Who is actually acting?
Your assistant booked the flight, emailed the landlord and paid the bill. It's a small miracle. It's also a question we haven't really answered yet. Afterwards, could you tell exactly what it did?
Until recently, if someone acted on your behalf, it was another person. A travel agent, a bookkeeper, a clinic receptionist, or a neighbour doing you a favour. When a booking went wrong or a bill looked strange, you could ask them what happened. They would check their notes, remember the phone call, and give you a straight answer.
Software is now stepping into that role. AI assistants read our email, fill in forms, compare prices and, increasingly, act: they send, buy, book, reschedule, and negotiate. And they are getting better at it quickly. One careful measurement found that the length of task AI agents can complete on their own has been doubling roughly every seven months.1
That shift is genuinely exciting. Imagine never again losing an afternoon on hold with a utility company, or spending your Sunday evening untangling a reimbursement form. Yet it raises a simple, practical question: when an assistant acts in your name, how do you know what it actually did?
An unmarked van on your porch
Most software today wasn't built to answer that question. When an AI assistant clicks through a website, it usually looks either like you typing at superhuman speed or like an anonymous script knocking from an unknown address.
Picture coming home to find a heavy wooden crate sitting on your front porch, blocking the door, while an unmarked white van with no licence plates speeds away down the street. There is no delivery slip taped to the lid. You don't know which company sent the van, who authorised the drop-off, whether your card was charged, or who to call to haul the crate back.
That is what an unsigned agent action looks like on the internet today. When an automated assistant makes a request without a clear identity or a bounded permission slip, everyone is left guessing. The service on the receiving end cannot tell whether your assistant had your blessing to change a contract or simply guessed wrong. And you have no independent receipt showing what was promised on your behalf.
Three small questions: the letter, the valet key, and the receipt
We think every action an agent takes should travel inside a signed action envelope that answers three small questions.
1. Who is it acting for? (The notarized letter.) Never just "an AI". A real person, household, clinic, or organisation must stand behind the software. Think of it like a notarized power-of-attorney letter for a single errand: it names the person represented and carries a signature nobody can forge.
2. What is it allowed to do? (The hotel valet key.) When you hand a valet your car at a hotel, you don't hand over the master key to your house. You hand over a valet key that parks the car for twenty minutes, cannot open the trunk, and stops working afterwards.
A task lease works the same way, travelling with the action and expiring automatically. We explore why scoped keys beat master passwords in AI agents should hold permissions that expire.
3. What did it actually do? (The itemized receipt.) Every step leaves a plain, dated record listing what was requested, what was agreed, and which rule allowed it. That itemized receipt is signed by both sides and stored where neither the software nor its maker can alter it afterwards.
None of this is exotic. We already expect these safeguards in everyday life. A licence plate shows who stands behind a vehicle, a valet key limits how far it can be driven, and an itemized receipt shows what was bought. Together, they let us sort out mistakes without asking anyone to trust a stranger blindly.
Three everyday moments where receipts change the story
To see why this matters in daily life, walk through three situations where software assistants are already stepping in.
A travel rebooking gone wrong. Suppose an ice storm cancels your evening train home, and your assistant tries to rebook you on the next departure. The rail company's system offers two seats: a flexible standard ticket and a non-refundable first-class upgrade. Without an action receipt, if you wake up to a steep charge on your statement, you are stuck in a circular argument. The rail company says you clicked confirm; your assistant says the form was unclear.
With a signed action envelope, the trail is unambiguous. Your task lease states plainly that the assistant had permission only to rebook a standard seat under a set limit within thirty minutes of the cancellation. If the rail system charged you for first class anyway, the signed receipt proves the rail system ignored the lease boundary. If your assistant exceeded its instructions, its own receipt shows the error immediately.
A clinic scheduling assistant. Now picture a community health clinic using an assistant to schedule follow-up blood work with patients' personal assistants. You want the two assistants to find an appointment window that fits both your work schedule and the nurse's shift. What you never want is for the clinic's scheduling bot, or your own calendar tool, to rummage through your private medical chart notes or share your workplace appointments.
A valet-key task lease keeps that boundary tight. Your assistant carries permission only to confirm a thirty-minute morning window, and the clinic's assistant carries permission only to reserve a lab chair. Both sides get a signed receipt confirming the appointment time, and neither side ever touches a single line of private medical history.
A small business supplier order. Finally, imagine you run a neighbourhood bakery and use an inventory assistant to reorder flour and butter from two regional mills each week. One morning, a faulty spreadsheet or a supplier's pricing glitch causes the mill's automated agent to quote triple the normal wholesale price for fifty sacks of flour.
If your assistant had your master bank login, that order could empty your operating account before the ovens warmed up. Because the assistant carries a bounded task lease instead, the order halts at the gate the moment the quote crosses your normal wholesale ceiling. Better still, you have a single revoke switch on your phone, like the one in the diagram above, that cancels the assistant's active lease in a tap.
What this means
When your assistant makes a mistake, or another agent oversteps, you can see it, prove it and fix it. You won't be stuck arguing with a chatbot about what probably happened.
Why this matters more as agents talk to each other
Today, most agents still act on websites built for human eyes. Soon, far more of them will deal directly with other agents on dedicated machine channels, a shift we describe in Why the internet needs a second road. Your assistant will negotiate with a store's assistant, which will check stock with a warehouse assistant and confirm terms with a credit union's assistant. That chain takes seconds. It is also a conversation no human being is watching live.
When every party in the room is software, the receipt is the only witness. If that record is missing, or if the largest platform in the room can edit the log afterwards, then truth becomes whatever the strongest system claims happened. We shouldn't drift into that world by accident.
What's already happening, and what isn't
The good news is that technical foundations for this are already taking shape. Internet standards groups are drafting rules for how software workloads prove who they represent and exchange narrowly scoped permission tokens rather than master passwords.2, 3 Several software makers are also adding activity logs and confirmation prompts to their assistants.
What is still missing is a shared civic rule: every agent action should leave a signed, portable receipt that you hold yourself. Right now, most activity logs sit locked inside the servers of the company running the assistant. Putting a tamper-evident copy of that receipt in your hands is the piece we are building, because fair dispute resolution depends on it.
We also want to be honest about the hardest unsolved problem. A receipt proves what was written down and signed, not that every covert side-channel was written down. Two badly behaved agents could, in principle, keep a second set of books off the record. Catching unreported actions requires cross-checking independent clues, an open problem we explore in Open problems we would love help with.
Where this leaves you
You don't need to be a software engineer to ask the right questions. Before you let an AI assistant book, buy, or message in your name, ask three things: Can I limit what it is allowed to do? Can I revoke its permission in one click? And do I get a receipt I can check that nobody can alter later? If the answer is no, you deserve to know that upfront.
Helpful AI could give us back hours of our week to spend with the people and work we actually care about. Keeping a licence plate, a valet key, and an itemized receipt on every automated errand is simply how we make sure our assistants stay accountable to us.
1. Thomas Kwa, Ben West et al. (METR), Measuring AI Ability to Complete Long Tasks (19 March 2025); technical report: arXiv:2503.14499.
2. IETF Workload Identity in Multi-System Environments (WIMSE) Working Group charter; Brian Campbell, Chuck Mortimore, Michael B. Jones and Yaron Y. Goland, RFC 8693: OAuth 2.0 Token Exchange (January 2020).
3. Annabelle Backman, Justin Richer and Manu Sporny, RFC 9421: HTTP Message Signatures, Internet Engineering Task Force (February 2024).
