Your AI agent just finished a job. It called a search tool, hit two APIs, wrote a file, ran a script, and asked a second model to review the output. Six tools, three services, one finished job.
Now prove what happened.
If you are lucky, one or two of those calls came with something checkable. The rest is the agent's word for it. That gap is the whole problem: agents do real work across real systems, and most of that work leaves no evidence behind.
Whole-job receipts close the gap. Every tool call in a job, whether Zambo executed it, watched it pass through a gateway, or your agent is reporting it, gets sealed into one checkable timeline. One link. Anyone with the link can verify the chain.
Three kinds of entries, zero blur
The design starts from an honest distinction. There are exactly three kinds of entries in a job timeline, and they are never mixed:
Executed entries. Zambo ran the tool itself. Zambo observed the request and the response, so Zambo vouches for the inputs and the outputs. These carry verifiable receipts.
Observed entries. Zambo's gateway watched this call pass between your agent and a third-party tool. The external tool is named. Zambo vouches that it observed these exact bytes in transit. It did not execute the call.
Logged entries. Your agent or a hook reports that something happened outside Zambo. Zambo did not run it, did not watch it, and does not claim otherwise. What Zambo vouches for is narrower and exactly stated: the record was sealed with a server timestamp and has not been tampered with since it was logged.
That wall matters more than any other part of the design. A receipt system that blurs "we ran it" with "we watched it" with "someone told us it ran" is worse than no receipts at all, because it launders hearsay into evidence. Whole-job receipts keep the three claims in separate, clearly labeled lanes.
Three badges, plain language
Every entry in the timeline carries one of three provenance badges, written so a non-technical reader gets it:
- EXECUTED BY ZAMBO, Zambo ran this tool and observed the request and response.
- OBSERVED VIA GATEWAY, Zambo's proxy watched this call pass between your agent and a third-party tool. The external tool is named. Zambo observed the bytes in transit; it did not execute the call.
- LOGGED BY AGENT, An agent or hook submitted this record. Zambo attests the record is unchanged since logging, not that the reported action occurred.
The rule is mechanical, not editorial: an entry wears exactly the badge for what happened. A logged entry must never wear an executed or observed badge, an observed entry must never wear an executed badge, and an executed entry must never wear a logged one. Badge assignment is enforced in the receipt logic, not left to copywriters.
How verification actually works
Each entry in a session's journal links to the one before it with a hash, forming a chain back to a genesis entry. The receipt id is a hash over the entry's canonical bytes, including its provenance type, so a badge cannot be swapped after the fact without breaking the chain.
The session timeline page shows entries in chronological order with their badges, plus the chain's root hash and a validity indicator. Verification is recomputation: take the public entries, recompute the hashes, compare. No account needed, no special access. If a single byte changed after sealing, the chain says so.
Timestamps come from Zambo's server clock, not the reporting client. A client can claim anything about when something happened; the seal records when Zambo received it. Submissions are screened for key-like material, which is redacted before storage, so the journal stays safe to share.
What Zambo vouches for, exactly
This is worth stating with precision, because precision is the product:
- For executed calls: Zambo vouches for the inputs it sent and the outputs it received.
- For observed calls: Zambo vouches that it watched these exact bytes pass through the gateway, and names the external executor.
- For logged calls: Zambo vouches for when the record arrived and that it is byte-identical since arrival.
What Zambo never vouches for: the truth of an agent's report. If your agent logs that it called a tool and the tool never ran, the receipt proves the log entry is untampered, not that the call happened. The system is honest about the boundary between evidence and attestation, and that honesty is what makes the evidence trustworthy.
How entries get into the journal
Agents log non-Zambo actions through a dedicated logging tool: hashes of what happened, never raw payloads. Local hooks can auto-log tool calls a coding agent makes, with inputs hashed before they leave the machine. Gateway deployments observe third-party traffic in transit and log what they saw.
Journal writes are authenticated, and anonymous submissions are rejected. Journal writes are rate-limited to prevent abuse, so the journal cannot be used as an infinite write pipe.
Why this matters
Three reasons, in increasing order of importance.
Debugging. When a multi-step job goes wrong at step 14, the timeline shows exactly what ran, in order, with inputs and outputs for the executed calls. You stop guessing.
Accountability. When an agent acts on your behalf across systems you do not directly control, a sealed timeline is the difference between "the agent says it did it" and "here is the checkable record." Audits, incident reviews, and customer disputes all get simpler.
Trust in agents generally. The agent economy runs on delegation, and delegation without evidence does not scale. A standard where every job ends with a verifiable timeline is how agents graduate from impressive demos to infrastructure you can build a business on. That is what the AER-1 open draft is converging on: receipts as the unit of agent accountability.
One job, one timeline
One job, one timeline, every call accounted for, every claim labeled honestly. Executed where we ran it, observed where we watched it, logged where it was reported. Checkable by anyone with the link.
That is a whole-job receipt.
Zambo is the execution layer that gives AI agents real tools with a verifiable receipt for every call. Start free at zambo.dev. Read the open AER-1 receipt draft at zambo.dev/aer-1.
Top comments (0)