AIREP protocol logs AI governance decisions as signed, tamper-evident records
A paper introduces AIREP, a protocol for recording the governance decisions that automated AI runtimes make about individual outputs. When a runtime releases, blocks, defers, redacts, or escalates a given output, AIREP captures that decision as a single signed object that any party can check offline, independent of the runtime that produced it.
Each record states the decision as one of a closed set of verbs, tied to a stated policy basis. Rather than embedding the actual input, output, and supporting evidence, a record references them by hash, and it explicitly declares both what its evidence covers and what it does not cover.
Records are chained together using SHA-256 hashes that bind each record to its position in the sequence, so tampering with a record or removing one from the chain becomes detectable through recomputation.
To keep the format usable across vendors, models, and domains, the specification confines any vendor-, model-, or domain-specific content to a single optional namespace, and a mechanical neutrality test checks that the shared format stays free of such content.
The authors describe a reference implementation along with a conformance kit covering two programming languages, though the text does not name which two. They also discuss open implementation issues: aligning the canonical form of records across different implementations, providing freshness witnesses, and handling chains that span multiple runtimes.
The format is offered for adoption by any AI runtime that records governance decisions. The paper does not report that any real-world runtime has adopted it yet, and it gives no version number, benchmark, or evaluation result for the reference implementation.
Key facts
- AIREP records five closed-set decision types about individual AI outputs: release, block, defer, redact, and escalate.
- Each decision becomes a single signed record that references its input, output, and evidence by hash rather than by value, and states what the evidence covers and what it does not.
- Records form a SHA-256 hash chain binding each record to its position, so tampering or gaps become detectable by recomputation.
- Vendor-, model-, and domain-specific content is confined to a single optional namespace, checked by a mechanical neutrality test to keep the core format vendor-neutral.
- The authors provide a reference implementation and a two-language conformance kit, and flag open issues including canonical-form alignment across implementations, freshness witnesses, and multi-runtime chains.
Why it matters
Automated AI runtimes already decide, on their own, whether to release, block, defer, redact, or escalate individual outputs, but there has been no standard way to record those decisions so an outside party can check them later without trusting the runtime itself. AIREP proposes a shared, signed record format for exactly that gap, aimed at making automated governance decisions checkable offline and independent of the system that made them.
Who it affects
The protocol targets any AI runtime that makes automated governance decisions about its outputs, along with the parties who need to audit or verify those decisions afterward, such as operators or auditors checking a runtime's behavior offline. The paper does not name a specific vendor or runtime that has adopted AIREP; it offers the format for adoption.
How to use it
A runtime implementing AIREP records each governance decision, one of the closed set release, block, defer, redact, or escalate, as a single signed object that states the applicable policy basis and references the input, output, and supporting evidence by hash rather than embedding them directly. Vendor-, model-, or domain-specific details go into a single optional namespace, kept separate from the core format by a mechanical neutrality test. The authors provide a reference implementation and a conformance kit covering two languages, though the text does not name the languages or give a version number.
How solid is it
The paper describes a working reference implementation and a two-language conformance kit, and specifies a concrete integrity mechanism: a SHA-256 hash chain binding each record to its position, so tampering or missing records can be detected by recomputation. It also candidly lists unresolved implementation issues rather than presenting the protocol as finished. No benchmark or evaluation result is given, and no version number is stated in the text.
Risks and caveats
The authors themselves flag open problems: aligning how different implementations produce the canonical form of a record, providing freshness witnesses, and handling chains that span multiple runtimes. The paper offers the format for adoption but does not report that any real AI runtime has adopted it, and it gives no timeline for adoption.