%% You should probably cite draft-sharif-agent-audit-trail-06 instead of this revision.
@techreport{sharif-agent-audit-trail-03,
    number =    {draft-sharif-agent-audit-trail-03},
    type =      {Internet-Draft},
    institution =   {Internet Engineering Task Force},
    publisher = {Internet Engineering Task Force},
    note =      {Work in Progress},
    url =       {https://datatracker.ietf.org/doc/draft-sharif-agent-audit-trail/03/},
    author =    {Raza Sharif},
    title =     {{Agent Audit Trail: A Standard Logging Format for Autonomous AI Systems}},
    pagetotal = 44,
    year =      ,
    month =     ,
    day =       ,
    abstract =  {This document specifies a standard logging format for autonomous AI agent systems. The Agent Audit Trail (AAT) defines a JSON-based record structure with mandatory fields for agent identity, action classification, outcome tracking, and trust level reporting. Records are linked via tamper-evident hash chaining using SHA-256 per RFC 8785, with optional ECDSA signatures for non-repudiation. The format addresses requirements from the EU AI Act (Regulation 2024/1689), which mandates automatic recording of events for high-risk AI systems effective August 2026. It also maps to SOC 2 Trust Services Criteria, ISO/IEC 42001, ISO/IEC 24970, prEN 18229-1, and PCI DSS v4.0.1 logging requirements. The design is transport-agnostic and supports export to JSONL, Syslog (RFC 5424), and CSV while preserving chain integrity. Privacy is addressed through input/output hashing, content fingerprinting, and tombstone-based deletion compatible with GDPR Article 17. This revision (-01) adds pre-execution recording requirements, recording independence, deny reason codes, replay protection, external timestamp anchoring, and content fingerprinting based on feedback from independent implementers. This revision (-02) adds a Decision Reproducibility section (Section 13) that distinguishes record reproducibility, available for any model, from decision reproducibility, available only for open-weight models executed at temperature zero in an attested environment, and defines the associated record fields. This revision (-03) adds the Attestation Closure requirement (Section 13.6): the digests recorded for decision reproducibility MUST cover the complete computational closure of the inference function -- model weights, tokenizer, chat template, inference engine build, decoding configuration, and numeric environment -- together with new record fields (tokenizer\_digest, chat\_template\_digest, engine\_build\_digest) and a minimal-change threat analysis (Section 13.7) showing that any component left outside the attested set is a forgery channel.},
}