Agent Evidence Levels (AEL): Grading AI-Agent Audit Evidence

An open standard that grades how much of an AI agent's activity record an outside party can verify, and how much omission they can detect, without trusting the vendor or the operator.

Ready to protect your own setup?

Most agent-security datasheets say “tamper-proof logs” and stop there. That phrase claims the strongest property that still requires trusting whoever holds the signing key. Agent Evidence Levels (AEL) exists to make that gap legible.

AEL grades a record of what an AI agent did by one question: how much of it can an outside party verify, and how much omission can they detect, without trusting the vendor or the operator. It is an open standard, and it ships with a runnable checker and a conformance corpus, so a grade is something you demonstrate, not something you assert.

The levels

  • AEL-0, authentic and ordered. Records are signed and hash-linked. Modification and interior deletion are detectable. Tail truncation and outright fabrication are not, because one keyholder produced everything.
  • AEL-1, gap and truncation evident. A signed open, heartbeats so silence is itself signed, and a signed close committing to a count. Now a missing tail or a silent gap within a run shows.
  • AEL-2, cross-domain omission evident. A second recorder under a different verified signing key. For declared covered event classes, an omission on one side that the other recorded becomes detectable.
  • AEL-3, externally anchored. Chain heads registered in a declared external append-only log under a different verified log key, so anchored history cannot be presented in conflicting versions without detection.
  • AEL-4, counterparty-confirmed. For declared confirmed flows, the destination attests what it received, including “nothing.” AEL confirms receipt, not harmlessness or meaning.

A grade is the minimum across the required dimensions, cumulative from AEL-0. There is a reproducibility suffix, R, for when the recorded decision can be re-derived from the recorded inputs.

What no level claims

No level proves completeness against the party holding the signing keys. A keyholder can construct a clean history, sign every part of it, and pass every internal check. Omission-evidence is bought only with additional signed evidence, one verified keyholder at a time, and organizational independence remains declared unless established outside AEL. Each level states plainly the limit it does not cover. That honesty is the point of the scale.

Two questions it teaches a buyer to ask

  1. What AEL does your evidence earn when the reference checker runs on an artifact you hand me?
  2. If a record were silently dropped, who outside your trust domain would detect it, and how?

Use it

AEL is authored by Pipelab and intended for donation to a neutral foundation. The specification, the reference checker, and the conformance corpus are public:

github.com/luckyPipewrench/agent-evidence-levels

Run the checker on your own evidence, or on a vendor’s, and read the grade for yourself.

Frequently asked questions

What is Agent Evidence Level (AEL)?
AEL is an open standard that grades a record of an AI agent’s activity from AEL-0 to AEL-4 by how much an independent party can verify, and how much omission they can detect, without trusting the vendor or the operator. It ships with a runnable reference checker and a conformance corpus, so a grade is earned by demonstration, not asserted in a datasheet.
What do the levels mean?
AEL-0: records are signed and ordered, so tampering and interior deletion are detectable. AEL-1: gaps, silence, and truncation within a run become evident. AEL-2: a second recorder under a different verified signing key makes omission of covered events detectable across recorders, unless the keyholders collude. AEL-3: chain heads are registered in a declared external append-only log under a different verified log key, so anchored history cannot be presented in conflicting versions without detection. AEL-4: for declared confirmed flows, the receiving party attests what it received. A grade is the minimum across the required dimensions, and ‘unable to verify’ is a first-class outcome distinct from ‘fails.’
Is AEL a Pipelab product?
No. AEL is a vendor-neutral standard Pipelab authored and intends to donate to a neutral foundation once the vocabulary has independent use. The specification carries no product marks. Pipelock is one mechanism that can be graded against AEL, the same as any other.
How do I verify a grade?
Run the reference checker on the evidence a vendor hands you. It reports each check as PASS, FAIL, or UNABLE-TO-VERIFY and prints the earned grade. The standard’s own conformance corpus is the proof: every level has a valid artifact that earns it and a perturbed artifact the checker must reject.

Ready to protect your own setup?