How do you audit a multi-agent orchestration run?

Chain every delegation into one verifiable evidence trail: a receipt per tool call across every agent, each child receipt linked to the parent receipt that caused it. Walk the tree from the final answer to the leaves, recomputing each commitment. The chain answers which agent did what, where errors entered, what each branch cost, and whether any sub-run is missing.

Why is multi-agent auditing harder than single-agent auditing?

A single run is a line; an orchestration is a self-rewriting tree. Delegation is invisible in summaries, blame cannot be assigned to a branch, and cost cannot be attributed. Normal logs from each agent do not link together, so the auditor is left stitching a story from disconnected files.

What is a receipt chain?

A linked sequence of verifiable execution receipts where each child receipt references the parent receipt that caused it. In AER-1, the planner's delegation receipt points to researcher receipts, which point to tool receipts, forming one checkable tree from the final answer down to every leaf call.

How does a receipt chain show where an error entered?

Walk the chain backward from the bad output. Each receipt's commitment covers its exact inputs and outputs, so the first receipt whose outputs do not match its claimed result marks the branch that introduced the error. Tampering at any node breaks that node's commitment, flagging the exact location.

Can orchestration receipts track cost per branch?

Yes. When each receipt carries its cost, the total bill decomposes by branch, agent, and individual call. That turns the runaway-branch problem, one sub-agent burning the budget, from a mystery into a line item.

Auditing Multi-Agent Orchestration Runs: The Receipt Chain Method

Why orchestration breaks normal auditing

A single-agent run is a line: prompt in, tools called, answer out. A multi-agent orchestration is a tree that rewrites itself mid-run. The planner spawns three researchers; one researcher spawns a coder; the coder calls a shell tool seventeen times. By the end, dozens of agents touched the task and the only record is usually the planner's summary: done, here is the answer.

Three things go wrong. First, delegation is invisible: you see the final answer but not which sub-agent produced which part. Second, blame is unassignable: when the output is wrong, no record says which branch introduced the error. Third, cost is unattributable: the bill shows one run, not which branch burned the budget.

The receipt chain method

Give every call a receipt, and give every receipt a parent pointer. The method:

Receipt per call. Every tool call by every agent in the tree mints a verifiable receipt at execution time: tool, caller, timestamp, inputs, outputs, SHA-256 commitment.
Parent linkage. Each child receipt references the parent receipt that caused it. The planner's delegation receipt points to the researcher receipts; the researcher receipts point to the tool receipts.
Tree verification. Walk the tree from the final answer down to the leaves, recomputing commitments at every node. A broken commitment marks exactly the branch that was tampered with. A missing child shows up as a gap.

The result is one evidence chain for the whole orchestration. The auditor does not read logs from twelve agents and stitch a story together. The chain is the story, and the math checks it.

What the chain answers

Which agent did what. Every output traces to the exact sub-agent and tool call that produced it.
Where it went wrong. A bad output walks back up its receipt chain to the exact call that introduced it.
What it cost. Every receipt can carry its cost, so the bill decomposes by branch, agent, and call.
Whether anything is missing. Sequence gaps at any level flag deleted or dropped sub-runs.

Swarm-scale version

Orchestration trees get wide fast. The swarm receipts guide covers evidence chains when dozens of agents run in parallel. Read the swarm guide.

How AER-1 supports chaining

AER-1 is a verifiable execution receipt format, published as the IETF Internet-Draft draft-zambo-aer1. Each receipt records the tool, the calling agent, the execution timestamp, canonical inputs and outputs, and a SHA-256 commitment, with fields for linking a child receipt to its parent. Implementations mint the chain automatically as the orchestration runs; the auditor verifies it with the public conformance vectors.

Chaining across vendors is proven: the AER-1 x Tanilo interop ran a full receipt chain with real values, verified end to end and double-verified by both sides.

Try a chained receipt

The live demo mints real AER-1 receipts, free, no signup. Run a call, then imagine every call in your orchestration carrying the same proof, linked to its parent.

Mint a receipt and see the chain primitive.