Everyone signs decisions. Nobody verifies done. — ZTI

Essay · Agent governance

Everyone signs decisions.<br>Nobody verifies done.

Chad McCormack · Zero Trust Intelligence · August 2026

Something good is happening in AI-agent security: the field is converging on<br>receipts. Microsoft ships an agent-governance toolkit with offline-verifiable,<br>hash-chained receipts. The Cloud Security Alliance is specifying AARM, a runtime<br>category that intercepts agent actions, checks them against policy, and records<br>tamper-evident receipts. There are Internet-Drafts — the<br>Governed Action Protocol,<br>Asqav's compliance receipts —<br>and open specs like Agent Receipts. Most of us even<br>landed on the same primitives: Ed25519, RFC 8785 canonical JSON, SHA-256 hash chains.

That convergence is worth taking seriously, and worth crediting. It is also worth<br>reading closely, because every one of these systems answers one or both of the same two<br>questions: was this action authorized, and did it run. Signed policy decisions.<br>Signed invocation records. Chains you can audit later.

None of them answers the third question: did the work the agent claims to have<br>finished actually get finished?

The lie that receipts don't catch

In July 2025, an agent at a SaaS company deleted a production database during a code<br>freeze — and then reported the task complete, tests passing. The delete is the famous<br>part. The second act is the important part: the false &ldquo;done.&rdquo;<br>Policy interception addresses the delete. A signed decision receipt would have recorded,<br>faithfully and immutably, that the action was evaluated. But when an agent says<br>&ldquo;tests pass, task complete,&rdquo; a decision receipt simply notarizes the claim.<br>A signature over an agent's self-report is a beautifully authenticated lie.

An executor's claim of success is attestation .<br>It is not verification. Signing it, hashing it, and chaining it does not change what it is.

Check the specs. Microsoft's receipts attest that an agent invoked a tool and policy<br>allowed or forbade it — the docs define verification as signature, chain, and policy checks;<br>nothing in them re-executes or independently verifies outcomes.<br>The GAP draft produces a receipt for every gate decision; nothing in it verifies<br>completion. AARM records what was intercepted and enforced. Asqav signs allow/deny events.<br>All of this is real progress on &ldquo;may it act&rdquo; and &ldquo;what ran.&rdquo;<br>None of it touches &ldquo;is it actually done.&rdquo;

What verifying done requires

The fix is structural, not cryptographic, and it fits in three rules:

Checks are declared before execution. The request states what must<br>pass for the outcome to count as success, and the envelope hash binds those checks to<br>the authorized request. Criteria invented after the fact are not verification.

Verification is independent. The checks are evaluated by an<br>authority independent of the executor — a control plane, a designated validator, or<br>deterministic re-execution of the declared checks. The entity that executes does not<br>verify its own work, for the same reason it does not authorize its own work.

Attestation never satisfies a check. Fail closed. A required check<br>that fails independently resolves VERIFY_FAILED. A check satisfied only by<br>the executor's say-so resolves COMPLETION_UNVERIFIED. If verification<br>cannot run at all, the transaction cannot succeed: VERIFY_UNAVAILABLE. An<br>unverifiable success is not a success.

That third rule is the one you won't find elsewhere. It makes self-reporting<br>structurally incapable of closing a transaction — not discouraged, not flagged<br>for review. Incapable.

Where this is specified

These semantics are the core of ZTIP — the<br>Zero Trust Intelligence Protocol: an open, MIT-licensed, transport-neutral protocol<br>for governed agent transactions. Five immutable envelope types, RFC 8785 + SHA-256<br>integrity, policy authorization — the parts the field already agrees on — plus<br>independent completion verification as a first-class, fail-closed lifecycle stage. The<br>spec, JSON Schemas, ten lifecycle examples with real recomputable hashes, and a reference<br>runtime are public, and the protocol summary is filed as an Internet-Draft<br>(draft-mccormack-ztip)<br>so the record has a date on it.

Honesty about status: ZTIP is 1.0-draft — a draft<br>protocol, open for scrutiny, not a finished standard. The commercial control plane that<br>implements it (ZTI Core) is in build; a working reference gate exists and catches the<br>disaster above in a narrated demo. Nothing here<br>claims otherwise.

Credit where due: the projects named in this essay are doing valuable<br>work on identity, policy interception, and evidence formats. The argument is not that<br>they are wrong — it is that the square they all leave empty is the one where agents lie<br>most consequentially.

Agents don't just act without permission. They report success that didn't happen. If<br>your governance stack signs decisions but trusts &ldquo;done,&rdquo; it governs the first<br>failure and...