Verifiable Agent Conversations

Status of This Memo

This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.¶

Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.¶

Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."¶

This Internet-Draft will expire on 13 August 2026.¶

Copyright Notice

Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved.¶

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License.¶

Table of Contents

1. Introduction

Autonomous Agents--typically workload instances of agentic artificial intelligence (AI) based on large language models (LLM)--interact with other actors by design. The two main types of actors interacting with autonomous agents are humans and machines (e.g., other autonomous), or a mix of them. In agentic AI systems, machine actors interact with other machine actors. While the responsible parties ultimately are humans (e.g., a natural legal entity or an organization), agents do not only act on behalf of humans they can also act on behalf of other agents. These increasingly complex interactions between multiple actors that can also be triggered by machines (recursively) increases the need to understand decision making and the chain of thoughts of autonomous agents, retroactively.¶

This document defines conversation records representing activities of autonomous agents such that long-term preservation of the evidentiary value of these records across chains of custody is possible. The first goal is to assure that the recording of an agent conversation (a distinct segment of the interaction with an autonomous agent) being proffered is the same as the agent conversation that actually occurred. The second goal is to provide a general structure of agent conversations that can represent most common types of agent conversation frames, is extensible, and allows for future evolution of agent conversation complexity and corresponding actor interaction. The third goal is to use existing IETF building blocks to present believable evidence about how an agent conversation is recorded utilizing Evidence generation as laid out in the Remote ATtestation ProcedureS architecture [RFC9334]. The fourth goal is to use existing IETF building blocks to render conversation records auditable after the fact and enable non-repudiation as laid out in the Supply Chain Integrity, Transparency, and Trust architecture [I-D.ietf-scitt-architecture].¶

Most agent conversations today are represented in "human-readable" text formats. For example, [STD90] is considered to be "human-readable" as it can be presented to humans in human-computer-interfaces (HCI) via off-the-shelf tools, e.g., pre-installed text editors that allow such data to be consumed or modified by humans. The Concise Binary Object Representation (CBOR [STD94]) is used as the primary representation next to the established representation that is JSON.¶

2. Agent Conversations

Content¶

agent-convo-record = {
 version: text                   ; Agent Trace specification version (e.g., '1.0'). Should be semver?
 id: text                        ; "Unique identifier" (uuid type 4) for this convo-record
 timestamp: text .regexp date-time-regexp ; RFC 3339 timestamp when the convo was recorded
 ? vcs: vcs                      ; Version control system information for this convo
 ? tool: tool                    ; The tool that generated this convo
 files: [* file]                 ; Array of files with attributed ranges
 ? metadata: anymap              ; Additional metadata for implementation-specific or vendor-specific data
}

date-time-regexp = "([0-9]{4})-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):([0-5][0-9]):(60|[0-5][0-9])([.][0-9]+)?(Z|[+-]([01][0-9]|2[0-3]):[0-5][0-9])"

uri-regexp = "(([^:/?#]+):)?(//([^/?#]*))?([^?#]*)(\\?([^#]*))?(#(.*))?" ; FIXME

anymap = { * label => value }    ; placeholder for later
label = any
value = any

vcs = {
 type: "git" / "jj" / "hg" / "svn"; Version control system type
 revision: text                  ; Revision identifier (e.g., git commit SHA, jj change ID)
}

tool = {
 ? name: text
 ? version: text
}

file = {
 path: text                      ; Relative file path from repository root
 conversations: [* conversation] ; Array of conversations that contributed to this file
}

contributor = {
 type: "human" / "ai" / "mixed" / "unknown"
 ? model_id: text                ; The model's unique identifier following models.dev convention (e.g., 'anthropic/claude-opus-4-5-20251101'), maxLength of 250?
}

resource = {
 type: text
 url: text .regexp uri-regexp
}

conversation = {
 ? url: text .regexp uri-regexp  ; URL to look up the conversation that produced this code
 ? contributor: contributor      ; The contributor for ranges in this conversation (can be overridden per-range)
 ranges: [* range]               ; Array of line ranges produced by this conversation
 ? related: [* resource]         ; Other related resources
}

range = {
 start_line: uint                ; min of 1? was int
 end_line: uint                  ; min of 1? was int
 ? content_hash: text            ; Hash of attributed content for position-independent tracking
 ? contributor: contributor      ; Override contributor for this specific range (e.g., for agent handoffs)
}

3. References

Authors' Addresses