Why call histories are not verifiable
Ask most agent platforms for the tool call history and you get a list: the agent called web search at 10:02, called the database at 10:03, called the code runner at 10:05. It looks complete. It is also, in most architectures, written by the same runtime that ran the agent, with no cryptographic binding between the entries and the calls.
That means three failure modes are invisible. Omitted calls: the agent called a tool and the entry never appeared. Invented calls: the entry says a tool ran, but nothing executed. Rewritten results: the entry shows success where the tool actually failed. A screenshot of a history proves even less: pixels of a claim.
From history to evidence
A history says what happened. A receipt proves it, in bytes anyone can recompute. Read the tool call history guide.
The anatomy of a verifiable tool call
- Tool identity and caller identity. Which tool ran, and which agent or sub-agent called it.
- Execution-time timestamp. When the call actually ran, recorded by the execution layer.
- Canonical input and output bytes. Not a summary: the bytes that went in and the bytes that came back.
- A commitment you can recompute. SHA-256 over the canonical bytes. Change anything and verification fails.
- Sequence position. Every call numbered, so a missing call is a visible gap.
- A public verification path. Anyone holding the receipt can check it: no account, no API key, no permission from the operator.
What a verifiable call proves, and what it does not
A verifiable AI agent tool call proves the saved result was not changed. It does not prove the model was right, the tool was the right one to call, or the outcome was desirable. Execution integrity and correctness are separate layers. Verify execution with the receipt, verify correctness the way you always have. The receipt is the foundation those layers build on.
Verified across vendors, not just one system
Receipts are only worth anything if verification crosses system boundaries. The independent AER-1 x Tanilo interop run checked an AER-1 receipt chain against real Tanilo values end to end on an independent implementation, a worked example of cross-vendor verification. Independent implementations are tracked in the public registry.
Tamper-evidence is the log-level version of the same property: every entry checkable, every change detectable. Read the tamper-evident AI agent logs guide.
Check one yourself
The live demo runs one real tool call and mints a real verifiable receipt, free, no signup. Recompute the commitment yourself. That is the entire verification procedure, and it takes under a minute.