Ephemeral proofs
The newest receipts in the agent-accountability market are zero-knowledge proofs that a policy check ran: a solver evaluated the action against the rules before it executed, and the proof demonstrates the computation itself — without revealing the policy. This is real cryptography, and at the moment of issuance it proves strictly more than a signature does. We respect it, and the honest rows below say so.
But several implementations of this pattern share three properties stated in their own documentation: proofs are single-use and marked consumed once verified, verification depends on material held on the vendor’s servers, and that material may not persist across the vendor’s own infrastructure updates. The mathematics is permanent. The receipt is not.
This page compares a design pattern, not a vendor. Any system — ours included — can be measured against it.
A proof that can be verified once, while the vendor’s server still holds the material, is a demonstration. Evidence is what still verifies when the reader arrives years late.
The late reader test
Disputes have latency. The action happens today; the subpoena, the coverage dispute, the regulator’s request arrive quarters or years later — after limitation periods have run most of their course, after the agent stack has been rebuilt twice, sometimes after the vendor that issued the receipt has pivoted or folded. A record built for that reader needs three properties:
- It survives re-verification — every party to a dispute checks the same record independently, in any order, as many times as the proceeding requires.
- It survives the vendor — verification runs on open primitives against a public log, not against material only the issuer holds.
- It survives the wait — nothing about the record decays between the action and the dispute, because nothing about it depends on anyone’s servers staying the same.
- · The proof is a gate, not a record — its job ends the moment the action clears
- · Verification is machine-to-machine at transaction time, and the answer is consumed immediately
- · Hiding the checked policy from the counterparty is the dominant requirement
- · The counterparty needs the answer now and will never need it again
- · The reader arrives after the proving material is gone
- · Discovery requires each side to verify the same record independently
- · The record must outlive the vendor that produced it
- · The question is “prove it again, in front of the court”
| Criterion | Sealed Evidence Record | Ephemeral proof receipt |
|---|---|---|
| Lifespan | ||
| How many times the record can be verified | Unlimited — by anyone, in any order, forever | Once — proofs are marked consumed on verification |
| Where the verification material lives | Public transparency log + open primitives | The vendor's servers, including the proving artifacts |
| Survives the vendor's own infrastructure changes | The anchor is outside every vendor's blast radius | Proving material may not persist across server updates |
| Verifiable after the vendor pivots or shuts down | Yes — the log and the verifier outlive us | No — verification dies with the service |
| Time of need | ||
| When the reader typically arrives | Years later — the anchor is still there | Designed for verification shortly after generation |
| Re-verification during discovery | Each party independently re-checks the same record | A consumed proof cannot be re-run by the next reader |
| Adversarial | ||
| Detects a record that has quietly disappeared | Inclusion proofs make absence provable | A consumed proof looks identical to one that never was |
| FRE 902(13)/(14) certification posture | Open process, external anchor, repeatable check | The certifier must explain why it no longer verifies |
| Issuance | ||
| Strength of the claim at the moment of issuance | Attests custody, authority, and content at a point in time | Proves the checked computation itself ran correctly |
| Hiding the checked logic from the reader | Field-level redaction; structure remains visible | The policy is hidden by construction |
The last two rows are ours to lose. At the moment of issuance a zero-knowledge receipt proves the computation itself, and it hides the policy completely — a signed record attests custody and authority, which is a different and, at that instant, narrower claim. If every reader you will ever face arrives within the proof’s lifetime, the ephemeral receipt is the stronger artifact. Litigation timelines rarely extend that courtesy.
The two patterns also answer different questions. An ephemeral proof answers: was this action checked against the rules before it ran? A Sealed Evidence Record answers: who stood behind this action, what did the record say, and has it changed since? A firm that needs both answers can run both layers — enforcement receipts at the gate, sealed evidence in the vault. Nothing about the first substitutes for the second the day a court asks.
The mathematics is permanent. Make sure the receipt is too.
Do not take that on our word either. Seal a record yourself, then verify it twice — today and whenever you come back. The anchor sits in a public log we do not operate, and it will still be there.
Seal a record and verify the anchor →