Verify an authorization receipt yourself. Two minutes, offline, no one’s word for it.

An authorization receipt (formerly Trust Receipt) is a signed, machine-verifiable evidence packet proving that an enrolled approver key authorized a specific AI-agent action before it executed. When the auditor independently trusts the directory binding for that key, the receipt supports attribution to the named approver. Unlike an audit log — which asserts what happened inside a system you cannot inspect — a receipt is something you re-verify yourself, with public-key cryptography, without relying on the auditee’s systems or on EMILIA.

Written for U.S. government auditors (GAGAS / the GAO Yellow Book), single-audit practitioners and state auditors, SOC 2 and ISO/IEC 42001 assessors, EU AI Act conformity reviewers, and internal audit. No cryptography background required.

The verification procedure

1. Obtain the evidence packet. Request the receipt or device-signoff JSON for the sampled action from the auditee. Some packets carry a public key for a self-consistency check, but a key carried by the artifact cannot establish its own identity. Obtain the relying party’s independently pinned issuer key and, for named-person attribution, the trusted approver-directory binding. If the auditee can only show you a dashboard, that is a finding, not evidence.
2. Re-verify it independently. Two equivalent paths: in the browser at emiliaprotocol.ai/verify (the check runs locally in your tab — open the network panel and observe that nothing uploads), or fully offline in a terminal:

   npx @emilia-protocol/verify receipt.json

   The verifier is open source (Apache-2.0, published on npm) — your firm can pin and review the exact code it ran. Firms standardizing on Python or Go can use the equivalent reference verifiers (Python, Go) in the same public repository — three same-team reference ports, all held to the same published conformance suites (21 active suites and 329 vectors), so the verdict does not depend on which language your team runs.
3. Read the checks. Each line is one verified property (table below). A valid artifact passes all of them; any single failure invalidates it.
4. Record the result. The workpaper fields below make the verification reproducible by anyone, years later — the receipt does not expire and does not need our servers.

What each check proves

What to record in workpapers

Red flags

• A governed action class (e.g. payment release) with no receipt produced for a sampled transaction — absence of evidence is the finding.
• key_class C on actions the auditee’s own policy designates as requiring Class A (approver-held key).
• challenge_binding: false on any artifact — the approval evidence does not match the action it is attached to.
• Receipts that can only be “verified” inside the auditee’s or vendor’s own dashboard. Independently verifiable evidence requires no such access.

Ingesting receipts into a SIEM

Receipts are canonical JSON (RFC 8785) — Splunk, Datadog, and Elastic parse them natively, which lets a compliance dashboard correlate every governed action with its human approval. Core fields:

Full schema in the specification. Verify signatures before ingest; treat the SIEM copy as an index, the signed JSON as the evidence.

Compliance and control mappings

• U.S. government audit mapping — GAGAS / GAO Green Book / Uniform Guidance (2 CFR 200)
• EU AI Act mapping — financial services
• EU AI Act mapping — government programs
• EU AI Act mapping — healthcare
• SOC 2 evidence map — authorization receipts → CC6.1 / CC6.2 / CC7.2 / CC7.3
• SOX ICFR mapping — receipts as authorization evidence in key controls (§302/404)
• Treasury and payment controls mapping — wires, beneficiary changes, releases
• NIST AI RMF mapping — MEASURE / MANAGE subcategories, per-subcategory evidence
• Agentic AI runtime controls — evidence for agent-action oversight testing
• Public benefits integrity — improper-payment and disbursement controls
• Human-control crosswalk — EU AI Act Art. 14, NIST, ISO/IEC 42001 side by side
• Auditor control catalog — copy-paste RCM rows with executable test commands