@techreport{marques-asqav-compliance-receipts-05,
    number =    {draft-marques-asqav-compliance-receipts-05},
    type =      {Internet-Draft},
    institution =   {Internet Engineering Task Force},
    publisher = {Internet Engineering Task Force},
    note =      {Work in Progress},
    url =       {https://datatracker.ietf.org/doc/draft-marques-asqav-compliance-receipts/05/},
    author =    {João André Gomes Marques},
    title =     {{Compliance Profile of Signed Action Receipts for AI Agents}},
    pagetotal = 88,
    year =      2026,
    month =     may,
    day =       31,
    abstract =  {This document defines a multi-jurisdiction compliance profile of the signed action receipt format used by AI agents to record machine- readable evidence of access-control decisions. The profile binds receipt fields to two regulatory surfaces: on the European Union side, Articles 12 and 26 of the EU AI Act (Regulation (EU) 2024/1689) and Article 17 of DORA (Regulation (EU) 2022/2554); on the United States side, the NIST AI Risk Management Framework, the Colorado AI Act, the Texas Responsible AI Governance Act, the New York Department of Financial Services Cybersecurity Regulation (23 NYCRR Part 500), the HIPAA Security Rule, SEC Rule 17a-4, and the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA). Working entirely within the existing wire format, canonicalization transformation, and signing algorithms of the underlying receipt format, the profile tightens a subset of the OPTIONAL fields to REQUIRED, imposes a retention floor, and requires at least one timestamping anchor (RFC 3161 or OpenTimestamps). It registers OPTIONAL extension fields for risk and incident classification, cross-agent envelope binding, per-action freshness and integrity, build provenance, threat-framework taxonomy, and server-built enforcement attestation, each subject to false-attestation guards where applicable, and registers receipt type namespaces for passive- telemetry and result-bound observation receipts. The full field set and its normative requirements are defined in the body of this document.},
}