diff --git a/packages/contracts-bedrock/scripts/DeployAuthSystem.s.sol b/packages/contracts-bedrock/scripts/DeployAuthSystem.s.sol
index 6f90eacc3481..9ff57b3ccb72 100644
--- a/packages/contracts-bedrock/scripts/DeployAuthSystem.s.sol
+++ b/packages/contracts-bedrock/scripts/DeployAuthSystem.s.sol
@@ -54,3 +54,34 @@ contract DeployAuthSystemInput is CommonBase {
         return _owners;
     }
 }
+
+contract DeployAuthSystemOutput is CommonBase {
+    Safe internal _safe;
+
+    // This method lets each field be set individually. The selector of an output's getter method
+    // is used to determine which field to set.
+    function set(bytes4 sel, address _address) public {
+        if (sel == this.safe.selector) _safe = Safe(payable(_address));
+        else revert("DeployAuthSystemOutput: unknown selector");
+    }
+
+    // Save the output to a TOML file.
+    // We fetch the output values using external calls to the getters to verify that all outputs are
+    // set correctly before writing them to the file.
+    function writeOutputFile(string memory _outfile) public {
+        string memory out = vm.serializeAddress("outfile", "safe", address(this.safe()));
+        vm.writeToml(out, _outfile);
+    }
+
+    // This function can be called to ensure all outputs are correct. Similar to `writeOutputFile`,
+    // it fetches the output values using external calls to the getter methods for safety.
+    function checkOutput() public view {
+        address[] memory addrs = Solarray.addresses(address(this.safe()));
+        DeployUtils.assertValidContractAddresses(addrs);
+    }
+
+    function safe() public view returns (Safe) {
+        DeployUtils.assertValidContractAddress(address(_safe));
+        return _safe;
+    }
+}
diff --git a/packages/contracts-bedrock/test/DeployAuthSystem.t.sol b/packages/contracts-bedrock/test/DeployAuthSystem.t.sol
index 06078c25a960..06dadb4f6437 100644
--- a/packages/contracts-bedrock/test/DeployAuthSystem.t.sol
+++ b/packages/contracts-bedrock/test/DeployAuthSystem.t.sol
@@ -48,3 +48,64 @@ contract DeployAuthSystemInput_Test is Test {
         dsi.owners();
     }
 }
+
+contract DeployAuthSystemOutput_Test is Test {
+    using stdToml for string;
+
+    DeployAuthSystemOutput daso;
+
+    function setUp() public {
+        daso = new DeployAuthSystemOutput();
+    }
+
+    function test_set_succeeds() public {
+        address safeAddr = makeAddr("safe");
+
+        // Ensure the address has code, since it's expected to be a contract
+        vm.etch(safeAddr, hex"01");
+
+        // Set the output data
+        daso.set(daso.safe.selector, safeAddr);
+
+        // Compare the test data to the getter method
+        assertEq(safeAddr, address(daso.safe()), "100");
+    }
+
+    function test_getter_whenNotSet_reverts() public {
+        vm.expectRevert("DeployUtils: zero address");
+        daso.safe();
+    }
+
+    function test_getter_whenAddrHasNoCode_reverts() public {
+        address emptyAddr = makeAddr("emptyAddr");
+        bytes memory expectedErr = bytes(string.concat("DeployUtils: no code at ", vm.toString(emptyAddr)));
+
+        daso.set(daso.safe.selector, emptyAddr);
+        vm.expectRevert(expectedErr);
+        daso.safe();
+    }
+
+    function test_writeOutputFile_succeeds() public {
+        string memory root = vm.projectRoot();
+
+        // Use the expected data from the test fixture.
+        string memory expOutPath = string.concat(root, "/test/fixtures/test-deploy-auth-system-out.toml");
+        string memory expOutToml = vm.readFile(expOutPath);
+
+        address expSafe = expOutToml.readAddress(".safe");
+
+        // Etch code at each address so the code checks pass when settings values.
+        vm.etch(expSafe, hex"01");
+
+        daso.set(daso.safe.selector, expSafe);
+
+        string memory actOutPath = string.concat(root, "/.testdata/test-deploy-auth-system-output.toml");
+        daso.writeOutputFile(actOutPath);
+        string memory actOutToml = vm.readFile(actOutPath);
+
+        // Clean up before asserting so that we don't leave any files behind.
+        vm.removeFile(actOutPath);
+
+        assertEq(expOutToml, actOutToml);
+    }
+}
diff --git a/packages/contracts-bedrock/test/fixtures/test-deploy-auth-system-out.toml b/packages/contracts-bedrock/test/fixtures/test-deploy-auth-system-out.toml
new file mode 100644
index 000000000000..35465cae1942
--- /dev/null
+++ b/packages/contracts-bedrock/test/fixtures/test-deploy-auth-system-out.toml
@@ -0,0 +1 @@
+safe = "0xDC93f9959c0F9c3849461B6468B4592a19567E09"