Hardware-rooted attestation for AI-agent evidence: composing IETF RATS with action evidence packages

Abstract. An action evidence package (AEP) is a signed, append-only record of what an AI agent did, who or what authorised the action, and what the outcome was. This note argues that software attestation of this kind is necessary but not sufficient, and composes AEPs with hardware evidence appraised under the IETF Remote Attestation Procedures (RATS) architecture (RFC 9334) using Veraison, an open-source RATS verifier. A feasibility experiment with an emulated TPM demonstrates the binding and a three-way platform verdict (Attested / Contested / Expired) end to end, including rejection of a forged outcome bound to a valid quote.