The one principle
An agent's chat summary is a story. A receipt is evidence. Every tool call your agent makes should produce a small, portable record: what tool ran, what bytes came back, a SHA-256 commitment to those bytes, when it happened, and who ran it. If you have that, you do not need trust. If you don't, no amount of confident prose substitutes for it.
This is the whole game. Agents fail in fluent, confident ways: they narrate a plan as if they executed it, they report a tool's generic success status while nothing happened, they do real work in the wrong environment. None of that is detectable from the summary. All of it is detectable from an execution-time record the narrator did not write.
Know the honest limit up front
A receipt proves the saved result was not changed. It does not prove the model was right about the outside world, that it called the right tool, or that the strategy was sound. Anyone selling you "proof the AI was right" from receipts alone is selling something else. Execution proof is the foundation; judgment about quality sits on top of it.
The checklist
Run this on any agent output you need to rely on. Each step takes seconds once the habit is set.
- Demand a receipt for every tool call. If your agent platform does not give you a per-call receipt, that is the gap. The open format is AER-1 (draft-zambo-aer1-23, an IETF Internet-Draft): one receipt per execution, each with a stable ID and a public URL. A zambo receipt for every call lives at
zambo.dev/run/<id>, no account needed to check it. - Recompute the output commitment. Each receipt carries an output commitment, a
sha256:digest of the canonical result bytes. Recompute the SHA-256 yourself and compare. If they match, the result you are looking at is the result the system recorded. If they don't, something changed it. - Check the provenance class. The receipt records who ran or reported the action, and the class is included in the receipt's hashed payload, so verification confirms it was not changed. Confirm the provenance class matches what you expect: your agent, your system, not some unknown reporter.
- Check the timestamp. Receipts carry RFC 3339 timestamps. "It ran yesterday" should be checkable, not a claim. Confirm the time is sane and consistent with the rest of the record.
- Verify the anchor. Strong receipts are anchored to public relays with an envelope binding the receipt ID, the output hash, and the evidence hash. An anchored receipt can be checked by someone who never trusted the system that made it.
- For multi-step work, verify the chain. One receipt per step, hash-chained in order, the whole run sealed under a single Merkle root (a workflow receipt). Verify the root, then spot-check the steps you care about. A broken link in the chain is a finding, not a mystery.
What does not count as trust
Most of what passes for agent accountability today is the agent vouching for itself:
- A chat summary. "I checked 12 suppliers and the best price is X." The agent wrote it. It could be wrong, incomplete, or invented, and nothing in the message lets you tell.
- Screenshots or exported logs. Logs are written by the same system being audited. Editing a log after the fact is trivial, and there is no way to detect it.
- A completion badge. "Task completed successfully" is a status string, not evidence. It attests to nothing checkable.
- Confidence. A fluent, detailed, well-formatted answer feels trustworthy. Fluency is a property of the text, not of the work. The most dangerous outputs are the confident wrong ones, because nobody re-checks them.
The common thread: every one of these requires you to trust the party whose work you are trying to verify. Proof must survive distrust, or it is not proof.
What a receipt looks like
A verifiable execution receipt is a record captured at execution time for one unit of agent work, with four properties:
- Captured when it happened. The record is generated as the tool executes, not reconstructed later from a summary.
- Bound to the exact bytes. The receipt carries the canonical bytes of what the tool returned and a SHA-256 commitment over them. Anyone can recompute the hash and confirm the stored result was not changed.
- Checkable without the agent's help. A third party verifies it with public information only. No account, no API key, no asking the agent to confirm its own story.
- Edits break it. Any edit after the fact breaks verification. The record either checks out or it does not; there is no middle ground.
Try it live: zambo.dev/verify checks a receipt right now, no signup. The open format behind it is AER-1, an IETF Internet-Draft (draft-zambo-aer1-23): canonical bytes and an output commitment anyone can recompute.
If you buy or manage agent work
Make receipts a condition of payment, not a post-incident investigation tool. The contract language is simple: every unit of billed agent work ships with a verifiable receipt; payment clears when the receipts verify. Freelancers, agencies, and internal teams can all comply with the same open format, which means your check does not depend on any one vendor's dashboard.
The agents worth paying are the ones that can prove what they did. Ask for the proof before you pay, and the market sorts itself out.
Is your AI agent lying about being done?
Usually the honest answer is: it is not lying, it is summarizing. The agent reports its own narration of the work, and narration drifts: a planned step gets reported as an executed one, a generic success status gets reported while nothing changed, a step that failed quietly disappears from the story. You cannot fix that by asking harder or demanding confidence. You fix it by checking the two things the summary cannot fake: a verifiable receipt for each claimed action, and a fresh read of the state the action was supposed to change.
Two field guides go deeper: Did My Agent Lie? How to Check What Your AI Actually Did works the claim-by-claim check, and The Most Dangerous Line in Your Agent's Log Is the One That Isn't There covers the failure a summary hides best, the action that never made it into the record at all. Or skip the reading and watch the check happen: the live demo mints a real receipt in about 10 seconds, no signup.
My AI agent made up results. How can I tell?
Fabricated results have a tell: they exist only inside the agent's message. A number it never looked up, a confirmation it never received, a file it never opened, all written in the same confident prose as the real results sitting next to them. Reading the message harder will not separate them, because the prose is identical either way. You have to check something the prose cannot produce on its own.
The check is the per-call record. For each result the agent reports, there should be a verifiable receipt from the moment the tool ran, carrying the exact input bytes and the exact output bytes, bound by a hash commitment anyone can recompute. Recompute it. If the digest matches the output the receipt carries, that output is what the tool actually returned, word for word. If a claimed result has no receipt behind it, treat it as unwritten, not as true. Then read back the live state the result describes, the record, the balance, the sent folder, and compare the two. The full claim-by-claim procedure is in Did My Agent Lie? How to Check What Your AI Actually Did.
The limit, stated plainly: a receipt proves the saved result was not changed since it was saved. It does not prove the tool's answer was correct about the outside world. What it kills is the failure you are actually worried about, a result invented after the fact or quietly edited on its way to you. Watch the check happen live at the demo, no signup, and keep a full day of runs covered with a Day Pass.
Frequently asked questions
Can I trust AI agent output?
Not on the agent's word alone. Trust the receipt, not the summary. When every tool call carries a verifiable execution receipt and you check the commitments yourself, the question stops being about trust entirely: the output either verifies or it doesn't.
AI agent lying about done: how do I catch it?
Check the two things the summary cannot fake: a verifiable receipt for each claimed action (recompute its hash yourself) and a fresh readback of the state the action was supposed to change. A claim with neither is not done, whatever the agent says. See the check run live: the demo mints a real receipt in seconds, no signup.
Does a receipt prove my AI agent was right?
No. It proves the saved result was not changed after the fact. Correctness about the outside world, tool choice, and strategy are separate questions that still need human judgment. Receipts make that judgment possible by giving you ground truth to stand on.
What if my agent platform doesn't give me receipts?
Then you are flying on summaries, and the checklist above cannot run. The fix is an execution layer that mints receipts per call. AER-1 is the open format; zambo.dev/mcp is the fastest way to get one wired into your agent today: one paste of the endpoint, no key.
Is checking receipts slow?
The one-minute version is: open the receipt, find the digest, recompute, compare. Spot-check the claims that matter and verify the chain root for the rest. In practice this is faster than the argument you'd have with the agent about what it did.
How can I trust my AI agent's work
Trust the checkable parts; verify the rest. You can trust your AI agent's work to exactly the extent that the work left records you can check. For each result that matters, find its verifiable receipt, recompute the digest over the saved result, and read the saved result itself. The parts of the work that resolve to receipts earn trust mechanically. The parts that exist only as the agent's summary earn none yet, and the practical move is to shrink that second category: run the work where every call leaves a receipt, and make the receipt the deliverable alongside the result.
This is a calmer posture than either blind trust or blanket suspicion. Zambo is the verifiable work layer for AI precisely so this question has a mechanical answer: do not trust the agent more; make the work checkable, then check it.
Can I trust AI agent output
Not on its face, and you do not have to. AI agent output arrives polished whether it is right, wrong, or invented, and polish carries no information about which. The question worth asking is not whether to trust the output but whether the output is checkable: does it resolve to a verifiable receipt whose saved result matches what you were handed? If yes, you can trust that this output is the result that call produced at that time, and then judge its quality on the merits. If no receipt exists, the output is a claim, and treating it as more than a claim is the risk, not the agent.
Keep the scope of the check straight: a receipt proves the saved result was not changed since it was saved. It does not certify the result was correct. That second judgment is yours, and it is far easier to make against a record you have already confirmed is the real one.