Open standard

Proof of Control.

An open standard for proving what AI agents did. Here is how far Aqua’s evidence goes today, the proofs of concept we want to run with partners, and what opens the next tier.

Proof of Control, Working Draft v0.1 · SDK a9d63c4 · 18 October 2026 · Self-assessed by inblock.io

Why proof of control matters.

Today, trusting data means trusting whoever holds it. But AI agents now act across organisations: an agent sends an invoice, signs a contract, moves data to a partner. At every handover, the next party takes the record on faith.

Someone has to answer for what an agent did, to partners and to regulators. Without that you can’t manage the risk, and without managing the risk you can’t use agents at scale. Proof of Control is the open standard for showing it.

Promises don’t travel between organisations. Proof does.

The result.

Grade today

Tier 2

Self-assessed. Someone still vouches for the evidence.

In the standard

127

Requirements, each one checkable.

Met by the SDK

60 of 60

In the architecture. 36 run in reference code today; 24 wait for a proof of concept.

Beyond the SDK

Duties of the system around it or of the organisation. Named, not rated.

Re-assessed against the current SDK on 18 October 2026.

Where each requirement stands.

All 60 requirements a software library can meet are met in Aqua’s design. Some need nothing but the SDK. Others hold once the gateway your agents call tools through, any system that enforces the decision, or a secure enclave, does its part. Each square is one requirement of the standard.

Shown in running code (36)
Proof of concept to run (24)
Of those, needed first (7)

With the SDK alone 42 requirements

1.1.1
1.1.3
1.1.5
1.2.2
1.2.3
1.3.1
1.4.1
1.4.2
2.1.1
2.1.2
2.3.1
2.3.2
3.1.1
3.1.2
3.2.1
3.2.2
4.1.1
4.2.1
4.2.2
4.2.3
5.1.2
5.2.1
5.2.2
6.3.2
6.3.3
6.3.4
6.3.5
7.2.2
7.3.1
7.3.3
7.3.4
7.3.5
7.6.2
7.6.6
7.7.1
7.7.2
7.7.3
7.7.4
7.7.5
8.1.5
8.1.8
9.2.3

Through the agent’s tool gateway 12 requirements

1.1.4
1.2.1
2.1.3
4.1.4
4.1.6
4.1.7
4.1.8
5.1.1
5.1.3
6.1.2
7.1.2
7.5.1

Wherever the decision is enforced 3 requirements

2.2.1
2.2.2
4.1.2

Through secure enclaves 3 requirements

2.3.3
2.4.1
4.2.4

The proofs of concept we want to run.

For 24 requirements the design is settled and we know how to build it. What is missing is a working proof, in a real setting, with a partner. Here they are, grouped by the partner each one needs.

Agents that stay inside their mandate

An AI agent acts through tools. The gateway between the agent and its tools is where rules are enforced and records are written, and today most gateways keep neither in a form anyone else can check.

How Aqua solves it. The gateway, typically an MCP server, checks each tool call against the tool’s signed definition, the person’s delegation and the business rules, and writes a signed record before, during and after the call. Aqua supplies the definitions, the check and the decision. The gateway acts on it.

Partners we are looking for: Teams building agent platforms and MCP servers.

4.1.4 One tool call checked three ways: its shape, extra rules, and the state of a related business record. Needed first
4.1.7 A limit that holds across a whole session, such as a total over many payments, not only per call.
4.1.8 Approval thresholds read from the signed grant, so no tool output can raise them.
4.1.6 Human approvals signed with a passkey, rejections included, recording exactly what was shown.
5.1.3 A delegation from the person to the agent itself, checked on every call.
1.1.4 Only approved tools and plugins admitted, by verified signature or by allow and deny lists.
1.2.1 Every document and memory the agent reads, recorded as it arrives.
2.1.3 What the agent passed on to a tool or a third party, recorded apart from what it used.

Results you can trust without seeing the data

Some checks run over data that has to stay confidential: salaries, health records, the chain of delegations between two companies. The standard asks for proof that the result is right without showing what went in.

How Aqua solves it. Several independent secure enclaves run the same Aqua check, and each signs its result. You rely on the enclaves agreeing, not on one operator, and the data never leaves them.

Partners we are looking for: Confidential-computing providers and operators of enclave infrastructure.

2.3.3 A result over confidential inputs, released only when the enclaves agree on it. Needed first
4.2.4 Proof that a confidential chain of delegations is in order, without revealing the chain. Needed first
2.4.1 Kept evidence reduced to an agreed extract, attested by the operator and signed in the enclave. Needed first

Knowing which model did it

A record that says “the model” is not evidence. It matters which weights, which configuration, which build, and where each of them came from.

How Aqua solves it. Aqua records signed fingerprints of the model, its serving configuration and the build it runs in, and checks them against the providers you have approved.

Partners we are looking for: Model providers and teams running model serving.

1.1.5 A provenance record for a model’s supply chain, from source to deployment. Needed first
1.2.3 Each data transformation recorded with its process, its version, and fingerprints of what went in and came out. Needed first
1.1.1 The provider’s fingerprint of the model and its configuration in every execution record.
1.1.3 A model’s chain of signatures checked against approved providers before it runs.
1.3.1 The exact image or build of the environment the agent ran in.

Logs nobody can quietly rewrite

An evidence log is only as good as the proof that nothing was removed, rewritten, or shown differently to different people.

How Aqua solves it. Aqua chains every record to the one before it and anchors the chain outside the operator’s control, with trusted timestamps or a public blockchain. These proofs of concept close the loop from a single record to the published anchor.

Partners we are looking for: Auditors, data platforms, and operators of evidence storage.

3.1.1 A signed record each time data crosses from one organisation or system to another: from where, to where, and what. Needed first
7.3.3 Log checkpoints anchored on a public blockchain, so nobody can show two different histories.
7.3.4 Proof that one record is in the log, delivered with the record, without handing over the rest.
7.3.5 Each checkpoint checked against its anchor, end to end.
7.6.6 A declared anchoring interval, checked, with an alert when a deadline is missed.
6.3.3 When a key is compromised: every record it signed found, and everyone relying on it told.
2.1.1 Every read and write of content kept in a signed activity log.
2.1.2 Regular scans that no protected data has slipped into the evidence.

What the tiers mean.

Proof of Control grades evidence in four tiers. At Tiers 1 and 2 you trust a party: someone vouches for the evidence. At Tiers 3 and 4 nobody has to: anyone can check it directly. Aqua’s evidence reaches Tier 2 today. Every record is signed by a key that a named party holds, and of the code that checks it, only a snapshot is public so far: aqua-rs-sdk-core, not yet the full SDK at the version each claim names.

Where Aqua is strongest.

A system of evidence, not a record.

Every entry is recorded, attributed and checkable, the way accounting treats transactions. Each step is chained to the one before it, so a broken chain fails the check instead of quietly getting shorter.

Evidence that travels.

Records carry what is needed to check them, so they can be checked offline and across organisations, with no central platform in between and without asking us.

Who acted, and with what right.

Identity, delegations and permissions are part of the evidence, key changes and post-quantum signatures included, not a side note.

Evidence that reads the same everywhere.

Signed data has one exact form, and every fingerprint and signature names its method, so two checkers cannot disagree about what was signed.

What opens the next tier.

Today anyone can inspect aqua-rs-sdk-core, a published snapshot of Aqua’s core under the Apache-2.0 licence. The full SDK, the version every assessment here is made against, is in pre-release.

Today

A public snapshot, and the full SDK for pilots.

Anyone can read and run aqua-rs-sdk-core, the published snapshot of Aqua’s core. Pilot partners work with the full SDK before its release.

When the viewer is published

Anyone can check Aqua evidence themselves.

A free verification tool, published as a binary, checks evidence without an account, a contract or our help.

When the SDK is published

The verification code is open to inspect.

The full SDK, at the version each claim names. This is what the highest tiers of Proof of Control ask for.

An outsider can run the check the standard asks for at Tier 3, with nothing from us but the published tool.
Nineteen requirements can then be graded for Tier 3, for claims anchored on a public blockchain.

Requirements about the system around the SDK, or about the organisation running it, stay where they are: what we report, and what we don’t.

Run a proof of concept with us.

Every proof of concept above is designed and ready to build. You bring the setting: an agent gateway, enclave infrastructure, a model pipeline or an evidence trail that has to hold up. We bring the full SDK, before its release, and the engineering.

Tested in 2026 in EUSAiR, the EU’s pilot sandbox for the AI Act. What we did there.

Become a partner → Read the standard

Public comments on Working Draft v0.1 close 30 October 2026.