MIO° Conduct Record
MIO° Conduct Record is a sealed record, time-stamped by an outside authority, of the mandates an AI agent operates under and the agent identities a tenant has registered. Each record is Ed25519-signed at the moment it is sealed and carries a timestamp from an outside authority, so its existence at that time does not depend on trusting the platform that issued it.
- Key Takeaways:
- A mandate records what an agent is authorised to do, sealed before the agent acts under it.
- An agent-inventory entry records an agent's identity as a reference, never as raw personal data.
- Every record is verifiable offline, by anyone holding a copy, without an account or a live query against this platform.
- This is a storage-and-lookup record, not an enforcement mechanism — nothing here yet checks a mandate before an agent acts under it, and that is stated plainly, not implied otherwise.
- Runs on infrastructure in a jurisdiction you chose.
- Hosting and storage of the record use no US-owned cloud: the record is stored in France and New Zealand. The public drand beacon and TLS certificate issuance are interoperation with public services, and are named as such. The same sealing and timestamping infrastructure AVA and Village already run on.
- The key that signs a record is held on a separate host from the platform. Each change to an email agent's standing in the Email Decision Record agent register (registered, key rotated, revoked, suspended, reinstated, offboarded) is a signed record in that agent's own chain, available on request. A Conduct Record agent-inventory entry is a sealed point-in-time record of an agent's identity reference; it carries no standing and is not changed.
What is sealed, and what is not claimed
A mandate record carries the agent it applies to, the actions it permits, and — where one exists — the earlier mandate it supersedes. An agent-inventory entry carries an opaque reference to the agent's identity, never a name, email address or other raw personal data, and a fixed disclosure statement travels with every entry, quoted here exactly as it appears on the record: “This inventory identifies agent identities, not agents. An agent operating under a human credential is not visible to it.”
Two things are deliberately not claimed. First, whether a mandate was actually consulted before an agent acted under it — nothing in this system enforces that yet; a mandate answers "what was authorised," not "what was checked." Second, tamper-evident ordering — the sequence used to determine which mandate is currently in force depends on an ordinary, application-writable timestamp until a further, separate piece of key-custody work is complete, and any lookup result says so.
How verification works — no account, offline
A tenant retrieves its own mandate or agent-inventory records through its existing, authenticated API access and can hand the resulting bundle — record, signature, and the public key it was signed with — to anyone, with no account and no live connection to this platform required on their part. The recipient verifies the bundle entirely offline, using nothing but the bundle itself and a short, auditable verification script:
node verify-record.js record-bundle.json --expect-did did:web:example.tenant.domainThe script checks the Ed25519 signature against the public key published inside the bundle, and,
where the --expect-did flag is used, checks that every signature claims to belong to
the tenant DID the caller expects — pinning the claimed name, not the keys, which a caller should
also confirm against that DID's own published document.
Download the verifier script.
Who built it
MIO° Conduct Record is built by My Digital Sovereignty Ltd, the New Zealand company also responsible for the Village community platform and the AI Visibility Auditor. It shares its sealing and timestamping infrastructure with both.