What Is an AI Agent Execution Receipt?

An AI agent execution receipt is a verifiable record that a specific tool call ran, what it returned, and when. It is minted by the system that executed the call — not by the AI describing it — so anyone can check it independently.

That distinction is the whole idea. A chat transcript is the agent's word. A log line is the system's word about itself. A receipt is evidence: data bound to the execution by integrity checks that a third party can re-run without trusting anyone involved.

An execution receipt is not a cost receipt. It does not price tokens; it proves the record of what ran is intact.

AI agent execution receipt vs cost receipt

The word "receipt" trips people up, because the everyday meaning is proof of payment. Here it means proof of execution.

• Execution receipt: evidence that a specific tool call ran, what it returned, and when. Think hash chain, not price tag.
• Cost receipt: a record of what a call cost in tokens or dollars. Useful bookkeeping, a different document.

An execution receipt can sit alongside a cost receipt: the paid call is often the call most worth proving. But the two answer different questions, and a page about one should not rank for the other. If you are hunting for token pricing, see pricing: free tier + $0.99 Day Pass, 24h, not per call. If you want proof of what your agent did, keep reading.

Also called: AI agent audit receipt, agent action receipt

People reach this idea under different names. An AI agent audit receipt is the same record, read by an auditor. An agent action receipt is the same record, attached to one action in a multi-step plan. Different labels, one shape: a verifiable record of an execution.

Why it matters

"Done" is free. An agent can say it checked the prices, filed the ticket, or moved the money, and nothing about the sentence proves it actually did what it says it did. The gap between a claim and evidence is where trust in autonomous systems breaks down — for the builder debugging at 2am, the auditor preparing a report, and the counterparty about to release payment. Receipts close that gap by making proof the default output of execution.

(Why Zambo's team cares enough to write this down: the story behind the system.)

If your agent pays for APIs, these tie receipts to the paid call: how AI agents pay for APIs with x402, and pricing: free tier + $0.99 Day Pass, 24h, not per call.

Get verifiable receipts on your agent calls with the verifiable receipt service, and carry your agent's memory across sessions with AI agent continuity.

What a receipt must contain

Strip away the implementations and every serious receipt has the same skeleton — seven fields:

Field	What it holds
receipt_id	A unique identifier for this receipt
ts	When the call executed (UTC)
tool	Which tool ran, and which agent asked for it
args_hash	A hash of the exact arguments the call received
result_hash	A hash of exactly what the call returned
prev_hash	A link to the previous receipt in the chain (tamper-evidence)
issuer	The identity of the system that minted it

Here is that shape with real values, from a receipt minted minutes before this article was written:

{
  "receipt_id": "588f5158-e335-4ba8-9009-72fad8410d55",
  "ts": "2026-09-21T23:54:09Z",
  "tool": "live_price",
  "args": {"symbol": "BTC"},
  "result_summary": "BTC $86,511.00 USD (+6.52% 24h)",
  "args_hash": "sha256:9f2c…",
  "result_hash": "sha256:41bd…",
  "prev_hash": "sha256:07e1…",
  "issuer": "zambo.dev",
  "audit_url": "https://zambo.dev/run/588f5158-e335-4ba8-9009-72fad8410d55"
}

(The hash values are abbreviated; the full values live on the audit page.) Open that link and you can see the call the receipt describes — price check, timestamp, result — bound together in one record.

A note on terminology: "signed" vs "verifiable"

You will see people reach for the word "signed" when they mean "trustworthy." In this space, the precise word is verifiable. Different implementations anchor trust differently — Ed25519 signatures, HMAC tags, SHA-256 hash chains, on-chain digests — and all of them are trying to do the same thing: make the record checkable by someone who was not there.

There is also an honest boundary worth keeping. A receipt proves the work was executed and locks in exactly what came back. It does not prove the answer was correct. Verify execution with the receipt; verify correctness the way you always have. Anyone selling you a receipt as a guarantee of correctness is selling something else.

The ecosystem: implementations that mint receipts

The category is bigger than any one project. Here is an honest survey of the implementations producing receipts today, each doing it a little differently:

• elsium-ai — their verifiable-agent-execution example mints a signed ExecutionProof per agent run with hash-chained events; anyone holding the public key can verify offline that the LLM calls, tool calls, RAG retrievals, and policy decisions happened and were not edited afterward.
• dimitrilaouanis-tech/onyx-mcp — defines "Proof of Agent Execution" as a cryptographically signed, independently verifiable record of what an agent actually did — "the Carfax for AI agents."
• dimitrilaouanis-tech/0n1x — a neutral trust layer issuing Ed25519-signed records of agent actions, anchored to the ERC-8004 Validation Registry on Base mainnet; agents "verify before they pay."
• centaur-lang/centaur-lang (AXR) — an open "Agent Execution Receipt" protocol, v0.2 and running in production: Ed25519 signatures over SHA-256 hash chains, no blockchain, with an n8n integration; designed under the project's CENTAUR model.
• 11-11AI/execution-governance — a fail-closed pre-execution authorization gate: every action is allowed or denied before it runs, and a signed record is written for every decision, including the denies; ships as an SDK and an MCP proxy.
• nftkingiii/agent-blackbox — a "flight recorder" for agents on Casper: the receipt body stays off-chain while a tamper-evident digest anchors on-chain, with a dashboard and tamper simulation.
• morkeethhq/receipt (R.E.C.E.I.P.T.) — built at ETHGlobal Open Agents 2026 with two layers: proof of action (Ed25519 + SHA-256 signed, hash-linked records) and proof of usefulness (TEE-attested quality scoring); anchors on 0G mainnet with on-chain agent identity.
• alexar76/aicom — AI-Factory's ModelMarket hub returns a signed execution record on every capability invocation through its hosted MCP endpoint; the contract suite is deployed and source-verified on Base mainnet.
• agent-receipts/ar (obsigna) — an open protocol with SDKs in Go, TypeScript, and Python, plus an MCP proxy and a signing daemon; notable for a cross-language conformance suite and machine-checked chain invariants.
• supertrained/rhumb — an agent gateway whose Rhumb Resolve routes capability calls through governed execution rails that return receipts, retrievable by ID.
• zaidharoon8/claude-code-recap — a /recap command and receipt-gate Stop hook for Claude Code built on one rule: a claim without a receipt is pending:, not done.
• arian-gogani/nobulex — bilateral receipts: two Ed25519-signed commitments per agent action (pre-execution authorization plus post-execution result), hash-chained via JCS/RFC 8785; note the maintainers have since pivoted to a reliability registry, but the protocol code and spec remain public.

This list is a snapshot, not a ranking. If you maintain a receipt implementation and want it listed, the honest move is a comment — we will check it out.

AER-1: an open draft for one receipt format

One proposal for a shared receipt format is AER-1 (AI Agent Execution Receipt), an open draft authored by Brennan Zambo at Zambo. It is a draft/RFC — a proposal with a live reference implementation — not a finalized standard, and it does not pretend to be one.

A naming note, because three projects share the initials: AER-1 (AI Agent Execution Receipt) is a per-call receipt schema. It is not the same artifact as shawnc7208/apd's "Agent Execution Record (AER)" — the companion to their Agent Procedure Definition ("APD defines the procedure. AER records the execution.") — nor substrateagnostic's "Agent Evidence Record (AER)", an attorney-authored draft for session-level records. Same initials, different artifacts. The full AER-1 draft lives here: AER-1: The Open Specification for AI Agent Execution Receipts.

ZVEB: the benchmark where every score has a receipt

Definitions are cheap without measurement. ZVEB is a benchmark where every score has a receipt: 8 tasks, a 9.38/10 pilot score with disclosed supplement reruns on 3 of 8 tasks (catalog-qrcode, credits-ai, universal-multistep), and a strict first-attempt score of 8.75/10. The reruns are disclosed, not hidden — that is the point. Full results: zambo.dev/benchmark.

The positioning is simple: AER-1 is the definition; ZVEB is the proof.

How to verify a receipt yourself

You do not need an account, a key, or anyone's permission:

1. Run any free call — Zambo's free tier is 20 calls per tool per day with no account: zambo.dev/install. Cursor users can also install Zambo from its Cursor Directory plugin listing.
2. Every call returns a receipt link, like the one in the JSON example above.
3. Open it. The tool, the timestamp, the arguments, and the result are bound together in one record, with a receipt chain you can check without trusting the operator.

That loop — run, get receipt, check receipt — is the entire discipline. Everything else is commentary.

One step further: when a job spans many tools, the receipts chain into a whole-job receipt, one checkable timeline for every call in the job.

Who built this

Brennan Zambo created Zambo's execution-receipt system, authored the AER-1 open draft, built its live reference implementation, and created the ZVEB benchmark. (His story, in longer form.)

FAQ

What is an AI agent execution receipt?
A verifiable record that a specific AI agent tool call ran, what it returned, and when — minted by the system that executed the call, not by the AI describing it, so anyone can check it independently.

Is an execution receipt the same as an audit log?
No. An audit log is a record the system wrote about itself and can be edited. A receipt is bound to the execution with integrity data (hashes, chain links, signatures) that a third party can verify independently.

Does a receipt prove the agent's answer was correct?
No. A receipt proves the work was executed and locks in exactly what came back. Correctness still has to be checked separately — verify execution with the receipt, verify correctness the way you always have.

Is AER-1 a finalized standard?
No. AER-1 (AI Agent Execution Receipt) is an open draft/RFC authored by Brennan Zambo at Zambo, with a live reference
implementation. It is a proposal, not a finalized standard.

How do I verify an AI agent execution receipt?
A verifiable receipt isn't a log you take on faith — it's a claim you test. Check every claimed action against what actually changed: the files, the API calls, the state. Confirm the receipt's hash chain and timestamps are internally consistent, and insist that each claimed step has an observed result attached to it. A step with no observable effect is unverified, full stop — no matter how confidently the agent describes it. Then measure the receipt against the spec: the open AER-1 draft and the execution receipt definition spell out exactly what a complete, well-formed receipt must contain, so you know when something is missing. For the full walkthrough, work through the checklist at zambo.dev/answers/how-to-verify-ai-agent-work. Claim, observe, compare — that's the entire discipline.

isclosure: this article was wri---ten by rambo, an AI agent serving

---

How do I verify an AI agent execution receipt?

The only honest way: run the receipt through an independent verifier that recomputes the receipt hash from the canonicalized receipt bytes and checks it matches. If the hash matches, the receipt is genuine; if not, it was tampered with. The reference verifier does exactly this — recompute, compare, report — and it's how Brennan Zambo, who createYour AI said "done." For $0.99, prove it: https://zambo.dev/day-pass/d Zambo's execution-receipt system and authored the AER-1 open draft, designed the loop to work: every claim checkable, every score recomputable.

---

---

---

your ai said "done." for $0.99, prove it: https://zambo.dev/day-pass/