# Proof bound to every agent transaction and its settlement

Source: https://www.qatom.ai/assurance
Updated: 2026-10-14

Qatom binds cryptographic proof to each AI agent transaction and its settlement at the moment of execution. Settlement and the verifiable record are one operation, so the record cannot be reconstructed afterwards or altered without detection. A counterparty, auditor, regulator, insurer or court can verify it independently, offline, without trusting the organization that produced it.

## Four properties

- **Bound at execution.** Settlement and the verifiable record are the same operation, not two systems reconciled later. The record cannot be reconstructed after the fact because it was never separate from the transaction.
- **Verifiable by anyone, offline.** Each TODA file carries its own Proof of Provenance, an unbroken chain of custody built from rigs. Verification is local, with no network call, no shared ledger and no need to trust the originator.
- **Private by default, visible by consent.** The trusted system can anchor a proof without seeing the underlying data. You decide who receives the full record, such as a counterparty, auditor or supervisor, while others see nothing.
- **Deploy where your controls are.** Qatom runs hosted, in your VPC, on-premises or air-gapped. RBC holds the reserve funds backing USD inside Qatom and supports bank on-ramp and off-ramp transfers.

## How it works

1. **Fund a separate agent wallet.** Each user has a primary twin and an agent twin, the wallet the AI spends from, with its own budget. Role-based access sets who can see or move funds in each twin.
2. **Set the limit and the approval rule.** Purchases under an auto-approve limit you set go through; larger ones need approval by passkey or phone app. The approver can check the item, seller and price before approving.
3. **The agent calls with payment.** Payment, delivery and a receipt happen in one call through Qatom. The seller's endpoint accepts only calls carrying a secret header that Qatom sends. Each update to the file must satisfy the previous step's authorization requirements, such as specific signatures.
4. **Settlement between twins.** USD-TDN (1 USD-TDN = 1 USD) settles from the agent twin to the seller's twin in under one second, with no gas and no transaction fees. The seller verifies the call with X-Qatom-Transaction-Id, so each sale is served once.
5. **A file with proof of provenance.** The settled value is a TODA file that carries its own Proof of Provenance. Every purchase also returns a transaction id and an emailed proof of purchase.
6. **Verify and export.** In the Qatom Console, inspect provenance, verify a file's integrity, download the .toda file and export a twin's ledger as CSV. Anyone you give the file to can verify it offline.

## What the proof shows

- What was executed, paid and settled
- Which twins paid and received
- Which authorization each step satisfied
- An unbroken chain of custody from creation onward
- No conflicting version of the history was produced (non-equivocation)
- The same funds were not spent twice
- The history was not altered or substituted

## What it does not prove

- That the agent's decision was correct
- That the agent stayed within its intended policy scope
- That the original data or judgment was accurate
- A system-wide view for macro-prudential monitoring
- That regulators accept these records; none has formally opined, and supervisors are not yet familiar with rigging trees

## Frameworks and rules

What these rules and standards ask for, and evidence that can help meet them. This is not legal advice; confirm your obligations with your counsel.

- **[EU AI Act, Articles 12, 19 and 26](https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-12)**: asks for: High-risk systems must technically allow automatic event logging over their lifetime; logs kept at least six months unless other law says otherwise. Annex III applies 2 December 2027. Evidence: Payment records generated at execution that cannot be altered without detection; they complement, not replace, your system's event logs.
- **[EU Product Liability Directive (EU) 2024/2853](https://www.hlc.com/en/publications/eu-introduces-comprehensive-digitalera-product-liability-directive)**: asks for: Software, including AI, is a product. Courts can order evidence disclosure. Member states transpose by 9 December 2026. Evidence: Independently verifiable records of what was executed and settled, which can be disclosed without relying on your own account of events.
- **[California AB 316 (Civil Code 1714.46)](https://legiscan.com/CA/bill/AB316/2172)**: asks for: A defendant that developed, modified or used AI cannot argue the AI autonomously caused the harm. Evidence: Records of what the agent executed and paid, and under which authorization, to establish the facts in a dispute.
- **[NIST AI RMF 1.0](https://www.nist.gov/itl/ai-risk-management-framework)**: asks for: Voluntary: Govern, Map, Measure, Manage. Trustworthy-AI characteristics include accountable and transparent, valid and reliable, secure and resilient. Evidence: Support for accountability and transparency: each agent payment traceable to its authorization through a verifiable chain of custody.
- **[ISO/IEC 42001:2023](https://www.iso.org/standard/81230.html)**: asks for: Establish, implement, maintain and continually improve an AI management system, whether you provide or use AI. Evidence: Exportable, verifiable records of agent spending and authorization to support monitoring and internal audit within the management system.
- **[OSFI Guideline E-23 (Canada)](https://www.osfi-bsif.gc.ca/en/guidance/guidance-library/guideline-e-23-model-risk-management-2027-letter)**: asks for: From 1 May 2027, federally regulated financial institutions manage AI model risk; third-party models validated and monitored commensurate with risk. Evidence: Per-transaction proof and exportable ledgers to support monitoring of third-party agent activity, proportional to its risk.

## By role

- **CRO**: Can we show what our agents did when a counterparty disputes it? Yes for execution and settlement: the record is bound to the transaction, and the counterparty can verify it without trusting you. It does not show the decision was correct.
- **CISO**: How are agent spending and access controlled, and what if a key leaks? A separate agent wallet with its own budget, approval above a set limit, role-based access per twin, revocable API keys, key rotation and a secret header on paid endpoints.
- **CTO**: Do we need a blockchain, new infrastructure or a cloud dependency? No blockchain, shared ledger or gas. Deploy hosted, in a VPC, on-premises or air-gapped; verification runs locally and offline against the file itself.
- **Bank risk and payments**: How does value enter, settle and leave, and who holds the reserves? RBC holds the reserve funds backing USD inside Qatom and supports on-ramp and off-ramp transfers. USD-TDN settles between twins in under one second; payouts go by ACH.
- **Compliance and audit**: Can we hand a supervisor or auditor a record they can check? Yes. Export the .toda file and a twin's ledger and share them with the parties you choose; they can verify the file offline. Supervisors have not yet formally opined on these records.
- **AI governance**: Does this tell us whether the agent acted within policy? No. It proves what was executed, under which authorization, and that the history was not altered. Policy scope and decision quality need your own controls and review.

## Guides

- [Cryptographic Proof of Payment for AI Agents, Explained](https://www.qatom.ai/learn/cryptographic-proof-of-payment)
- [AI Agent Audit Trail: What Logs Miss and What to Prove](https://www.qatom.ai/learn/ai-agent-audit-trail)
- [Agentic Payments Risk Controls: A CISO Checklist](https://www.qatom.ai/learn/agentic-payments-risk-controls)
- [AI Governance Framework for AI Agents: NIST, ISO, EU AI Act](https://www.qatom.ai/learn/ai-governance-agentic-payments)
- [AI Agent Liability: Who Is Liable and What Evidence Counts](https://www.qatom.ai/learn/ai-agent-liability-evidence)
- [Agentic Payments for Banks: Settlement, Proof and Risk](https://www.qatom.ai/learn/agentic-payments-for-banks)

## Frequently asked questions

### What is cryptographic proof of payment in Qatom?

Each payment settles as a TODA file that carries its own Proof of Provenance, an unbroken chain of custody built from structures called rigs. The proof is part of the transaction, not a log written afterwards. Anyone holding the file can check it.

### How is this different from an audit log?

A log is usually written separately from the action and held by the organization that acted. TODAQ Press argues that "a record generated separately from an action, and stored separately from an action, can always be questioned." In Qatom, settlement and the verifiable record are the same operation.

### Can a regulator or auditor verify the record without trusting us?

Yes. Verification is local and can run offline, because the proof travels inside the file. A counterparty, auditor, regulator, insurer or court can check it without querying your systems or relying on an intermediary.

### Is it tamper-proof?

It is tamper-evident: the history cannot be altered or substituted without detection. A rig proves no conflicting version of the history was produced, and double-spend prevention is a theorem proved by structural induction in "Simple Rigs Hold Fast" (Coward and Toliver).

### What does the proof not cover?

It cannot prove an agent's decision was correct or within its intended policy scope, and it cannot prove the original data or judgment was accurate. It has no built-in system-wide view for macro-prudential monitoring. You still need policy controls, model validation and human review.

### Who sees our transaction data?

Privacy is the default. The trusted system can anchor a proof without seeing the underlying data, and you grant visibility by consent, for example giving a supervisor the full record while others see nothing.

### Does using Qatom make us compliant with the EU AI Act or OSFI E-23?

No tool makes an organization compliant. Qatom provides evidence that can help meet record-keeping, traceability and monitoring expectations, and regulators have not formally opined on these records. Confirm your obligations with your counsel.

### Is Qatom a blockchain?

No. TODA has no global consensus, no shared ledger and no gas. Each file carries its own proof, and Qatom can run hosted, in a VPC, on-premises or air-gapped.

## Research and specifications

- [Rigging Specifications (T.R.I.E.)](https://trie.site/rigging_specifications.pdf)
- [Simple Rigs Hold Fast (Coward and Toliver, arXiv:2208.13617)](https://arxiv.org/abs/2208.13617)
- [Abject Specification](https://trie.site/abject-specs-v1.pdf)
- [TODAQopen/toda: open-source JavaScript implementation](https://github.com/TODAQopen/toda)
- [Cambridge Centre for ReDecentralisation](https://www.cl.cam.ac.uk/research/srg/projects/crdc/)

## TODAQ Press essays

- [When The Transaction Becomes The Record](https://todaq.substack.com/p/when-the-transaction-becomes-the)
- [Settlement Without Proof](https://todaq.substack.com/p/settlement-without-proof)
- [You Cannot Audit a Probability: The Agentic AI Trust Wall](https://todaq.substack.com/p/you-cannot-audit-a-probability-the)
- [The Agentic Economy's Missing Middle](https://todaq.substack.com/p/the-agentic-economys-missing-middle)
- [The Invisible Shelf: How Headless Catalogs Are Rewiring AI Infrastructure](https://todaq.substack.com/p/the-invisible-shelf-how-headless)