Admissibility by design

Forensic incident response for agentic AI.
Admissible by design.

Your agent took an action. Something went wrong. Prevention tools tell you you tried to stop it. Project AIR tells you what happened, proves the record is untampered, and gets the proof accepted as evidence.

Technical documentation, not legal advice. Admissibility is decided by the court hearing the matter. Consult qualified counsel before relying on Project AIR records in any legal proceeding.
air trace
$ air trace prod-agent.log --verify
The framework

Four bars. Evidence clears all four, or it is not evidence.

A court, a regulator, an auditor, an insurance loss adjuster. Every party that looks at your logs asks the same four questions. Project AIR answers the cryptographic ones by construction. You handle the procedural one. The line is explicit, not implied.

01
Bar 1

Authenticity

Is the record what you claim it is?

AIR Ed25519 signature and embedded public key on every record. Verifiable offline against RFC 8032.
You Document the key holder. Attest to the system.
02
Bar 2

Integrity

Has anything been altered since it was written?

AIR BLAKE3 content hashes forward-chained through every record. Any alteration breaks verification deterministically.
You Preserve the log file. Write to append-only storage.
03
Bar 3

Attribution

Which system and which key produced this?

AIR Each record carries the signer's Ed25519 public key. Chain links prove ordering, timing, and identity.
You Hold the private key under sole control. Document rotation.
04
Bar 4

Procedural admissibility

Does the process meet the formal requirements a court will apply?

AIR Deterministic, documented, and reproducible. Clears FRE 902(13), FRE 803(6), and eIDAS Articles 25-26.
You Deploy continuously in production. Retain per policy.
Integrity, live

Tamper with the chain. Watch verification break at the exact step.

Every Project AIR record is a Signed Intent Capsule: BLAKE3 content hash, Ed25519 signature over the link to the previous record. Change any byte, anywhere, and the verifier reports the exact record where the chain snaps.

air trace my-agent.log
[verified] 5 records | signatures valid | chain intact | signer: 7c3d9a1e...
record agent_start step 0 verified
payload
user_intent: "refund order #8821 for customer_id=4419"
prev_hash link to previous
0000000000000000000000000000000000000000000000000000000000000000
content_hash BLAKE3 of canonical payload
a1f4c8e2b7d3950e4f2c1a8b6d7e3f91c4b2a8e7d3f1c9a2b8e4d7f3c1a9b8e2
signature Ed25519(prev_hash || content_hash)
7c3d9a1e4b8c2f5d7a3e9b1c4d6f8a2e5b7c9d1f3a5e7b9c1d3f5a7e9b1c3d5f...
$ air trace my-agent.log --verify --public-key 7c3d9a1e... exit 0
[ok] signature verifies, payload hash matches, chain intact upstream.
[content mismatch] the payload was altered after signing. Detected deterministically.
[unverifiable] upstream break means downstream records cannot be trusted.
On-disk record shape (AgDR v0.2)

Every record is a Signed Intent Capsule.

OWASP's Agentic Security Initiative names "Signed Intent Capsule" as the emerging pattern for binding an agent's declared goal, constraints, and context to each execution cycle in a signed envelope. Project AIR writes that envelope for every agent step.

The format is AgDR-compatible: the same shape consumed by the open accountability.ai spec, so downstream verifiers, SIEMs, and custody chains work without proprietary tooling. Three primitives combine to produce the integrity guarantee.

  • 01 BLAKE3 content hashing. Canonicalised payload, 256-bit digest, reproducible offline.
  • 02 Ed25519 digital signatures. RFC 8032. Deterministic, batch-verifiable, approx. 128 bits of security.
  • 03 Forward-chained integrity. Each signature covers the previous record's hash. A single altered record invalidates every record downstream.
record.json
{
  "version":      "0.2",
  "step_id":      "01962a7f-8c4e-7a00-b4a1-8d7e92f01234",
  "timestamp":    "2026-04-21T14:32:01.248Z",
  "kind":         "tool_start",
  "payload": {
    "tool":       "send_email",
    "args": {
      "to":       "customer@acme.co",
      "subject":  "Refund processed"
    },
    "user_intent": "refund order #8821"
  },
  "prev_hash":    "b2e5d9f3c8a4061f...",
  "content_hash": "c3f6e0a4d9b5172a...",
  "signature":    "9e5f1c3a6d0e4b7f...",
  "signer_key":   "7c3d9a1e4b8c2f5d..."
}
Mapping to evidentiary frameworks

The rules that will actually apply. And how Project AIR clears them.

Every claim on this page is grounded in published law. Click through the jurisdictions. Each rule gets a concrete citation and a specific statement of what Project AIR does to satisfy it.

United States

Federal Rules of Evidence

The procedural rules federal courts apply to authenticate and admit electronic records.

The rule
FRE 901(a): general authentication

The proponent must produce evidence sufficient to support a finding that the item is what the proponent claims it is.

FRE 901
What AIR provides

Every record carries an Ed25519 signature and embedded public key. Any verifier can confirm the record is what it claims to be, offline, using RFC 8032.

The rule
FRE 901(b)(9): process or system

Evidence describing a process or system and showing that it produces an accurate result.

BLAKE3 + RFC 8032
What AIR provides

The hashing and signing process is deterministic and reproducible. Same inputs produce the same hashes and signatures. An expert witness can describe, demonstrate, and have the demonstration independently reproduced.

The rule
FRE 902(13): self-authenticating electronic records

A record generated by an electronic process or system that produces an accurate result, as shown by a certification of a qualified person.

FRE 902
What AIR provides

Records from the AIR chain accompanied by a qualified custodian certification (template generator above) self-authenticate. No live witness required.

The rule
FRE 803(6): business records exception

Records created in the regular course of business, near the time of events, kept by someone with knowledge.

FRE 803
What AIR provides

Continuous instrumentation pattern: AIR writes records at the time the agent acts, as part of normal operations. Meets the "regularly conducted activity" bar when deployed as documented.

The rule
FRE 1001-1004: best evidence rule

An "original" ESI includes any printout or output that accurately reflects the information. Duplicates are admissible unless authenticity is challenged.

FRE 1001-1004
What AIR provides

forensic-report.json is an accurate, human-readable reflection of the signed chain. Admissible under FRE 1003 provided the chain is preserved.

The hook

Generate your FRE 902(13) certification.

The declaration that turns a log file into self-authenticating evidence. Fill in the fields. Get a signed-ready template. Paste into Word, hand to counsel, file with your exhibit.

inputs Your details fill the template live.
This template is adapted from FRE 902(13). It is a starting point, not legal advice. Have qualified counsel review before you file or serve it.
fre-902-13-certification.md
CERTIFICATION OF RECORDS GENERATED BY AN ELECTRONIC PROCESS OR SYSTEM
Pursuant to Federal Rule of Evidence 902(13) and Rule 902(11)

I, [Full Name], hereby certify the following:

1. I am the Records Custodian for [Operator Entity]. I am a qualified person
   with personal knowledge of the electronic process and system described below.

2. The attached records are true and correct copies of records generated by the
   Project AIR logging system operated by [Operator Entity] in the regular course of
   business.

3. The records are stored in the AgDR (AI Decision Record) v0.2 format, a
   structured append-only log in which each record contains:

   a. a UUIDv7 step identifier and ISO 8601 timestamp;
   b. the kind of agent step (llm_start, llm_end, tool_start, tool_end,
      agent_finish, or agent_message);
   c. a structured payload describing the step;
   d. the BLAKE3 hash of the preceding record's payload (prev_hash);
   e. the BLAKE3 hash of this record's canonicalised payload (content_hash); and
   f. an Ed25519 digital signature (RFC 8032) over the concatenation of
      prev_hash and content_hash, produced with a private key held under sole
      control of [Operator Entity].

4. Each record is cryptographically linked to the preceding record by its hash.
   Any alteration, insertion, deletion, or reordering of records is detected
   deterministically by signature verification using the open-source Project
   AIR verifier (air trace), which reports the exact record at which the chain
   breaks.

5. The records were written at or near the time of the events they describe by
   the Project AIR instrumentation deployed in the regular course of
   [Operator Entity]'s operations. The records have been retained and preserved
   according to [Operator Entity]'s records retention policy.

6. The Ed25519 public key corresponding to the signing key used to produce the
   attached records is:

   [64 hex character Ed25519 public key]

7. The attached records have been verified using the "air trace" command. The
   verification output is attached as Exhibit A to this certification. The
   chain verified with status "ok" for 247 records.

8. The cryptographic primitives used are industry-standard, open, and
   independently reproducible. Ed25519 is specified in RFC 8032. BLAKE3 is
   specified in the BLAKE3 reference specification. The Project AIR verifier
   source code is MIT-licensed and available at
   https://github.com/vindicara-inc/projectair.

I declare under penalty of perjury under the laws of California that the
foregoing is true and correct.

Executed on 2026-05-15 at [Location].


_________________________________
[Full Name]
Records Custodian
[Operator Entity]
Template only

Adapted from the form contemplated by FRE 902(13) and 902(11). It is a starting point, not legal advice.

Have counsel review

Procedural requirements vary by jurisdiction and case posture. Qualified counsel should review before you sign or file.

Chain of custody

The certification describes the system. The operator still documents key management, log retention, and access controls.

Chain of custody

What Project AIR provides. What you provide.

Cryptography prevents in-file tampering. It does not prevent whole-file substitution, key misuse, or retention failure. The line is explicit.

Project AIR provides
  • Integrity. Any alteration within a chain breaks verification. Detected deterministically by air trace.
  • Authentication. Each record carries the signer's public key. Any party can verify offline.
  • Chain linkage. Each record is cryptographically bound to its predecessor. Reordering or silent deletion is detectable.
  • Forensic report. forensic-report.json is an auditor-readable artifact with verification status, findings, and record count.
  • Open-source verifier. air trace and airsdk.verify_chain are MIT-licensed. No dependency on Project AIR infrastructure.
Operator provides
  • Key management. Who generates the signing key, where it is stored, who has access, rotation, revocation. Document in a key management policy.
  • Log storage and preservation. Append-only storage (S3 Object Lock, GCS retention locks, WORM hardware). Retention policy documented.
  • Access control. Who can read, write, delete logs. Segregation of duties matters.
  • Timestamp verification. For strong timestamp admissibility, countersign chain checkpoints with an RFC 3161 trusted timestamp authority or an eIDAS Article 42 qualified timestamp service.
  • Custodian identification. The qualified person under FRE 902(13) who signs the certification under oath.
  • Deployment regularity. Continuous production deployment. One-off logging for litigation defeats the business-records exception.
Primitives

Open standards, audited choices.

No pre-image attack, collision attack, or signature forgery is known against Ed25519 or BLAKE3 at the time of this writing. Both are conservative, audited, widely deployed choices.

Ed25519 (EdDSA)
~128 bits. Deterministic signatures, batch verification, wide deployment: SSH, TLS 1.3, Signal, Git.
BLAKE3
128-bit collision resistance, 256-bit preimage resistance. Default 256-bit output.
Canonical JSON
Deterministic encoding: sorted keys, no extraneous whitespace, UTF-8. Reproducible hash inputs.
UUIDv7
48-bit millisecond Unix timestamp prefix, random tail. Timestamp-sortable and unique.
Honest disclosures

Limitations we own, out loud.

A security product that overclaims is worse than useless. Here is what Project AIR does not do.

Disclosure

Admissibility is case-specific

No cryptographic architecture guarantees a record will be admitted in any given proceeding. Courts apply the rules to the facts.

Disclosure

Timestamps are host-clock timestamps

For the strongest timestamp admissibility, countersign with a trusted timestamp authority (RFC 3161) or an eIDAS qualified timestamp service.

Disclosure

Advanced, not qualified by default

AIR produces advanced electronic signatures under eIDAS. Qualified status requires a certificate from an EU-listed Qualified Trust Service Provider.

Disclosure

Chain of custody is procedural

Cryptographic primitives are on us. Key management, log retention, and access control are on you.

Disclosure

Jurisdictional variance

Strongest mapping is US FRE, EU eIDAS, EU AI Act, and GDPR. Other jurisdictions have analogous rules; local counsel handles the procedural fit.

Disclosure

Key compromise is operational

Past signatures remain valid (the attacker cannot retroactively forge). Records produced between compromise and revocation are attacker-controlled. Standard opsec applies.

Ship the proof

Admissibility by design. Everything else is operations.

Instrument your agent, write the chain, hand your custodian a pre-filled certification. Read the EU AI Act post-market monitoring playbook, or pick the pricing tier that covers your stack.

One line to instrument:
$ pip install projectair v0.2.4 · MIT