How it fits NANDA
The NANDA Index makes an agent discoverable, identifiable, and authenticated, and AgentFacts is its dynamic, cryptographically verifiable record — together they resolve who an agent is and where to reach it. But resolution ends at the moment the agent acts; nothing in the Index or AgentFacts says what the agent then did, or whether it was allowed to.
Attested Actions is that missing piece — the accountability for what a resolved agent does. Once the NANDA Index has made an agent discoverable and authenticated, Attested Actions makes its actions verifiable: that they happened, and that they were authorized.
NANDA — the internet of AI agents
│
├─ NANDA Index + AgentFacts discoverability · identifiability · authentication
│ "who is this agent, and where to reach it"
│
└─ Attested Actions accountability for what the agent does
"what it did, and was it authorized"
The two are complementary: the Index resolves the agent, Attested Actions holds its actions to account. Neither does the other's job — discovery does not attest actions, and attestation does not resolve agents.
The two claims
The action occurred
Bound to receipts — agency receipts (sm-arp), the signed records an agent emits when it acts.
The action was permitted
Bound to permits and grants — the pre-action authorization verdict (sm-aae) and the principal-signed grant behind it (sm-dat).
(c) The subject was truthful is a companion concern — multi-source corroboration of the counterparty, the quilt — kept separate from the envelope. (d) It was correct or wise is out of scope entirely; Attested Actions never claims it.
The atomic object: the Attested Action Envelope
The envelope is the atomic unit: a signed, content-addressed record that binds an action to its authorization and chains to the agent's previous envelope. It is signed with Ed25519 over the JCS-canonical body (sans signature) — the same canonical signing path across the whole stack, so an envelope verifies fully offline.
envelope {
agent_id
action: { verb, resource, params }
policy_id (the authority the verdict cites)
outcome: authorized | denied | conditional
prev_hash (chains to this agent's prior envelope)
issued_at
pubkey (the signer's Ed25519 key)
sig (Ed25519 over JCS(body sans sig))
}
Because each envelope names its predecessor by hash, an agent's authorization history is a
tamper-evident chain: deleting or reordering it breaks the links. Refusals
(denied) are first-class signed envelopes — "we said no" is provable, not an absence
of evidence.
What it consumes, produces, and does not do
Action & authorization records
Receipts, permits, and grants — the artifacts that already say an action happened and was authorized.
The Attested Action Envelope
One signed, per-agent hash-chained envelope binding the action to its authorization, verifiable offline against the signer's own key.
Correctness, subject-truth, semantics
It does not judge whether an action was correct or wise, does not itself corroborate the subject (that is the companion quilt layer), and does not attest the meaning of an action.
Ecosystem positioning: Attested Actions composes an agent's own action records into one verifiable chain — NANDA's accountability layer, complementing the discovery and identity NANDA already provides. A layer above the records, not a competitor to discovery.