Producing a document that looks like a certificate has become a commodity task. In the last three weeks, agents moved from assistants that answer to systems that act: SpaceXAI opened a Grok Bot enterprise offer on September 3, Meta launched its Muse personal agent in the United States on September 8, stating "It can open a browser, fill out forms, and negotiate on their behalf.", and on September 17 Alchemy announced that its AgentCard will carry Mastercard payment credentials so agents can complete purchases for their users.

An agent that can operate a computer, fill a form and send the finished PDF is an agent that can produce a convincing return-to-service record, training certificate or conformity statement. The question for the receiving team is no longer "does this document look right". It is "what was recorded at issuance, and by whom".

The asymmetric fact about generated documents

Writing a document and writing history are different operations. An agent can produce a flawless PDF: correct layout, plausible certificate numbers, a signature block in the right place. What it cannot do is change a fingerprint that was recorded before the file existed, inside a registry the agent does not control.

That asymmetry is the check that survives cheap document generation. NIST's Secure Hash Standard states that digests "are used to detect whether messages have been changed since the digests were generated." A fingerprint cannot tell you the original statements were true. It can tell you the data in your hands is, or is not, what an issuer recorded at a particular time.

Anchoring boundary Left column: the fingerprint proves the file is unchanged since issuance and which issuer identity recorded it. Right column: it cannot prove the work was done, the statements were true, or the signer had authority. The fingerprint settles This certificate data matches what was recorded, by this issuer identity, at this time Whether the anchor is still recorded, or has since been revoked It cannot settle Whether the maintenance, training or inspection actually happened Whether the recorded statements were true, or the issuer held authority
The boundary of a recorded fingerprint. Integrity and issuer identity on the left, event truth and authority on the right.

What AeroCert's verifier does today

Describing only what is live: when AeroCert issues a privacy proof, a SHA-256 fingerprint of the certificate data is recorded on the Avalanche network configured for the issuing organization's wallet, Fuji testnet during the launch phase, and the payload names that same network so a verifier reads the right registry, as described on how anchoring works. On that path the issued document carries a QR code whose /verify link carries the verification payload in its URL fragment.

The verification page recomputes the fingerprint in your browser and reads the registry on that network directly. It does not call an AeroCert backend to decide the outcome. The checks it performs are the ones in the live trust boundary: the hash is recorded, the issuer wallet matches the issuer named in the payload, that wallet and its organization are still active in the on-chain organization registry, and the entry has not been revoked. The registry is what turns a wallet address into an identity: the organization record on chain says which company that wallet belongs to and whether it is still active, which is the part a sender cannot write for itself. How verification works walks through the same model.

Two properties matter for the agent scenario. First, the check does not depend on the document's appearance or on who sent it. Second, it does not call an AeroCert backend: the fingerprint comparison runs against a public registry entry.

A fictional case: the tidy PDF from the vendor portal

Imagine a small maintenance organization that receives a return-to-service certificate through a vendor portal. The vendor's operations team now lets an agent assemble these documents from work-order data. The PDF is clean, the certificate number format is right, and the signature block shows the usual name.

The reviewer does not ask whether the document looks authentic. She asks two narrower questions. Was a fingerprint recorded for this exact certificate data by the issuer's identity? And does the recorded entry still stand, or was it revoked? The first takes seconds when an anchor exists. The second is a registry read, not a phone call to a busy front desk.

If no anchor exists for this issuer, the document is unanchored, not fake. The fallback is the same one that worked before agents: contact the issuer through a channel obtained independently of the document itself, and record which evidence was checked before relying on it.

What still needs a human question

Agent-filled forms add volume, not a new kind of doubt. A convincing PDF was always possible; now it is cheap. The recorded fingerprint answers integrity and issuer identity. It does not answer whether the work was done, whether the recorded statements were accurate, or whether the signer held the required authority on that date. Those questions still need the underlying records and, where the stakes justify it, a direct issuer confirmation.

That boundary is also where the checkride case cuts the other way: even a perfectly anchored certificate cannot prove the exam behind it occurred. Integrity protects the file. The event still needs its own evidence.

For the reading direction of the same problem, see what GPT-6 Astra document review cannot prove. For keeping verification usable when the issuer's systems are down, see the resilience guide.