Framework defines how to verify claims about AI agent actions
Auditable Claims about AI Agents
Artificial IntelligenceComputation and LanguageComputers and SocietyMultiagent Systems
Summary
Organizations often say things like 'every email is approved' or 'actions are logged' about their AI systems, but it's unclear what records prove these claims. The authors propose a way to make such claims 'auditable' by clearly stating the policy, scope, required records, and who creates them before checking. They add conditions like independent records and completeness to ensure trust. This method helps clarify what evidence is needed to confirm claims about AI behavior under rules like the EU AI Act.
What this means in practice
- •For compliance officers: Use the framework to establish clear evidence requirements for verifying AI system safety and behavior claims under regulatory standards.
- •For security auditors: Apply the claim-check table to systematically assess whether records adequately support specific claims about AI agent actions.
A position paper. It proposes an approach and reports no results.
Authors
Yue Zhao, Jiate Li, Li Li, Yi Nian, Jinbo Liu, Xiaolin Zhou, Xiyang Hu
Abstract
Organizations make claims about their AI agents: a person approves every external email, every action is logged, an evaluation shows the agent is safe to deploy. Article 12 of the EU AI Act requires high-risk systems to allow the automatic recording of events but does not say which records settle a given claim. The position is one sentence: to be checked, a claim about an agent must first name its policy, its scope, the records that would settle it, and who writes them. Adapting the preconditions of an assurance engagement, we call a claim auditable when these elements and a decision rule are fixed before any verdict and the records are obtainable. This extends the Policy Checkability dimension of our Auditable Agents framework from single actions to claims. Agents add three conditions: coverage by an independent record, authorization bound to each action's arguments, and completeness beyond integrity. Under an explicit model, we prove that support is impossible without each wherever its hypotheses hold. A claim-check table applies the method to six common claims, anchored in current NIST, IETF, and OWASP drafts. A worked case follows one claim through five evidence states. We close with a practice box and steps for operators, buyers, auditors, and standard setters.