v0.1 — Public draft

Every other platform records
what you tell it.
VAL proves it — and proves nothing's missing.

Provably complete, independently verifiable evidence for your EU AI Act audit trail — the one thing a compliance PDF can't fake. Everyone records what you tell them; VAL proves it, and proves nothing was quietly dropped. A canonical schema, a deterministic policy language, and a signed receipt bound to the actual decision trace — so every action your agent takes can be verified, replayed, and independently checked offline, by a third party, without trusting the vendor.

See how it works Install the SDK
Apache 2.0 reference implementations CC-BY 4.0 specifications Royalty-free patent grants

The audit substrate AI agents have been missing.

Agentic systems are increasingly autonomous, increasingly transactional, and increasingly scrutinized. The EU's Digital Omnibus (Regulation 2026/1744, in force since 27 July 2026) moved the high-risk AI Act deadline for stand-alone Annex III systems from 2 August 2026 to 2 December 2027, with product-embedded systems following on 2 August 2028. That's not a reason to wait — it's runway to build your evidence trail properly. Enterprise buyers and procurement teams already demand provable, verifiable proof of how your AI decides, today, deadline or not. The question keeps coming back: how do I prove what the agent did, and why?

Today the answer is a tangle of vendor-specific logs, screenshot replays, and chat transcripts. None of it is normative. None of it is verifiable. Signing and timestamping the steps you choose to show is commodity — it can't prove a step wasn't quietly dropped. VAL is how you hand auditors, customers, and procurement provable, court-defensible proof now instead of a PDF you're asking them to trust.

VAL is a notary, not a scanner: it proves the completeness and integrity of the evidence a system emits — it does not claim to discover behavior a black box never reveals. It defines:

  • A canonical action manifest — the structured intent the agent is about to execute.
  • A declarative conduct policy — the rules the substrate or operator imposes on what the agent may do.
  • A signed receipt — a COSE_Sign1 envelope binding the manifest, the policy decision, and the substrate's key into a single tamper-evident record.

How VAL works, in one diagram.

            ┌───────────────────────────────┐
            │  Agent intends to act         │
            └───────────────┬───────────────┘
                            │
                            ▼
            ┌───────────────────────────────┐
            │  Action Manifest (VAL-AM)     │
            │  canonical JSON, JCS-hashed   │
            └───────────────┬───────────────┘
                            │
                            ▼
            ┌───────────────────────────────┐
            │  Conduct Policy (VAL-CPL)     │
            │  deterministic rule eval      │
            └───────────────┬───────────────┘
                            │
                            ▼
            ┌───────────────────────────────┐
            │  Receipt (VAL-RF)             │
            │  COSE_Sign1 + ledger link     │
            └───────────────┬───────────────┘
                            │
                            ▼
            ┌───────────────────────────────┐
            │  Verifier (any language)      │
            │  re-evals policy, checks sig  │
            └───────────────────────────────┘
1

Manifest

The agent serializes its intent as a VAL-AM manifest — substrate, agent ID, action verb, targets, value-at-risk, parent action, originating human. Canonicalized via JCS (RFC 8785). One hash, deterministic.

2

Evaluate

The substrate evaluates the manifest against a VAL-CPL policy. Every rule, every predicate, in a fixed order. The decision — ALLOW, ESCALATE, DENY, REFUSE, PAUSE — is a deterministic function of inputs.

3

Sign

The substrate emits a VAL-RF receipt: a COSE_Sign1 envelope (RFC 9052) carrying the manifest hash, the policy hash, the decision, and a link to the previous receipt. Signed with the substrate's key.

4

Verify

Anyone — auditor, regulator, downstream operator — can verify the receipt offline. The signature proves the substrate. The hash proves the manifest. The ledger proves continuity.

Five lines to get started.

from val_sdk import Substrate, Agent, Action, Target, ValueAtRisk, Context
from val_sdk import PolicySet, PolicyEvaluator, ReceiptEmitter, KeyStore, Ledger

operator = Substrate(id="acme.ai", model="acme-1")
policy   = PolicySet.from_file("policies/default.cpl")
keystore = KeyStore.generate_es256()
ledger   = Ledger(path="ledger.jsonl")

manifest = Action.build(
    substrate=operator,
    agent=Agent(id="agent-42"),
    action_verb="transfer.money",
    targets=[Target(uri="acct:42")],
    value_at_risk=ValueAtRisk(amount=5000.0, currency="USD"),
    context=Context(request_id="r-1"),
)

decision = PolicyEvaluator(policy).evaluate(manifest)
receipt  = ReceiptEmitter(keystore, ledger).emit(manifest, decision)
print(receipt.seq, decision.effect.name)
import { Substrate, Agent, ActionBuilder, Target, ValueAtRisk, Context }
  from "@openval/sdk";
import { PolicySet, PolicyEvaluator, ReceiptEmitter, KeyStore, Ledger }
  from "@openval/sdk";

const operator = new Substrate({ id: "acme.ai", model: "acme-1" });
const policy   = await PolicySet.fromFile("policies/default.cpl");
const keystore = KeyStore.generateES256();
const ledger   = new Ledger({ path: "ledger.jsonl" });

const manifest = ActionBuilder.build({
  substrate: operator,
  agent: { id: "agent-42" },
  actionVerb: "transfer.money",
  targets: [{ uri: "acct:42" }],
  valueAtRisk: { amount: 5000, currency: "USD" },
  context: { requestId: "r-1" },
});

const decision = new PolicyEvaluator(policy).evaluate(manifest);
const receipt  = new ReceiptEmitter(keystore, ledger).emit(manifest, decision);
console.log(receipt.seq, decision.effect);
curl -sX POST https://api.val.run/v1/evaluate \
  -H 'content-type: application/json' \
  -d '{
    "agent":   { "id": "agent-42" },
    "action_verb": "transfer.money",
    "targets":     [ { "uri": "acct:42" } ],
    "value_at_risk": { "amount": 5000.0, "currency": "USD" },
    "context": { "request_id": "r-1" }
  }'

# response:
# {
#   "seq": 1,
#   "decision": { "effect": "ESCALATE", "matched_rule": "money-escalate" },
#   "receipt": { "cose_sign1": "..." }
# }

Both SDKs share a binary-compatible receipt format. A receipt signed in Python is byte-for-byte verifiable in TypeScript. Tested in CI.

The specifications.

Three short, self-contained drafts. Together they define everything you need to ship a conforming implementation.

VAL-AM

Action Manifest

Canonical structure of an agent's intent-to-act. JCS-serialized. Hash-stable.

v0.1 — Draft
VAL-CPL

Conduct Policy Language

Declarative policy: when this manifest matches that condition, take this effect. Deterministic.

v0.1 — Draft
VAL-RF

Receipt Format

COSE_Sign1 envelope binding manifest, policy decision, signature, and ledger link.

v0.1 — Draft

Reference implementations.

Both SDKs at parity. Both Apache 2.0. Both cross-verified in CI.

Python

pip install val-sdk
  • Build manifests with type-safe dataclasses.
  • Load CPL policy from .cpl source or compiled JSON.
  • Emit and verify COSE_Sign1 receipts.
  • Append-only ledger with hash-chain proofs.
GitHub →

TypeScript

npm i @openval/sdk
  • Node 20+ and modern browsers (Web Crypto).
  • Same builder API shape as Python.
  • Binary-compatible CBOR (no Buffer / Uint8Array drift).
  • SPKI DER + PEM key parsing.
GitHub →

An open standard with no single owner.

The VAL specifications are stewarded by the OpenVAL Foundation, a neutral 501(c)(6) drafted with structural protections — Independent Director veto, royalty-free patent grants, doctrine lock — so the standard outlives any single vendor.

Royalty-free

Every Member grants a royalty-free, perpetual license under all patents necessarily infringed by an implementation.

Cross-vendor neutral

Substrate vendors (model providers) and operators are explicitly represented at parity. Neither side can capture the standard.

Conformance, not gatekeeping

Use the marks once your implementation passes the Conformance Test Suite. Membership is not required to ship.

Aligned with COSE, JCS, CBOR

Built on RFC 9052 (COSE), RFC 8785 (JCS), RFC 8949 (CBOR). Not a parallel universe — a profile of existing standards.

Three ways to engage.

01

Ship a verifier

Add VAL verification to your agent platform. Detect tampering, replay attacks, policy drift.

→
02

Join the Foundation

Implementer-class, Sustaining, or Academic. Bring your weight to the standard.

→
03

Design partner

Reference implementation support, conformance review, co-marketing on the launch. Limited slots.

→