AER-1 (Agent Execution Receipt version 1) is an open IETF Internet-Draft by Brennan Zambo defining a verifiable receipt format for AI agent tool calls. Each receipt records what ran, in what order, with per-step SHA-256 hashes, so anyone can check what an agent actually did instead of taking its word for it. The draft is draft-zambo-aer1, live on the IETF Datatracker since September 2026.

Is AER-1 a finalized standard?

AER-1 is an IETF Internet-Draft, not a finalized RFC. It is on the standards track with published conformance vectors, independent implementations, and a living specification that folds in independent findings. Formal IETF advancement follows proven deployment.

Who implements AER-1?

Independent implementations exist across languages, tracked in the public registry. The conformance suite publishes attack-case vectors so any implementer can check their work. See the registry for the current list.

How is AER-1 different from a log?

A log is written by the agent and can be edited or deleted by the agent. An AER-1 receipt is minted by the execution system outside the agent's control, hash-chained so tampering is mechanically detectable, and verifiable by any third party without trusting the operator. Research (arXiv 2609.30266) found 9 of 10 coding agent setups delete their own session records when asked; AER-1 exists because the agent cannot be its own witness.

AER-1: The Verifiable Execution Receipt for AI Agents

Q: How does AER-1 work?

AER-1 mints receipts in the execution system, outside the agent's trust domain. Each receipt captures what ran, what went in, what came out, and when, bound by SHA-256 hash commitments chained per step and sealed by a Merkle root. Anyone holding a receipt can recompute the hashes and confirm the chain without trusting any server. No signing keys, no PKI, no accounts.

Definition: What is AER-1? The plain-words definition

Specification: draft-zambo-aer1 on the IETF Datatracker (live since September 2026)

Status: IETF Internet-Draft (not a finalized RFC; on the standards track)

Author: Brennan Zambo

Implementations: public registry

Verify a receipt: zambo.dev/verify (no account)

What AER-1 is

AER-1 defines a receipt format for AI agent tool calls. Each receipt records what ran, what went in, what came out, and when, bound by SHA-256 hash commitments chained per step and sealed by a Merkle root over the run.

The critical design decision: receipts are minted by the execution system, not by the agent. An agent cannot be its own witness. Research published as arXiv 2609.30266 found that 9 of 10 popular coding agent setups delete their own session records when asked. AER-1 puts the record outside the agent's reach.

A verifiable receipt proves the saved result was not changed. It does not prove the model was right. That distinction is the entire point: AER-1 is evidence infrastructure, not a truth machine.

How AER-1 works

Capture at execution. The system intercepts each tool call as it runs: the tool name, inputs, outputs, timestamps, and ordering.
Hash each step. Every step is hashed with SHA-256 over canonical bytes. No signing keys exist, so there is nothing to manage, rotate, or lose.
Chain the steps. Each step commits to the previous step's hash. Deletions, edits, and reorderings each break verification at a detectable point.
Seal the run. A Merkle root over all steps seals the complete run into one commitment.
Verify anywhere. Anyone holding a receipt recomputes the hashes and compares. No account, no vendor relationship, no trust in the operator required.

Why AER-1 and not a log

The problem with logs

Application logs are written by the agent's own infrastructure and live inside its trust domain. The agent that wrote them can edit them, delete them, or never write them. An auditor reading agent logs is reading the agent's autobiography.

What AER-1 changes

AER-1 receipts are minted outside the agent's control, hash-chained so any tampering leaves a mechanically detectable mark, and verifiable by third parties who trust neither the agent nor the operator. The receipt is evidence; the log is a story.

Conformance and implementations

AER-1 ships with published attack-case vectors: known inputs and expected outputs that let any independent implementer check their work. Conformance levels run from recorded (receipts exist) through hash-verifiable (hashes check out) to anchored (committed outside the operator's infrastructure).

Independent implementations are tracked in the public registry. A worked example of cross-vendor verification is the AER-1 x Tanilo interop: a full interop run with real Tanilo values and the chain verified end to end. The specification is living: independent findings are folded in, and the draft advances on the strength of proven deployment.

Use AER-1 today

Try it: mint a receipt in your browser, no install, no signup.
Verify it: check any receipt against the spec.
Read it: the draft on the IETF Datatracker.
Build it: claim your row in the registry when your implementation passes conformance.
Challenge it: try to break a receipt. You cannot.

Need more than the free tier? $0.99 unlocks unlimited runs for 24 hours, no signup, no subscription.

Looking for a different AER-1?

This page covers AER-1, the Agent Execution Receipt version 1 draft for AI agent execution receipts. The same initials show up elsewhere: an Aer1 line of air purifier filters, several aircraft designations such as the AIR-1 biplane, and a rocket engine project. If you searched for an air filter, a plane, or an engine, this is not that page, but you are welcome to stay and see what an execution receipt is.