A Signed Attestation Is Not Evidence

A lot of AI security tooling now ships a signature. A vendor signs the output of an AI decision, hands you a record, and calls it audit-ready. For a FinTech team preparing for a supervisor, this looks like the thing they need. Most of the time it is not.

Here is the distinction that matters. A signed attestation proves who produced an output and that it was not changed afterward. It says nothing about whether the action behind it was allowed before it ran. The signature sits on top of the result. It does not reach back to the decision.

What an attestation actually proves

An attestation is a statement a vendor stands behind. The vendor takes the output of an AI decision, signs it, and vouches for its integrity from that point forward. That is real and it is useful for one narrow thing: detecting whether the record was tampered with after signing.

What it does not tell you is more important. It does not tell you the agent was checked before it acted. An attestation signs the conclusion. It does not confirm anyone inspected the tool call, the destination, or the policy before the agent went ahead. If a prompt injection steered the agent toward an action it should never have taken, a vendor can still sign the result of that action cleanly. The signature is valid. The action was wrong. Both are true at once.

Why a log is not evidence either

Logs have the opposite problem. A log is a faithful diary of what happened. It records the action after the fact. What it cannot do is prove anything. A log does not show what was verified before the action, which policy applied, or whether an entry was edited later. Two systems can produce identical logs while one enforced a policy and the other enforced nothing. The log looks the same in both cases.

So the two common answers to "prove your AI behaved" each miss half the problem. The attestation proves integrity of a result but skips the check before the action. The log records the action but proves neither the check nor its own integrity. Neither one answers the auditor's real question, which is whether the agent was permitted to do what it did, and whether the record of that can be trusted.

Evidence is sealed at the moment of decision

Real evidence has to do two things a signature and a log each do alone. It has to capture the check that ran before the action, and it has to seal that record so tampering is detectable. Both, on the same record, at the same moment.

That timing is the whole point. If the record is assembled after the fact from logs, the verification is gone and you are back to a diary. If the check happens but is never sealed, you cannot prove it later. Evidence is the record created at the point of decision, tying the action to the policy and the checks that cleared it, then sealed so an outside party can confirm it was never altered. That is the difference between a claim you make about your system and proof another party can verify about it.

For FinTech this is not academic. Under DORA, live since January 2025, a financial entity has to answer for how ICT systems behaved, and an AI agent inside that chain inherits the same duty. A signature that vouches for an output will not carry that answer. A record that shows the action was checked, bound to policy, and sealed at decision time will.

Operanta was built around that record. Every AI request runs through a verification pipeline before it executes, and each decision leaves a signed Evidence Pack that captures the checks, the policy, and integrity proof, verifiable offline without depending on us.