Tamper-Proof Receipts Could Be the Key to Auditing AI Agent Actions

As AI agents gain the ability to perform high-stakes tasks like issuing refunds or calling production APIs, relying on editable logs is no longer a sufficient safeguard. A developer has built a demo system where an AI agent generates a cryptographically signed, tamper-evident receipt after each task, proving it followed pre-approved rules. The approach chains each action step using hashing so that any alteration — whether to the rules, a step, or the signature — causes verification to fail. The technique draws on a broader research concept called verifiable agent behavior, or zkML, which aims to let third parties audit an agent's conduct without re-running it or exposing private data. The demo, built in roughly 120 lines of standard cryptography code, is publicly available on GitHub and requires no API key to run.