Did the signed record change?
AFA uses Ed25519 signatures to check whether the recorded bytes changed after signing. A valid signature does not tell you where the event belongs in the timeline.
Security model Clear checks, clear limits
What does an AFA record actually prove?
AFA asks separate questions: Was the action allowed? Did the signed record change? Is it still in the right order? Was it stored safely? Is its content true? A yes to one question is not automatically a yes to the others.
Is the event still in order?
A separate chain check asks whether each event still follows the event that came before it. This matters because approval before an action is different from approval added later.
Was the action allowed?
On a supported host with enforcement turned on, AFA can allow an action, ask a person, or deny it before the tool runs. A host that does not call the gate cannot be controlled by it.
Was the action correct?
A properly authorized agent can still be wrong. Signed, ordered records help establish custody and integrity; they do not prove that the action or result was factually correct.
Did the task drift?
AFA can compare two envelopes and surface changes to the actor, purpose digest, scope, action class, time mode, or step order. That is structural drift detection, not a judgment about private reasoning.
Does this prove IP ownership?
No. Signed chronology and content digests can support a dispute by showing custody and sequence. Authorship, originality, ownership, and infringement require evidence and judgment beyond AFA.
What private content is kept?
The authority record stores structural fields and one-way digests. It does not store raw prompts, source code, secrets, or a model's private reasoning.
Will the record survive?
The current local writer uses SQLite in WAL mode and keeps JSONL as an export. Six damaged historical JSONL lines are preserved as evidence, so the ledger is honestly marked degraded instead of being presented as clean.
| Capability | Evidence question | Boundary |
|---|---|---|
| Action decision | Did the connected host ask AFA to allow, pause, or deny the action before it ran? | The host must connect to the gate and send the action in a supported format. |
| Signed record | Do the signatures match the expected public identity? | A valid signature does not prove order or truth. |
| Ordered record | Does each event still appear in the place where it was written? | Every supported verifier must agree before hosted launch. |
| Child-agent start | Was a live, signed grant recorded when the child agent began? | That record does not yet enforce every file, tool, or call limit for the child. |
| Hosted storage | Will production refuse to start if its durable database is missing? | Hosted launch gate remains open. |