Record the action. Check the record later.

A client, human app, or agent calls an API. The response returns with a signed record in the PEAC-Receipt header: same request, same wire, one extra header. The publisher's terms live at /.well-known/peac.txt, and the record binds a digest of the policy that was in force at the moment of the call.

Later, a verifier can confirm the issuer signed a record binding: the request digest, the response digest, and the referenced policy for this call, without the vendor's logs, dashboard, or cooperation.

An agent host calls a tool over the Model Context Protocol. The tool result returns with the record tucked into _meta, a standard MCP extension point, so hosts that do not know PEAC simply ignore it. A separately signed tool-definition manifest pins what the tool was, meaning its name, schema, and version, when it ran.

Later, a verifier can confirm the issuer signed a record binding: Which tool version ran, what it received, and what it returned. Per call, offline, across host and server boundaries.

An agent proposes an action, and a human or policy approves it. The approval record binds exactly one proposal digest. The execution record must bind that same digest. If the action changed after approval, the flow emits a denied record and fails closed. Every step links to the previous one, building a per-run lineage chain.

Later, a verifier can confirm the issuer signed a record binding: The action that executed was byte-for-byte the action approved, who delegated to whom, and that the run chain matches the issuer's sealed run summary and count.

Traffic passes a gateway or guardrail: an AI proxy, an MCP gateway, an egress filter. The gateway decides to allow, deny, or route to review, and sometimes redacts on the way through. PEAC records the decision facts: the outcome, a reason code, the digest of the policy the issuer recorded, and two content digests, one for what was produced and one for what was delivered.

Later, a verifier can confirm the issuer signed a record binding: the issuer-reported policy reference and distinct produced and delivered digests, so a verifier can confirm the delivered content differs from what was produced, without revealing either. A signed refusal is evidence too.

An agent hits a paid resource and gets a 402 response with a signed offer. Payment settles on the rail, such as x402, Stripe, or paymentauth, never on PEAC. The seller then issues a record that preserves the rail's own signed artifacts alongside the amount and the delivery digest. The counterparty can add a linked acknowledgment record.

Later, a verifier can confirm the issuer signed a record binding: What was offered, what was paid, and what was delivered: the exact dispute triangle. Replay-guarded, bundle-exportable, and verifiable offline.

An agent provisions real infrastructure: accounts, resources, credentials, budgets, subscriptions, and deployments. Each event becomes an *-observed record. The critical property is that credential material is never captured. The schema itself rejects secret values, so the record carries a reference and a digest, and a leak through the evidence layer is structurally impossible. See provisioning records.

Later, a verifier can confirm the issuer signed a record binding: Every account, resource, credential, and budget an agent created, changed, or removed: the anti-shadow-infrastructure trail, without a single secret in the evidence.