AI Agent Receipts vs recorded Attestations

Comparison matrix

Frequently asked questions

Who authored the AER-1 draft?

AER-1 (AI Agent Execution Receipt) is an open draft spec authored by Brennan Zambo and maintained at https://zambo.dev/aer-1.

AI agent receipts vs recorded attestations

recorded attestations can bind a statement to a signer. A receipt adds execution context, observed output, and a review path. The two formats can complement each other, but neither proves an outside result that was never observed.

What can a verifiable receipt prove?

It can show what the execution layer recorded and what its integrity checks verify. It cannot prove an unobserved outside outcome.

How can another reviewer check the record?

Open the public receipt, compare the tool, time, result, and status, then call the verifier. Keep outside confirmations separate from the execution record.

Receipts and attestations in practice

A receipt preserves an execution record while an attestation makes a claim about an authority or environment. The useful unit is not a confident sentence from an assistant. It is a bounded claim that names what happened, when it happened, and which evidence another person can retrieve. That framing makes the page useful to an operator who is reviewing a real run rather than reading a product slogan.

Build the evidence boundary first

Write down the question before collecting records. Is the question whether a call was attempted, whether a service accepted it, whether bytes were returned, or whether an outside system now shows the desired state? Those are different questions. A receipt should answer the execution question it was designed to answer, while a source system, approval record, or human check answers the questions beyond that boundary.

Keep the record narrow enough to share safely. A stable identifier, timestamp, tool name and scope, provenance class, exact committed bytes, output hash, and verification status are often more useful than a complete prompt transcript. When private inputs matter, retain a reference or commitment and keep the underlying material under the access rules of the system that owns it.

Use a repeatable review loop

1. State the expected action and the acceptance condition in plain language.
2. Locate the receipt created by the execution layer and match its identity, time, tool, scope, and status.
3. Check the exact bytes or output commitment using the published verification procedure.
4. Read back the important result from the system that owns the state, without treating a receipt as that read-back.
5. Record supported, pending, contradicted, and unobserved claims separately.

Inspect issuer, scope, bytes, verification method, and the outside evidence separately. This makes a short review reproducible: a second reviewer can see which artifact supported each conclusion and which uncertainty remains open. It also gives an agent a safe stopping rule. If a required record is missing, the agent should report that boundary instead of filling it with an invented success.

Failure handling and retention

Preserve failed calls, retries, rejected permissions, timeouts, and partial writes. They explain why a later state differs from the requested state and prevent a clean-looking final summary from erasing the path that led there. Attach the capture time and source URL to any external read-back, because a changing system can make yesterday's confirmation impossible to reproduce.

A signature does not make an unobserved outcome true, and a receipt does not establish every identity claim. For high-impact work, add a human approval or a second-system confirmation before sending a message, changing durable data, spending funds, or publishing a result. For low-risk reads, a receipt plus a spot check may be enough. The standard should follow the cost of being wrong, not the agent's confidence.

Finally, describe the result with precise language. Say that a call was recorded, that bytes matched, or that a source system displayed a state at a given time. Do not silently upgrade those observations into a claim that a model was correct, a transaction settled, a customer received a message, or a legal requirement was satisfied. Honest limits are part of a useful verification record.

For a live demonstration, make one low-risk tool call through the Zambo demo, then inspect its receipt through the verification page. Keep the example separate from private production data, and use the same evidence vocabulary when you document the workflow.

What a good review record contains

A useful review note is short but specific. Record the question being answered, the receipt identifier, the capture time, the verifier result, the system queried for confirmation, and the reviewer decision. If the evidence is incomplete, name the missing artifact instead of adding a confidence score that has no defined source. This format lets a later reviewer repeat the check without reading an entire conversation.

For example, a reviewer might write that a tool call was recorded with the expected scope, that its committed bytes matched the receipt hash, and that the destination system did not yet show the requested change at the time of read-back. That is a useful finding. It is more precise than saying the agent failed, because the available evidence distinguishes execution from the external outcome.

When this method is not enough

Receipts are one layer in a control process. They do not replace access control, approval policy, backups, monitoring, incident response, or domain review. They also cannot recover data that was never observed or prove that a third-party response was truthful. If the workflow involves regulated records, money, safety, or an irreversible publication, add the controls required by the organization that owns that risk.

The best implementation makes uncertainty visible at the same place it reports success. Keep pending and rejected states queryable, make corrections append-only when possible, and preserve the original bytes used for verification. That discipline gives operators a durable explanation for what happened without asking them to trust a generated narrative.

Before closing the review, ask whether another person could reach the same conclusion from the retained evidence. If not, identify the missing link, assign its owner, and leave the result pending. A transparent incomplete record is safer and more useful than a complete-looking record that quietly joins assumptions to facts.