# APIR, the evidence record for AI agents

> Show your AI's work. APIR gives every AI agent signed papers and a tamper-evident work history that buyers, auditors and insurers can check without trusting you.

APIR stands for Audit, Proof, Identity, Record: Audit for the log book, Proof for the
signatures and timestamps, Identity for the agent's signed ID, and Record for
the history anyone can check.

## Who it is for

- **AI vendors** whose deals stall at a buyer's security review or on an
  insurer's AI questions. The buyer gets a record to check, not a claim to
  believe: the agent's papers, its log book, and an Evidence Pack for the file.
- **Australian organisations** preparing for the Privacy Act's automated-decision
  disclosure. From 10 December 2026, APP 1.7 requires an organisation's privacy
  policy to describe automated decisions that use personal information and
  could significantly affect people. A record of what each agent decided is the
  evidence behind that disclosure. APIR does not give legal advice; the
  organisation's own lawyer writes the words.
- **Auditors and insurers** who need a record they can check themselves, without
  trusting the vendor or APIR.

## Agent evidence

- **The Check** (https://apir.ai/check-agent): free forever, no account. Any
  agent's passport ID or name; the Ed25519 signature is re-checked against the
  published key, the mandate read back and the log book proven intact.
- **The public registry** (https://apir.ai/registry): every public Trust
  Passport, each one checkable.
- **Agent papers**: a signed ID (an Ed25519 credential anchored to
  `did:web:apir.ai`), a mandate that says what the agent may and may never
  do, a log book, and a public Trust Passport once the agent is graded. The first working agent is free
  (the First Employee, https://apir.ai/register?next=/agents/first); each
  further agent is AUD 49, once, for life.
- **The log book** (the Agent Black Box): an insert-only, hash-chained (SHA-256)
  record of what the agent did. The chain head is timestamped every night by an
  outside RFC 3161 authority, so nobody, APIR included, can backdate an entry
  past the last stamp without the check showing it.
- **The Evidence Pack** (https://apir.ai/pricing): one agent's hash-chained
  record, sealed and Ed25519-signed, for a deal, a security review or a claim,
  with a public link anyone can verify. AUD 499, one-time.
- **Wage** (AUD 99 per agent, per month) and **Crew** (AUD 499 per
  month, up to ten agents): everything on for working agents. APIR's own agents
  run on the same papers and log book, and they are the live demonstration of
  the record (https://apir.ai/hire). Agents draft and stage; a person sends.

Bring your own agent: an agent that runs anywhere is registered at
https://apir.ai/agents/connect, gets an API key, and sends each thing it does
to POST https://apir.ai/api/v1/events. Every action goes into the same
insert-only, hash-chained log book, timestamped nightly by an outside RFC 3161
authority. Prompts and outputs never leave the agent's side; only their SHA-256
hashes are sent. Said plainly: the log book proves what the agent reported and
shows any later change to it, not that the report was complete, and the
mandate is written by the agent's owner. The first agent is free.

## How anyone verifies it

- DID document: https://apir.ai/.well-known/did.json
- Public keys (JWKS): https://apir.ai/.well-known/jwks.json
- Verify a passport: https://apir.ai/verify-passport
- Check any agent: https://apir.ai/check-agent
- Public registry: https://apir.ai/registry
- What APIR holds and does not hold yet: https://apir.ai/trust
- MCP server for AI assistants: https://apir.ai/api/mcp (in the official MCP
  registry as ai.apir/verify): verify_agent, check_authority,
  get_verification_keys, read-only and free

Signatures verify against the published key, offline if you like. A passport
reflects the agent's state as of its last assessment; the timestamp is on the
passport. Tamper-evident, verified as of the moment it is opened. It proves the
record is intact, never that the agent was right.

## File sealing

A tool on the same record. Seal a file free for a person at https://apir.ai/seal:
it is fingerprinted in the browser, never uploaded, and timestamped by an
outside authority. Anyone checks a copy at https://apir.ai/seal/check with no
account, or offline with https://apir.ai/proof/verify-seal. Seal by API is
AUD 2 per seal (https://apir.ai/developers). A seal can carry later
acts, each its own event: an AI involvement statement as the declarant
declares it (bands, never figures), process files, custody records,
attestations by named people, and contests with answers; APIR does not rule
on contests. A Seal Evidence Pack, AUD 49, is one document from a
seal's record for an appeal, a client or a dispute. A review signed by a
person, AUD 149, records consistent, inconsistent or insufficient against
the declaration, never authorship. Checking by API is free for the first
1,000 files a month, then AUD 0.02 a file. Every seal also verifies
offline with https://apir.ai/proof/apir-seal.mjs. APIR sealed the
declaration and the files; it did not determine how the work was made.

## Business checks

A side-line for anyone buying a business (https://apir.ai/business).

- Business Profile, free: the public register record, sourced and dated
  (https://apir.ai/profile).
- Check the numbers, free: two arithmetic tests in the browser
  (https://apir.ai/check-numbers).
- Numbers Check, AUD 149: the two tests, approved by a person and
  sealed (https://apir.ai/numbers/new).
- Triage Verdict, AUD 2,500, fixed, paid before work starts: can these
  documents all be true at once? Consistent, inconsistent or insufficient,
  workings shown, signed by a person within 48 hours of the last document
  landing, verifiable with the token printed on it
  (https://apir.ai/triage-verdict; the seller's door is https://apir.ai/sell-side).
- The Deal File, quoted up front (https://apir.ai/deal-file).

Never a valuation, an audit or advice.

## Also live, not featured

- Wills and valuables register: https://apir.ai/wills
- The Vault: https://apir.ai/vault
- AI Answer Record: https://apir.ai/answers

## Core systems

- **Trust Passport**: public, Ed25519-signed credential; verifiable against the
  published key at https://apir.ai/.well-known/did.json
- **Agent Black Box**: hash-chained (SHA-256) append-only event record
- **Trust Genome**: scoring across capability, conduct and evidence; an agent
  with no score is shown as Unrated, never given a made-up one
- **Mandate / ARBITER**: the authorisation ceiling an agent cannot exceed
- **Ghost Audit**: continuous re-checking of agents already in service

## Regulatory context

APIR's records are built to support evidence obligations under the EU AI Act,
NIST AI RMF and ISO 42001, including human oversight, event logging and
technical documentation, and the automated-decision disclosure in Australia's
Privacy Act (APP 1.7, from 10 December 2026). APIR produces evidence. It does
not certify compliance, and it is not a law firm or an auditor. What the OAIC
says about APP 1.7 to 1.9, quoted with its sources:
https://apir.ai/australian-privacy-act-automated-decisions

## What APIR is not

APIR is not a compliance platform. It does not run a GRC programme, write
policies, or audit anyone. Compliance teams use its records as evidence, which
is a use of APIR, not a description of it.

APIR is not an insurer or a broker; no underwriting partner exists. It is not
an agency; it papers agents and does not operate them for customers. Its agents
are never autonomous: they draft and stage, and a person sends. It has no
relationship with any coach, programme or seminar, and nothing here implies
one. It does not promise results. It proves whatever happens.

## Guides

Answer pages, each with its sources and the date they were read:

- What is an AI agent evidence record?: https://apir.ai/what-is-an-ai-agent-evidence-record
- How to prove what your AI agent did: https://apir.ai/how-to-prove-what-your-ai-agent-did
- AI agent audit and compliance tools compared: https://apir.ai/ai-agent-audit-tools-compared
- Privacy Act automated decisions, 10 December 2026: https://apir.ai/australian-privacy-act-automated-decisions

## Links

- Check any agent: https://apir.ai/check-agent
- Public registry: https://apir.ai/registry
- Verify a passport: https://apir.ai/verify-passport
- AI agents: https://apir.ai/hire
- Methodology: https://apir.ai/methodology
- Pricing: https://apir.ai/pricing
- Trust Center: https://apir.ai/trust
- Seal a file: https://apir.ai/seal
- Check a file: https://apir.ai/seal/check
- API docs: https://apir.ai/docs
- Check a business: https://apir.ai/business
- Profile a business, free: https://apir.ai/profile
- Check the numbers, free: https://apir.ai/check-numbers
- The Triage Verdict: https://apir.ai/triage-verdict
- The Deal File: https://apir.ai/deal-file
- About APIR: https://apir.ai/about
- AI disclosure: https://apir.ai/legal/ai-disclosure
- Full text of this file and the guides, for AI systems: https://apir.ai/llms-full.txt

## Operator

RIPA PTY LTD trading as APIR (ABN 48 638 569 632). APIR stands for Audit, Proof, Identity, Record.
Adelaide, South Australia.
Contact: ripa@apir.ai, Security: security@apir.ai