DEILS

§Abstract

As AI agents move from advising to acting — signing transactions, moving value, making commitments on a person's behalf — society faces a false choice: log everything (surveillance) or log nothing (impunity). DEILS proposes a third path.

Interactions are private by default — no continuous surveillance: for an interaction covered by a pinned coverage policy, only a metadata-minimal commitment (a hash of the content plus its position in a monotonic sequence) is published, and its content is revealed only when triggered. When revealed, the content is a receipt: a record whose result anyone can independently re-derive from committed inputs under pinned public rules. The stack keeps four boundaries distinct — integrity ≠ protocol conformance ≠ legal finding ≠ settlement — so judgment stays with courts; the receipt is evidence, not the verdict. The primitives are not hypothetical: the receipt and conformance layers run today; full leg-2 interoperability is specified and queued, not yet running (§6).

§Scope — and what the chain already does

A settled on-chain action is already self-evidencing: the chain shows the transaction happened, and anyone can read it. DEILS adds nothing there, and shouldn't pretend to.

What the chain does not show is everything that produced that action — or happened instead of one:

• the off-chain behaviour — the instruction the agent acted on, its reasoning trace, the conversation, off-chain API calls, the model's inference inputs and outputs — which today leaves no tamper-evident trace at all;
• the binding between that off-chain intent and the on-chain action. The chain shows that 0.1 ETH moved to address X; never that X was the right recipient under the rules for what the user actually asked. "The transaction executed" and "the agent did what it was asked, correctly" are different claims — only the first is on-chain.

DEILS targets exactly that gap. The chain proves what settled; DEILS proves what the agent did to get there.

1The false choice

Accountability for automated systems today defaults to monitor everything, just in case: pervasive logging, retained indefinitely, privacy eroded on the off-chance of a future dispute. The alternative in practice is nothing — no durable, tamper-evident account of what an agent did, so no recourse when it errs, and no way for an honest operator to prove it did the right thing.

Neither serves a world where agents act with real consequences. Constant surveillance is a civil-liberties cost paid by everyone to catch the few; its absence is an accountability vacuum.

2The third path

Human law already resolves this for people. You are not filmed continuously; but when a dispute arises, evidence is produced and weighed. DEILS ports that model to human↔agent interaction:

• No continuous surveillance: the content of interactions is never recorded ambiently.
• On a covered interaction: for any interaction covered by a pinned coverage policy, a metadata-minimal commitment — a hash of the content plus its position in a monotonic sequence — is published. The interaction's existence goes on the record; its content does not.
• When triggered: the content is disclosed, checked against its commitment, and — if it binds — the receipt is reproducible: any party, trusting neither the human nor the agent, re-derives the claimed result from committed inputs under pinned rules and confirms it byte-for-byte.

3Three pillars

3.1  Standardized, auditable protocols

Interactions run over open, versioned protocols whose rules are public and whose conformance is machine-gradeable — so "the agent followed the rules" is a checkable statement, not a promise.

3.2  Privacy in the content, never in the existence

Persisting an interaction does not mean publishing its substance — but for a covered interaction it does mean publishing that it happened. A monotonic ledger alone only prevents deletion after a commitment is published; full non-suppression needs the prior step — a coverage event creating an obligation to issue:

A covered interaction with no commitment is a visible gap, not a silent absence. DEILS therefore claims non-suppression for covered interactions — not automatically for every conceivable one.

content_commitment is its own identity — not the receipt root. It binds the private content; the ReceiptOS receipt_root binds the canonical receipt envelope. They must not collapse. The rule is pinned exactly:

The commitment is a named-algorithm ref in the shared string form — literal sha256: + exactly 64 lowercase hex chars, matching Chronicle and the witness spec. A 0x prefix is non-conformant and an uppercased digest invalid: same bytes, different string, but comparing the two forms as refs is a silent mismatch — the exact failure the pinning prevents. And JCS is a named, exact profile (RFC 8785 / the receipts' receiptos-c14n-v0 variant) — because number formatting, Unicode, and escaping are where two honest implementations quietly diverge.

Metadata is minimized, not eliminated. Sequence activity can still reveal frequency or timing. Guardrails DEILS names: pseudonymous lanes, batching, delayed-publication windows, no party identifiers, and no exact timestamps unless required.

3.3  On-demand receipts, and a reveal that can say NO

When content held behind a published commitment is disclosed, the first check is whether it matches. A match binds the content (then conformance is recomputed — verified / rejected / unverifiable). A mismatch is a named, fail-closed state — content_commitment_mismatch — never a quiet "invalid." The public entry already committed to something, so a mismatch is itself evidence. The system detects and names it and preserves both artifacts; which failure it was — tampering, error, or misconduct — is a question for the court, not the check. No verdict is ever computed over content that isn't bound to its commitment.

4The accountability model — four layers

DEILS's credibility rests on keeping four things separate. The crypto establishes the first two; the law owns the last two.

Most "blockchain proves it" proposals fail by collapsing these — implying a cryptographic check is a legal conclusion. DEILS refuses that at every seam. A reproducible receipt is authenticated evidence, not a verdict. Reproducible ≠ conformant-in-law ≠ true-in-law ≠ liable.

5Who is accountable

DEILS does not propose legal personhood for AI. It makes an agent's actions legible so the responsible party — the operator, deployer, or principal who put the agent in the loop — can be held to account on evidence rather than assertion. Exoneration is a first-class outcome: an honest builder can prove their agent did exactly what it should, defeating a false claim with the same machinery that would have convicted a dishonest one.

6Reference implementation — exact status

Running today

• Verifiable agent identity — ERC-8004 / on-chain agent bindings; an action is attributable to a specific, source-bound agent.
• Reproducible receipts + conformance — a conformance gate emits portable evidence capsules whose roots recompute offline; a tri-state verdict grades an action against hash-pinned rules. The underlying receipt specification — the canonical envelope and its receipt_root — is ReceiptOS (DOI 10.5281/zenodo.21402444, crystal-receipt).
• A live showcase — recomputable in the viewer's own browser.

Leg-2 — specified & queued, not yet running

The reveal-check semantics are pinned; an independent second checker exists (built from the spec, blind). Full leg-2 interoperability is not running until all four land, in order: (1) the primary held-content extension; (2) the pinned neutral vector set; (3) the adapter; (4) the blind cross-implementation diff. That is an excellent status — and it is not the same as "done."

Honestly scoped: what runs today establishes record integrity and protocol conformance. What DEILS still owes is the legal groundwork — mapping receipts to jurisdictions' rules of evidence. The technology is ahead of the law; DEILS is the bridge.

7What DEILS is — and is not

• Not automatic court-admissibility; admissibility is jurisdiction-specific legal work.
• Not AI legal personhood.
• Not total logging; deliberately the opposite.
• It is a design pattern (coverage-policy + commit-reveal + reproducible receipts + conformance), a legal / civil-liberties framing, and a working reference stack that already embodies the running parts.

8Next steps

• Technical standards — pin the receipt, commitment-anchoring, coverage-policy, and conformance-profile formats as ERCs, implementable by anyone.
• Legal framework — this paper, taken to digital-rights organizations and legal scholars, with the privacy and no-omission claims stated precisely enough to survive scrutiny.
• A pilot — one real interaction producing a real receipt, used as evidence in a mock dispute, end to end.