---
title: "What an auditor needs from an agent action: 12 questions"
url: https://knowyouragent.ch/en/knowledge/evidence-for-agent-actions
lang: en
updated: 2026-10-12
license: © Innopulse Consulting GmbH
---

# What an auditor needs from an agent action: 12 questions

A receipt is only worth as much as the questions it answers without follow-up. These twelve questions are asked by anyone who has to assess an agent action after the fact.

[Leutrim Miftaraj](https://knowyouragent.ch/en/about/leutrim-miftaraj), Founder, Innopulse Consulting GmbH
Published 12 October 2026

Key points

- Twelve questions decide whether a receipt can be verified without follow-up.
- Validity counts at the time of the action, not today.
- What evidence does not answer must be visible in the report.

## Key points

- Disputes about agent actions usually turn on facts, not on questions of law.
- An internal log is weak because the other side cannot verify it.
- Mandate, decision, receipt, chain and [timestamp](https://knowyouragent.ch/en/knowledge/glossary/rfc-3161-timestamp) form a verifiable chain of evidence.
- An [evidence pack](https://knowyouragent.ch/en/knowledge/glossary/evidence-pack) bundles everything in one file that third parties can verify reproducibly.

## Identity and instruction

- Which agent acted, and is its identifier bound to a key?
- Who is the [principal](https://knowyouragent.ch/en/knowledge/glossary/principal), and are they named?
- Who issued the mandate, and can the issuer's key be confirmed independently?

## Scope and validity

- Was the mandate valid at the time of the action – not today, but then?
- Did the action lie within action type, amount limit, currency and counterparty?
- Was the mandate revoked or suspended at the time in question?
- If the authority came through intermediate steps: is every hop signed and no broader than the previous one?

## Decision and execution

- Was there a decision before execution, and what was it?
- Does the [execution receipt](https://knowyouragent.ch/en/knowledge/glossary/execution-receipt) reference exactly this decision and this mandate?
- Is the sequence of receipts gapless, and would a later change be noticed?

## Time and reproducibility

- Is the point in time fixed by an independent timestamp authority, and to which anchor does it lead?
- Can a third party reproduce the result without access to the operator's systems?

## From the list to the model

The twelve questions correspond to the [ten checks](https://knowyouragent.ch/en/method/checks) of KYA; questions 4 and 12 are absorbed into time basis and determinism. Every question the evidence does not answer appears in the report as “not present” or “not checked” – with a reason, never silently.

## What this means in practice

Operators should produce evidence that answers all twelve questions without follow-up: mandate with scope and [status list](https://knowyouragent.ch/en/knowledge/glossary/status-list), decision before execution, chained receipts, timestamp. [Mandact](https://mandact.com/en/protocol?utm_source=knowyouragent.ch&utm_medium=referral&utm_campaign=knowledge-auditor) produces such evidence. Auditors can [verify it here without an account](https://knowyouragent.ch/en/verify).

## What a court wants to know

When a dispute arises about an agent's action, the questions almost always concern facts: which agent acted, for whom, with which instruction, and did it stick to it? Courts assess evidence freely. The more clearly origin, content and time of a piece of evidence are proven, the greater its weight.

A log entry in one's own system is weak here, because the other side cannot verify it and it could be changed afterwards. Signed, chained and timestamped evidence, by contrast, can be recomputed independently. More in the article [AI agent liability](https://knowyouragent.ch/en/knowledge/ai-agent-liability).

## The chain of evidence at a glance

- **Mandate:** the principal sets the limits and signs them.
- **Decision:** before the action, an independent component confirms that it lies within the limits.
- **Receipt:** after the action, what actually happened is recorded, with a reference to the decision.
- **Chain:** receipts are chained so that any later change is detected.
- **Timestamp:** an independent authority confirms when the chain existed.

An [evidence pack](https://knowyouragent.ch/en/knowledge/glossary/evidence-pack) bundles all five elements in one file.

## Retention and verification

Evidence should be kept for as long as claims arising from the action can be asserted. It is important that the related public keys and timestamp anchors also remain available, so verification is possible years later.

KYA verifies such packs reproducibly: same input, same options, same result. The certificate with its reportDigest can therefore itself become part of the file.

## A dispute step by step

A supplier disputes that an order of CHF 4,000 was authorized. The ordering company presents the evidence pack: the mandate allows orders up to CHF 5,000 from this supplier, the decision before the order reads “allow”, the receipt shows amount and counterparty, and a timestamp proves that the chain existed before the complaint. Both sides verify the pack with KYA and receive the same certificate. The dispute shifts from the question of what happened to the question of what follows from it, and can usually be settled quickly.

## Frequently asked questions

### What evidential value does a signed receipt have?

Courts assess it freely. A signature proves origin and integrity; together with chaining and a timestamp, it forms evidence considerably stronger than an internal log.

### How long should evidence be kept?

At least as long as claims arising from the action can be asserted, and within statutory retention obligations. Keys and anchors must remain available for just as long.

### Can a receipt be forged afterwards?

Not unnoticed, if it sits in a [receipt chain](https://knowyouragent.ch/en/knowledge/glossary/receipt-chain) whose state is timestamped. Any change alters the hash values from that point on.

### Who should verify the evidence?

Every party that relies on an action: merchants, banks, auditors and, in a dispute, the other side too. Because verification is reproducible, everyone reaches the same result.

### Is a screenshot enough to prove an agent action?

A screenshot is easy to alter and does not show who acted. Signed, chained evidence is considerably more meaningful because it can be verified independently.

### What belongs in a file about an agent action?

The evidence pack with mandate, decision, receipt and timestamp, the keys and anchors used, and the certificate with its reportDigest.

### Does every agent action have to be recorded?

Not every one. Reading actions without consequences usually need no receipt. Actions with consequences, such as payments, orders or submissions to authorities, should be recorded without gaps, because exactly these count in a dispute and must be verified independently later.

## Sources

- RFC 3161: Time-Stamp Protocol: [https://www.rfc-editor.org/rfc/rfc3161](https://www.rfc-editor.org/rfc/rfc3161)
- eIDAS-Verordnung (EU) Nr. 910/2014: [https://eur-lex.europa.eu/eli/reg/2014/910/oj](https://eur-lex.europa.eu/eli/reg/2014/910/oj)

---
Quelle: https://knowyouragent.ch/en/knowledge/evidence-for-agent-actions · KYA – Know Your Agent