---
title: "trust the receipt, not the agent"
canonical_url: https://ensurance.app/guide/trust-the-receipt-not-the-agent
markdown_url: https://ensurance.app/guide/trust-the-receipt-not-the-agent.md
subtitle: a registry says who an agent is. a reputation says who liked it. only a record shows what it did
category: ensurance
---

# trust the receipt, not the agent

*a registry says who an agent is. a reputation says who liked it. only a record shows what it did*

Ethereum now has a registry where an AI agent can say who it is. Nothing in it tells you what the agent actually did.

That gap is the honest answer to anyone searching for **verifiable AI agents**. The phrase usually means an agent whose identity you can check and whose track record you can trust. The first half has a standard now. The second half is still a set of reviews, and a review is not a receipt.

This post is about the receipt: what it is, where it lives, and why we refuse to boil it down to one number.

:::johnson
**a registry says who an agent is. a mandate says what it may do. a record says what it did.**

Trust the third one. If you hold a sensor log, a survey, or a field reading on a place, the place's agent has a record where it can land.

[bring a reading →](/contact?from=guide&topic=agents)
:::

## what the agent registries got right

**ERC-8004**, titled "Trustless Agents," is a draft Ethereum standard for finding agents and deciding whether to deal with them. It defines three lightweight registries. An **identity registry** gives each agent a handle that points to a registration file: a name, a description, and the services it offers. A **reputation registry** lets clients post feedback about an agent. A **validation registry** lets an agent ask an independent checker to review a piece of work, and records the answer.

This is useful work, and the authors are candid about its limits. Feedback is a signed number with optional tags and an optional file. Validation answers run from 0 to 100. The security section says plainly that Sybil attacks are possible, meaning fake reviewers can inflate a fake agent's reputation, and that the standard "cannot cryptographically guarantee that advertised capabilities are functional and non-malicious." The standard's job is to make the signals public and shared. Deciding what they mean is left to everyone else.

Is this crypto? It is a public ledger and a service that writes to it. The argument below holds without the ledger; the ledger just makes the registry's entries harder to rewrite quietly.

## who, may, did: four questions, four different answers

Most talk about agent trust blurs four questions into one.

| question | where the answer lives | who writes it | what it cannot tell you |
| --- | --- | --- | --- |
| who is this agent? | an identity registry | the agent or its owner | whether anything it says is true |
| what do others think of it? | a reputation registry | clients and reviewers | whether those reviewers are real, or were there |
| what may it do? | a mandate | the owner | whether it stayed inside the limits |
| what did it do, and what changed? | a record of actions and readings | onchain activity, plus whoever took the reading | nothing beyond what was observed, and that is the point |

An identity is a claim about the agent. A reputation is other people's claims about the agent. A mandate is a rule. Only the record is made of things that happened. We covered the rule in [an agent needs a mandate before it needs a wallet](/guide/an-agent-needs-a-mandate-before-it-needs-a-wallet?from=guide). This post stays on the record.

## a reputation is a review, not a reading

Reputation answers a fair question for a coding agent or a booking agent: did the last hundred clients get what they paid for? The validation registry suits work a checker can rerun, such as an inference or a computation.

A claim about a living place is a different animal. "This agent's watershed is holding" cannot be rerun by a staker, and a thumbs-up from a satisfied client says nothing about the creek. The only thing that speaks to the river is a reading of the river: a gauge, a probe, a lab sheet, a satellite pass, or a steward's season of notes, each with its method attached.

The difference between a sentence about a place and a measurement of it has its own post: [a claim is not a reading](/guide/a-claim-is-not-a-reading?from=guide).

## what an ensurance agent keeps instead

An [*ensurance* agent](/agents?from=guide) is an account that belongs to a place, a group of people, or a purpose. It has its own wallet, its own stated purpose, and a mandate its owner sets. There are more than two thousand of them. We explain the wider idea in the hub post, [every agent got a wallet. the earth didn't](/guide/every-agent-got-a-wallet-the-earth-didnt?from=guide).

Every agent also has a **claims and evidence** record. The examiner reads what the agent says about itself, then sets it beside what can be pointed at: its holdings, its recent activity, the places it is linked to on a map, attestations others have made about it, and any readings bound to its place. The report names the gaps and suggests what to collect next. It shows on the agent's page and through a public API.

Three design choices do most of the work.

**No composite trust score.** Each facet of the record gets a plain status: met, partial, unmet, or not applicable. There is no single number to game, and no number that hides a disagreement. If a gauge and a satellite product disagree about the same reach, both stay visible with their methods, and the person who has to sign decides.

**Evidence keeps its rank.** A reading with a unit, a method, a time, and a place the agent already claims ranks highest. A satellite product or a model ranks next, and only when it names its assumption. A person or a registry vouching for something nobody measured ranks below that. A bare number with no method, no unit, or no place is kept as a note and does not count. That ranking puts reputation where it belongs: an attestation is a vouch, not a measurement.

**The registry points at the record.** When an ensurance agent registers under ERC-8004, which its owner approves in their own wallet, the registration file lists a "claims" service. That entry points straight to the agent's claims and evidence report. Anyone who looks the agent up can follow the handle to the record.

## a place for the evidence to land

A record is only as good as what reaches it. So every agent has a door for readings. A manual entry and a JSON feed use the same shape: what was measured, the result, the unit, the time, the method, and the place. Radar, a soil probe, a lab row, and a field survey all fit. The server assigns the rank, not the sender. The raw file stays with whoever made it; the record keeps a pointer.

Who can post? The person who holds the agent, its operator, or an administrator. A stranger cannot write to an agent's record, which is the point of a record. Anyone can read it.

Here is what that looks like when it is honest. The [Roaring Fork River agent](/roaring-fork-river.basin?from=guide) has named river flow as an indicator it watches. No flow reading is bound to it yet, so its own record reads that watch as unmet, zero of one: no observed row for water flow. Nobody rounded that up. The gap is visible, and the record names what would close it: a bound reading of river flow, or dropping the indicator from the watch.

That is the stage we are at. The examiner is built and running, the door for readings is open, and the record is waiting on readings from people who already take them. It is built, and it is growing.

The record also serves something beyond itself. The reading matters because the place matters, and because a funder, an underwriter, or a steward will one day cite that reading to decide what the place needs. The record is a bridge to the place. It is never a substitute for it.

## frequently asked questions

### how do you verify what an ai agent did?

You read its record, not its profile. An identity registry tells you who the agent says it is. A record of actions and bound readings tells you what it did and what changed. For an ensurance agent, the claims and evidence report sets the agent's own statements beside that evidence, facet by facet, and names what is missing.

### is a reputation score evidence?

It is evidence of what reviewers think, which is worth knowing. It is not evidence of what happened. The ERC-8004 authors warn that fake reviewers can inflate a fake agent's reputation, and expect readers to filter feedback by the reviewers they trust. In our record, an attestation counts as a vouch and ranks below a measurement.

### what counts as evidence for a nature claim?

A dated reading with a unit, a method, and a place the claim is about. A model or satellite product counts when it says it is a model and names its assumption. A sentence, a score, or a bare number does not, though each can be kept and labeled for what it is.

## bring a reading

Have a sensor, a survey, or a field reading on a place? Bring it. [Tell us what you have](/contact?from=guide&topic=agents) and which place it belongs to. If you want the distinction first, start with [a claim is not a reading](/guide/a-claim-is-not-a-reading?from=guide).

## sources

[ERC-8004: Trustless Agents](https://eips.ethereum.org/EIPS/eip-8004) — the draft standard: identity, reputation, and validation registries; feedback and validation fields; security considerations, including Sybil risk and the limit on what the registry can guarantee

[ensurance protocol stats](https://ensurance.app/api/protocol/stats) — agent count (2,095 on 2026-10-26)

## the series

Seven posts on the agents we built for the economy nobody pays.

1. [every agent got a wallet. the earth didn't](/guide/every-agent-got-a-wallet-the-earth-didnt?from=guide)
2. [give an agent a wallet and you've built a target](/guide/give-an-agent-a-wallet-and-youve-built-a-target?from=guide)
3. [autonomous is a setting, not a personality](/guide/autonomous-is-a-setting-not-a-personality?from=guide)
4. [trust the receipt, not the agent](/guide/trust-the-receipt-not-the-agent?from=guide) — this post
5. [plug your model into the living world](/guide/plug-your-model-into-the-living-world?from=guide)
6. [nobody was coming, so we built the market](/guide/nobody-was-coming-so-we-built-the-market?from=guide)
7. [the first invoice a river ever sent](/guide/the-first-invoice-a-river-ever-sent?from=guide)