Six surfaces. One primitive.

A client, human app, or agent calls an API. The response returns with a signed record in the PEAC-Receipt header: same request, same wire, one extra header. The publisher's terms live at /.well-known/peac.txt, and the record binds a digest of the policy that was in force at the moment of the call.

Later, anyone can prove: This exact response was served for this exact request, under this exact policy, without the vendor's logs, dashboard, or cooperation.

An agent host calls a tool over the Model Context Protocol. The tool result returns with the record tucked into _meta, a standard MCP extension point, so hosts that do not know PEAC simply ignore it. A separately signed tool-definition manifest pins what the tool was, meaning its name, schema, and version, when it ran.

Later, anyone can prove: Which tool version ran, what it received, and what it returned. Per call, offline, across host and server boundaries.

An agent proposes an action, and a human or policy approves it. The approval record binds exactly one proposal digest. The execution record must bind that same digest. If the action changed after approval, the flow emits a denied record and fails closed. Every step links to the previous one, building a per-run lineage chain.

Later, anyone can prove: The action that executed was byte-for-byte the action approved, who delegated to whom, and that the run chain is complete: nothing added, nothing missing.

Traffic passes a gateway or guardrail: an AI proxy, an MCP gateway, an egress filter. The gateway decides to allow, deny, or route to review, and sometimes redacts on the way through. PEAC records the decision facts: the outcome, a reason code, the digest of the policy that applied, and two content digests, one for what was produced and one for what was delivered.

Later, anyone can prove: The gateway applied a specific policy and delivered something different from what was produced, provable without revealing either content. A signed refusal is evidence too.

An agent hits a paid resource and gets a 402 response with a signed offer. Payment settles on the rail, such as x402, Stripe, or paymentauth, never on PEAC. The seller then issues a record that preserves the rail's own signed artifacts alongside the amount and the delivery digest. The counterparty can add a linked acknowledgment record.

Later, anyone can prove: What was offered, what was paid, and what was delivered: the exact dispute triangle. Replay-guarded, bundle-exportable, and verifiable offline.

An agent provisions real infrastructure: accounts, resources, credentials, budgets, subscriptions, and deployments. Each event becomes an *-observed record. The critical property is that credential material is never captured. The schema itself rejects secret values, so the record carries a reference and a digest, and a leak through the evidence layer is structurally impossible. See provisioning records.

Later, anyone can prove: Every account, resource, credential, and budget an agent created, changed, or removed: the anti-shadow-infrastructure trail, without a single secret in the evidence.