1What proof of execution means
Proof of execution is evidence, captured when an AI agent runs, that lets a third party confirm what the agent actually did. Not what the agent claims it did. What it did.
This matters because an agent's chat transcript is self-reported. The same model that did the work writes the summary of the work. If it hallucinated a tool call, skipped a step, or fabricated an output, the "done" message looks exactly the same as a real completion. A transcript is a story. Proof of execution is a record.
2Why "done" is not proof
Agents in production regularly claim they called an API they never called, report success when a tool returned an error, summarize results that do not match the actual output, or skip steps in a multi-step workflow and present partial work as complete. None of this is visible in the transcript.
Tool call logs help with debugging but they are weak evidence. The log is written by the application, not captured by an independent layer. If the application has a bug, the log is wrong. If someone edits the log file, there is no way to tell. Logs are for debugging. Proof of execution is for verification.
3The four requirements of real proof
A genuine proof of execution has four properties. Miss one and the chain of trust has a gap.
One: capture at the tool boundary. The record must be created by the execution layer at the moment the tool runs, not reported by the agent after the fact. The agent is the least trustworthy witness to its own behavior.
Two: byte-exact hashing. The record must contain hashes of the exact input bytes and exact output bytes. Verification recomputes the hash and compares. Summaries do not count.
Three: hash chaining across the run. Each record includes the hash of the previous one, binding the run into one tamper-evident sequence. Without chaining, an embarrassing record can be deleted and the rest still verify.
Four: offline third-party verification. Anyone, anywhere, must be able to verify with no dependency on the originating system. No API calls, no accounts, no trust in the vendor. If verification needs the vendor's infrastructure to be alive, the evidence has an expiration date.
4The verifiable receipt: proof in practice
A verifiable receipt is a tamper-evident record of one AI tool call that meets all four requirements. It is captured at execution time by the execution layer, carries SHA-256 hashes of the exact inputs and outputs, chains to the previous receipt, and verifies by pure recomputation: hash the bytes, compare to the receipt, walk the chain.
Be precise about what this proves. A verifiable receipt proves the saved result was not changed since it was saved. That is the entire claim. It does not prove the answer was correct. It does not prove a real-world event happened. What it eliminates is the most common failure mode: the agent saying it did something it did not do, or reporting different inputs and outputs than what actually ran.
5The open standard: AER-1
AER-1 is the open IETF Internet-Draft that defines the verifiable execution receipt format: the receipt schema, the hash chaining rules, and the verification procedure. It is a draft, not a finalized standard. Open matters because machine verifiability only works when the verifier can be written by someone who does not trust you.
Read the draft: draft-zambo-aer1-23 on the IETF Datatracker. Implement it: one-prompt starter kits for Python, Go, Rust, and Node.
6Try it in under a minute
The fastest proof of execution you can hold in your hand: ask the Receipt Bot to do something. It returns the result plus receipt IDs. Take any receipt ID to zambo.dev/verify/ and check it yourself. No signup, no install.
For your own agents: zambo.dev mints AER-1 receipts for every tool call, free for up to 20 calls per metered tool per day, and works with any AI.
7Further reading
- Proof of Execution: The Protocol AI Agents Are Missing
- How to Check If Your AI Agent Actually Completed the Work
- The Execution Receipt Standard: What AER-1 Actually Specifies
- Receipt Driven Agents: The Architecture Pattern That Makes AI Work Checkable
- The Audit Trail AI Agents Need (and Do Not Have)
8Try it on your own agent work
Your AI said "done." For $0.99, prove it: get a Zambo Day Pass. Every agent run gets a verifiable receipt for 24 hours.