Dapr 1.18 Brings Cryptographically Provable Execution to AI Agents

Audit logs can be altered. That’s the uncomfortable truth behind most AI agent observability stacks, and it’s the problem Dapr 1.18 is built to fix. Released on June 11, 2026, the new version introduces cryptographic signing, lineage propagation and attestation directly into the workflow runtime, so instead of trusting that your logs haven’t been touched, you can prove it.

What Dapr 1.18’s Verifiable Execution Actually Does

Three features form the core of this release. They build on each other, so it’s worth understanding each before jumping into implementation.

Workflow History Signing generates cryptographic signatures over workflow history records as execution progresses. Each signature is backed by a SPIFFE workload identity, the open standard for service-to-service identity, which ties every signed record to a specific, verifiable identity. If anyone modifies the history after the fact, the signature check fails. For an AI agent approving a financial transaction, this means the entire decision chain is signed and resistant to tampering, not just logged.

Workflow History Propagation carries that signed lineage across service boundaries. When a Dapr-enabled agent calls a downstream microservice, the calling workflow’s authenticated history travels with the request. Downstream services can inspect it. In a multi-agent pipeline where actions traverse several services before completing, this answers “how did you get here?” not just “who are you?”, which is the question traditional workload identity never addresses.

Workflow Attestation goes one step further: downstream services receive a cryptographically verifiable execution context they can run policy decisions against. A critical database update can be configured to proceed only if it receives valid attestation from an agent workflow that completed all required pre-checks. No valid attestation, no access. This is zero-trust applied to execution lineage, not just identity.

As one perspective in the industry holds: the first wave of AI focused on making models intelligent; the next wave will focus on making AI systems trustworthy.

Getting Dapr 1.18 Running

You need Dapr 1.18 installed before any of this is usable. For local development:

dapr uninstall --all
dapr init --runtime-version 1.18.0

For Kubernetes, Diagrid Conductor handles the upgrade:

diagrid-conductor upgrade --dapr-version 1.18.0

Confirm the installation with dapr --version and check the runtime shows 1.18.0 or later.

SPIFFE identity configuration is the next dependency. On Kubernetes, Dapr integrates automatically with cert-manager to provision SPIFFE identities. Make sure cert-manager is installed and configured in your cluster. Outside Kubernetes, you’ll need to manually configure mTLS and issue X.509 SVIDs (SPIFFE Verifiable Identity Documents) for your applications and Dapr sidecars. This is the plumbing that makes signing possible, worth getting right before moving on.

Your AI agent application talks to Dapr via its sidecar, so the integration point is straightforward. If you’re already using LangChainCrewAI or the OpenAI Agents SDK, Diagrid has added durable workflow integrations that layer verifiable execution onto those frameworks without requiring changes to your agent code.

Implementing Workflow History Signing

Signing is enabled through Dapr’s workflow component configuration. The component spec looks like this:

apiVersion: dapr.io/v1alpha1
kind: Component
metadata:
 name: my-workflow-engine
spec:
 type: workflow.dapr
 version: v1
 metadata:
 - name: enableVerifiableExecution
 value: "true"

The component spec for a Dapr workflow engine is configured like this:

apiVersion: dapr.io/v1alpha1
kind: Component
metadata:
name: my-workflow-engine
spec:
type: workflow.dapr
version: v1

Note: the specific metadata key to enable verifiable execution signing should be confirmed against the official Dapr 1.18 documentation before use. When signing is enabled, Dapr automatically signs each state transition and event in the workflow history using the workload’s SPIFFE identity.

With signing enabled, Dapr automatically signs each state transition and event in the workflow history using the workload’s SPIFFE identity. Here’s a basic workflow structure in Python that would have its history signed:

from dapr.ext.workflow import WorkflowRuntime, WorkflowContext
import time
def my_agent_workflow(ctx: WorkflowContext, input: str):
 print(f"Agent workflow started with input: {input}")
 result1 = ctx.call_activity("PerformAction1", input)
 print(f"Action 1 result: {result1}")
 time.sleep(1)
 result2 = ctx.call_activity("PerformAction2", result1)
 print(f"Action 2 result: {result2}")
 return f"Agent finished with: {result2}"
workflow_runtime = WorkflowRuntime()
workflow_runtime.register_workflow(my_agent_workflow)
workflow_runtime.register_activity(perform_action_1)
workflow_runtime.register_activity(perform_action_2)

Once the workflow completes, you retrieve the signed history via Dapr’s API and verify it externally. The verification process: retrieve the signed history, extract the cryptographic signatures and public keys derived from the SPIFFE identities, recompute the hash of each history segment and verify it against the signatures, then confirm the signing identities against a trusted root. An external auditor or compliance system can run this check independently, the workflow history either validates or it doesn’t.

Propagating Execution Lineage Across Services

Propagation requires no code changes in most cases. When a Dapr-enabled agent invokes another service using Dapr’s service invocation API, the sidecar automatically injects the workflow history context into the request headers. That lineage flows downstream without you having to wire it explicitly.

In a downstream service, you access the propagated context through Dapr’s APIs. What you do with it is up to you. Three common patterns: log the full lineage for compliance audit trails; gate conditional logic on the verified origin of the request; enforce access controls that depend on which workflow initiated the call. A service handling sensitive data might be configured to reject any request that cannot prove it originated from an authorised agent workflow, not just from an authorised service identity, but from a specific, approved execution path. That distinction matters for regulated workloads.

Enforcing Policy with Workflow Attestation

Attestation is where this becomes operationally powerful for security teams. Rather than propagating history passively, attestation lets services make hard policy decisions based on verified provenance.

The wire transfer example is instructive. A core banking service receiving a request from an AI agent can verify not just that the agent has the right identity, but that the request originated from a specific approved “wire transfer approval workflow” that completed all fraud checks and human approvals. If the attestation doesn’t match the expected provenance, the transaction is denied. No exceptions, no override path through which an unverified agent can sneak a request through.

Implementation involves three steps: define policies specifying which attestations are required for sensitive operations; use Dapr’s attestation verification APIs inside your service code to check incoming requests against those policies; handle missing or invalid attestations by rejecting the request or routing it for human review. This pairs well with the kind of excessive agency controls teams building web-connected agents are already thinking about.

Running Verifiable Agents on Diagrid Catalyst

Dapr 1.18 is open source, but Diagrid Catalyst Cloud provides a managed runtime that handles the operational side, durable execution, secure communication and AI orchestration in a production environment designed for long-lived agent workloads.

Deployment follows standard Kubernetes practices. If you’ve built locally against Dapr 1.18, you can move to Catalyst with the same runtime. Full feature support for Dapr 1.18 on Catalyst was expected later in June 2026 following the initial open-source release.

On the monitoring side, Catalyst surfaces the cryptographic proof layer through operational dashboards: visualising signed execution lineage across distributed services, providing tooling to retrieve and verify signed workflow histories, and integrating SPIFFE-based identities with mTLS enforcement so only agents with verified provenance can reach sensitive resources. For CISOs and compliance teams, the value is that audits stop being a question of trusting log integrity and become a matter of cryptographic verification.

The Bottom Line

Dapr 1.18 moves AI agent accountability from “we have logs” to “we have proof.” Workflow History Signing, History Propagation and Attestation together give teams a complete chain of cryptographic trust, from the first action an agent takes to the downstream services it touches. For anyone building agent systems in financial services, healthcare or any environment where audit integrity matters, this is the infrastructure layer that makes compliance defensible rather than assumed. For more on AI agents and automation tools, visit our AI Agents section.