherit the system's vocabulary as if it were a finding. The new title strips away that shortcut. It asks the maker to demonstrate the smaller, testable thing: who signed what, what entered a log, when a batch was committed, and whether the presented history still matches that commitment. The person receiving the record must make a separate judgment about its use.

This is one author's active individual Internet-Draft. The IETF Datatracker gives it no formal standing in the standards process. The proposed Verifiable AI Provenance framework, or VAP, coordinates existing building blocks rather than specifying a new wire protocol. Its mapping puts signed statements and receipts from SCITT's published architecture beside remote attestation and COSE signatures. Those established technologies supply vocabulary and mechanisms. They do not turn VAP into an adopted IETF standard or make one draft author's profile an institutional verdict.

What the seal actually sees

The most instructive limit lies inside the revised completeness claim. An anchored batch would bind at least a record count, first and last identifiers, and an identifier for the policy under which the batch was produced. A later presentation that drops a committed record or swaps a historical view can be checked against the anchor. Sequence gaps can also be detected. This is a real and useful property. It is narrower than saying the system captured every consequential decision it made.

Consider a decision that never entered the proposed log. If another record implies it should exist, the gap may become visible: a recorded request could require a recorded outcome. If nothing else refers to the missing event, a perfect inclusion proof has nothing to inspect. The revised draft says so directly. It puts advance declaration of the expected record set, or a rule to derive it, under possible future work. The operator who selects the capture scope remains a central actor in the present proposal. A gold seal on a narrow batch makes that narrow batch harder to rewrite; it does not widen the camera.

External anchoring sharpens this boundary. The VAP author's separate VSO requirement set calls for signed batch roots to be placed with independent external systems at every conformance level, with an anchor-continuity plan. A later attempt to reconstruct another history should clash with a prior anchor. The frequency of anchoring remains a profile choice, and it defines how long a record can sit before outside commitment. A timestamping authority can attest a time of existence; it cannot alone guarantee every recipient saw the same view. These are design choices with owners, not a magic property of the acronym VAP.

The draft's new implementation section is more arresting than any diagram. It reports no known external implementation of VAP or a VAP profile. It reports no Evidence Pack accepted in a regulatory, judicial or audit proceeding. The author's research tooling includes synthetic cases and an offline verifier, but independent reproduction has not been established in the document. Those statements do not insult the proposal. They tell a purchaser exactly where prototype ambition stops and third-party experience has yet to begin.

The handoff nobody can outsource to a hash

Three decisions sit in different hands. The system operator chooses what its process records and submits. An independent verifier can test a signed statement, receipt and anchored history against a defined policy. A receiving authority decides what the resulting material proves in its own proceeding. The first choice governs the blind spot; the second governs technical integrity; the third governs institutional acceptance. Calling all three “evidentiary-grade” had bundled them into one sales adjective.

Revision 02 also confines the proposed architecture to retrospective audit and forensics. It records actions after the fact. An accurate signature can preserve an inaccurate statement made at the start, and the draft itself distinguishes a system's claim about its own behavior from an independent observer's claim. That is the practical reason a receiving institution needs the surrounding record: capture design, signer identity, timing, independence, relevant inputs and the dispute it must decide. A receipt is valuable because it makes one part of that inquiry harder to fake. Its value shrinks when it is asked to answer every part.

The next public milestones are modest and specific. The author proposes discussion at SecDispatch, feedback from SCITT and RATS, and a later decision about where the work belongs. Independent reproduction of the verifier, a committed expected-population rule and an actual named proceeding that accepts a VAP Evidence Pack would change the assessment of its reach. Today the draft has made its strongest governance improvement with an edit: it has stopped appointing its own evidence judge.

Sources