How to audit what your AI agent did after the session

An audit that only reads the agent's own logs is a claim checked by the party being checked. A real post-session audit turns every tool call into a verifiable receipt, one per execution, chained into a single tamper-evident session record. Here is the practical walkthrough: pull the tool calls, mint AER-1 receipts for each, verify them, and understand exactly what the audit proves. The receipt format is defined in IETF Internet-Draft draft-zambo-aer1.

See it working: run one free call and get a real verifiable receipt, no signup.

See it live: generate a real verifiable receipt in 30 seconds, no signup.

Why post-session audits are hard

Most agent platforms keep the session record inside the platform. That creates three problems for anyone auditing after the fact:

  1. The log is not evidence. A platform log is written by the party being audited, in a format only that party controls. It can be edited, trimmed, or exported selectively, and the auditor cannot tell.
  2. Exports are not anchored. Copying the log to a file does not prove the file matches what happened. There is no commitment binding the exported text to the execution.
  3. Model outputs are not records. The agent's chat transcript describes what it says it did. The tool calls are what it actually did, and those are the part usually missing from the transcript.

The fix is to bind each tool execution to a receipt at the moment it happens, then audit the receipts, not the platform's story about the session.

Step 1: pull the session's tool calls

For every tool call in the session, collect:

  • Tool name and arguments. What was called, with what inputs.
  • The result, as exact bytes. Capture the tool's returned output before any rendering, summarization, or reformatting. The exact byte sequence is what gets hashed, so this capture must happen at execution time, not reconstructed later from memory.
  • Timestamp and caller scope. When it ran and on whose behalf.

If your agent framework emits AER-1 receipts natively, this step is already done: every run produces a chained receipt per tool call automatically. If not, collect the calls now and mint the receipts in step 2.

Step 2: mint an AER-1 receipt per tool call

Each tool call becomes one receipt with the five interoperable fields from the AER-1 format:

  1. Identifier: unique per receipt.
  2. Creation time: when the receipt was minted.
  3. Tool and caller scope: which tool ran, for whom.
  4. Canonical bytes: the exact UTF-8 byte sequence of the observed result.
  5. SHA-256 output commitment: the hash of those bytes.

Then chain the receipts: link each receipt to the previous one, so the whole session is one hash-chained record. A single tampered or inserted call breaks the chain, which is what makes the session record tamper-evident rather than just a folder of files.

Step 3: verify the receipts

Verification needs no account and no trust in the agent:

  1. Take each receipt's canonical bytes.
  2. Compute SHA-256 over them.
  3. Compare with the receipt's output commitment. Match means the stored result is the result the tool returned. Mismatch means tampering.
  4. Walk the chain. Every link must reference the previous receipt correctly, or the session record was altered.

You can verify any AER-1 receipt right now at the public verifier: zambo.dev/verify. Paste a receipt, get a verdict. Because the format is an open IETF Internet-Draft, anyone can also write their own verifier in any language and check the same receipts independently.

Step 4: know what the audit proves

What a completed audit establishes

It proves the saved record was not changed. Every tool call that ran is bound to its result by a SHA-256 commitment, and the chain binds the calls together in order. If anything was edited, deleted, or inserted after the fact, verification fails.

It does not prove the answer was correct. A verifiable receipt proves the recorded result is the result the tool returned. It does not prove the model chose the right tool, fed it the right arguments, or that the outcome was good. Correctness, authorization, and policy compliance are separate layers that sit on top of the receipt format.

That boundary is exactly what makes the audit trustworthy: it checks something checkable, without asking you to trust anyone's judgment.

Close the deletion gap

One more audit rule: keep the receipts somewhere the agent cannot reach. If receipts live only in the agent's own storage, the agent (or anyone with its credentials) can delete the evidence along with the logs. Store the receipt chain in your own system or a public location, and the audit trail survives even if the agent's local history disappears. Read more on why agents deleting their own logs does not erase receipt-based audit trails.

Audit your next session in minutes

You do not need to rebuild your agent to try this. Mint a real verifiable receipt on the try page, verify it at zambo.dev/verify, and read the format that makes it possible: draft-zambo-aer1 on the IETF Datatracker.

Related

Browse the public registry of AER-1 implementations.

See it on a real call: the live demo runs one real Zambo call and hands you its verifiable receipt, no signup. To put a receipt under every call your agent makes, a Zambo Day Pass unlocks everything for 24 hours for $0.99.