AI Agent Receipts

What should a careful implementation include?

A reliable AI agent receipts process begins before the tool call. Define the question a reviewer will ask, identify the smallest event that can answer it, and decide which values are safe to publish. This prevents a broad transcript from being mistaken for a narrowly verified execution.

The request and the result should remain distinct. The request describes intent. The result describes what the execution layer observed. A receipt joins them through a stable execution identifier, but it should not rewrite the request into a success claim or silently fill missing fields.

Ordering matters when several tools run. Record start and completion timestamps, preserve the tool sequence, and make retries visible. A later successful call should not erase an earlier failure, and a proposed next step should not appear as though it already ran.

Arguments need a deliberate privacy policy. Some workflows can expose sanitized arguments, while others should publish only a commitment or a short description. The policy should be predictable enough that a reviewer knows what the public record includes and what it intentionally omits.

Canonicalization is the bridge between a human-readable result and a reproducible check. Serialize the selected bytes using one documented rule, calculate the digest over those bytes, and keep the verifier pointed at the same representation. A screenshot cannot substitute for this chain.

A verifier should make unavailable evidence obvious. If the upstream system did not provide a callback, settlement reference, delivery ID, or post-action read-back, return an empty evidence collection or an explicit unavailable state. Do not infer confirmation from a local HTTP success alone.

State changes require a higher bar than read-only answers. For a write, create, activation, or credential issue, record the initial executed state and perform a safe read-back. Only the read-back can move the public lifecycle to confirmed, and its hash should bind the observed state to the receipt.

Long-running jobs need phase language. Started means the job was accepted. Processing means work is still underway. Complete means the report was retrieved or a completion endpoint returned it. These labels should not be collapsed into one generic green status.

Portability is a practical test. Give the receipt URL to a reviewer who did not see the original chat. If they can identify the tool, time, result, integrity check, and evidence boundary, the receipt is doing useful work. If they need private context, the record needs a clearer handoff.

Retention and redaction are part of verification quality. Keep the public record stable long enough for a review, while removing secrets, private ownership values, raw tokens, and unnecessary personal data. A record that is easy to verify but unsafe to publish is not a finished design.

Failure reporting deserves the same precision as success reporting. A timeout, invalid input, provider outage, quota block, and denied authorization each explain a different next action. The receipt should preserve that distinction so a host AI can continue safely instead of repeating an unsafe request.

Reviewers should compare the receipt with the actual product contract. Check the live endpoint, current schema version, documented limits, and the tool definition. Static marketing copy can drift, while a machine-readable response and a fresh verifier check show what the system supports now.

Independent evidence should be labeled by source and capture time. A processor reference, callback, registry read-back, or settlement transaction can be useful, but each has a different meaning. Preserve the URI and reference without claiming that one kind of evidence proves another kind of outcome.

The cleanest reports state the boundary in the final sentence. Say that the execution was observed, that the stored bytes passed verification, or that the named upstream system confirmed a specific state. Then state what was not observed. Narrow claims survive scrutiny better than broad completion language.

Use a live example when teaching the workflow. The example should be safe to inspect, should remain available at the time of publication, and should be removed from the page if its verifier stops passing. Real examples make the procedure testable without inventing a benchmark or payment result.

For teams adopting this pattern, start with one read-only tool and one state-changing tool. Test both the happy path and a provider failure. Then add the receipt URL to the handoff format used by the host AI, dashboard, and post-session review. This sequence limits rollout risk while making the evidence model concrete.

A comparison is most useful when it names tradeoffs instead of declaring a universal winner. Ask what each method records, who can inspect it, how long it remains available, and whether it carries evidence from an upstream system. The answer may be different for a local developer workflow, a customer support handoff, and a regulated review.

The host AI should treat the receipt as a control signal for continuation. When a call is confirmed, it can safely summarize the observed result. When a call is executed but not confirmed, it should ask whether more polling or a human check is needed. When a call is blocked, it should not silently retry a consequential action.

A public verification URL also improves incident response. A team can attach the same URL to a support ticket, compare it with neighboring calls, and determine whether the issue was an input error, provider response, gateway failure, or missing evidence. This is faster than asking several people to reconstruct a chat from memory.

Version information matters for long-lived receipts. Preserve the receipt schema, tool version, and relevant scope so a later verifier can distinguish a current interpretation from a historical one. If a field changes meaning, publish the migration rule and keep the older record readable rather than rewriting history.

The strongest adoption plan is incremental and measurable. Begin with a small set of high-value calls, review false assumptions, measure verifier availability, and expand only after failure handling is clear. The goal is not to produce more records. The goal is to make the right executions easier to check and harder to misrepresent.

A reviewer should be able to explain the evidence in one short paragraph. Name the execution, state the verifier result, identify the hash or canonical bytes, and say whether a real upstream confirmation exists. If the explanation needs assumptions that are not visible in the record, mark them as assumptions rather than silently promoting them to facts.

The same discipline helps product teams write better copy. Say that a receipt is public, persistent, and checkable when those properties are true. Say that evidence is absent when it is absent. Avoid words such as guaranteed, completed, or delivered unless the relevant system returned a confirmation that is included in the record.

Testing should cover the public path, not only an internal function. Fetch the receipt URL, call the verifier without the original session, inspect the JSON shape, and exercise an unavailable or failed case. A green unit test cannot prove that a proxy, cache, static page, and API route all agree on the same receipt contract.

A durable receipt program connects engineering, support, and governance. Engineers define the fields and hashes. Support uses the URL to diagnose a call. Reviewers evaluate the evidence boundary. Governance decides retention and access. Keeping these roles explicit makes the system useful without turning one receipt into an unbounded claim.