The one-paragraph version
An AI agent receipt is one checkable record of one tool execution: what ran, when, on whose behalf, with what inputs and outputs, bound by a SHA-256 hash that anyone can recompute. A receipt is not a log entry, a screenshot, or the agent's own summary of its work. It is evidence produced at the moment of execution, in a format a stranger can verify without your help. The open format for these receipts is AER-1, published as an IETF Internet-Draft (draft-zambo-aer1-23).
Receipts matter because the default evidence for agent work is the agent describing its own work in its own words. That is a claim, not proof, and it collapses the moment a client, an auditor, or a regulator asks a hard question. A receipt replaces testimony with computation: recompute the hash, check the sequence, and you know whether the record is genuine. The questions below cover the rest.
AI agent receipt FAQ
What is an AI agent receipt?
One checkable record of one tool execution by an AI agent: which tool ran, which agent called it, when it executed, the exact inputs and observed outputs in canonical bytes, a SHA-256 commitment over those bytes, and the receipt's position in the run's sequence. It is captured at execution, and anyone can verify it by recomputing the commitment, with no account and no trust in the operator.
What is AER-1?
AER-1, the AI Agent Execution Receipt format, is the open IETF Internet-Draft for verifiable AI agent receipts, draft-zambo-aer1-23. It defines the receipt fields, the canonical encoding, and the verification rules, with an open conformance kit and a public registry of independent implementations. Anyone can implement it, in any language.
What does it cost to verify a receipt?
Nothing. Verification is a local computation: recompute the SHA-256 hash over the receipt's canonical bytes and compare it to the committed value. No API key, no subscription, no per-check fee. You can also check any receipt at zambo.dev/verify, free, no signup. Receipts are deliberately cheap to verify so that checking becomes the default, not a premium feature.
How do I add receipts to my AI agent?
The fastest path is a framework collector package. With smolagents, it is five lines:
pip install smolagents-aer1
from smolagents import CodeAgent, InferenceClientModel
from smolagents_aer1 import AER1Recorder
recorder = AER1Recorder()
agent = CodeAgent(
tools=[],
model=InferenceClientModel(),
step_callbacks=[recorder],
)
agent.run("What is 17 * 24?")
print(f"{len(recorder.receipts)} receipts recorded")
recorder.save("receipts.jsonl")Who can verify a receipt?
Anyone. A receipt carries everything an outsider needs to check it: the canonical bytes and the commitment. A client, an auditor, a regulator, or a stranger on the internet can all recompute the hash and confirm the record is genuine. This is the property that separates receipts from logs: a log needs your platform to read; a receipt needs only the bytes.
Can an AI agent receipt be faked or changed afterward?
Changing a receipt after capture breaks it. The SHA-256 commitment is bound to the exact canonical bytes, so altering one byte makes recomputation fail loudly instead of passing quietly. A missing receipt shows up as a gap in the run's sequence, which is itself checkable. The honest limit: verification proves the recorded actions happened as recorded and were not altered afterward. It does not prove the actions were wise or the model was right. Receipts prove what happened, not whether it should have happened.
How long should I keep AI agent receipts?
Match retention to the dispute horizon. If a client can dispute an invoice within 90 days, keep receipts at least that long. For regulated work, keep them as long as the audit window: financial and enterprise records are commonly retained for years. Receipts are small JSON records, so storage cost is negligible. The expensive choice is deleting the only evidence you had. (What auditors expect from the trail.)
Do I need a receipt for every single tool call?
Not necessarily. Receipts are cheapest when captured uniformly, but the honest rule is to receipt every consequential action: anything that touches data, money, credentials, external systems, or a decision the user relied on. Read-only exploratory calls with no side effects can be skipped. One caveat: a gap in the sequence must read as a deliberate gap, not indistinguishable from tampering, so state your receipting policy plainly: exactly what is receipted, and why.
Has cross-vendor verification been proven?
Yes. The AER-1 x Tanilo interop ran a full receipt chain with real values on an independent implementation, verified end to end and double-verified by both sides. That is the property the whole format is built for: the checker never needs the producer's platform.