Done Needs a Receipt: What My Agents Must Show Before I Believe Them

My agents fill in forms, ship code, look up paperwork steps and rotate passwords for me. Each of them used to end its work the same way: "Done."

I stopped believing that word on its own. Now every agent has to show a receipt, something from outside the agent that proves the work happened. No receipt, not done.

Why this matters now

Personal agents that act in a browser went mainstream this month.

• Meta's Muse launched in Japan on October 23, its first market outside North America. It opens a browser, fills in forms for you, asks before sends and purchases, and keeps a history of what it did.
• Anthropic introduced Claude Duet on October 21, an agent that keeps working while you're away. Anthropic is candid that it "still might misread a thread" and "can't yet show you its browser."

The same weeks brought evidence that an agent's own "done" isn't enough:

• Anthropic's October 9 report, Investigating unintended model actions, describes agents submitting real forms they shouldn't have, even with instructions to stop before submitting. The Conversation covered it on October 21: agents "can do as they're told and still cause trouble."
• A new paper, Who Verifies the Agent's Success Claim?, found that agents' confident reports pass failed runs, and that a judge who reads the agent's report misses more false claims. Its rule: "A system under audit should not provide evidence for its own success."
• Scale AI's Evidence-First Agentic Verification found judges "accept unsupported claims, including an agent's own reports of success," and asks for "an auditable receipt" behind every verdict.

Most advice on this is written for companies with test harnesses and CRMs. If you're one person with a few agents, the question is simpler: my agent says it's done, so what do I make it show me?

Four receipts my agents show

An agent that fills in web forms for me

It only believes a form went through when it sees a confirmation email or the site's own success banner. Clicking Submit isn't proof.

It learned that the hard way. Autofilled fields can look filled on screen without the site registering them. So before it submits, it retypes the key fields by hand. If there's no confirmation afterwards, it tries once more, then stops and tells me. It doesn't keep submitting, because a second accidental submission is worse than a missing one.

A reviewer that never wrote the code

Build work isn't judged by the agent that built it. A separate reviewer starts with a fresh context, reads the change against a written standard, and returns PASS or FAIL. Nothing merges without a PASS and green checks.

On a FAIL, the builder gets exactly one fix. If the fix fails too, it comes back to a person. The reviewers regularly catch leftovers the builder had already called done. That's the arXiv rule in practice: the thing being checked doesn't grade itself.

A paperwork agent that cites the official page

A household agent helps with government paperwork. Before it tells anyone a step, it re-checks the current official requirements page, not its memory, and records that source on the task card.

That habit caught a route it had recommended earlier, which had since changed. The plan was corrected the same day. It's a cheap check, so it runs every time. The receipt is the link and the date it was read.

An agent that rotates credentials

After a hosting provider's security incident, one agent rotated secrets end to end. Its receipt for "rotated" isn't "I changed the password." It's "the services redeployed with the new one and are healthy."

Its main rule: don't rotate a credential before you can redeploy with it. Rotating early causes the outage you're trying to prevent. When deploys were down, it set up a check that waited, did the risky steps once builds came back, and then deleted itself. Before it touches a shared credential, it checks which other agents depend on it.

Better: make the receipt part of the work

The best receipts aren't added afterwards. Another of my agents moved its cleanup into the same step as the action, so the record is correct the moment the work is done, instead of waiting for a later sweep to fix it. If something needs a scheduled job to become correct, the design is wrong. I wrote about that as accurate by construction.

Receipts check the work after it's done. Approval gates, like a send gate, check it before. You want both, and a green status still isn't the same as the job being right.

The one-page receipt table

Give your agents this table. Each agent has to show the proof before it says done.

| Action | Proof that counts | Retry once when | Escalate to me when | | --- | --- | --- | --- | | Submit a web form | Confirmation email or the site's success message | A field didn't register; retype key fields first | Still no confirmation, or a second submit could duplicate something | | Send a message or email | The sent copy in the outbox or thread | A draft didn't save | It isn't approved yet, or the recipient or wording changed | | Merge code or ship a change | PASS from a separate fresh-context reviewer against a written standard, plus green checks | One fix after a FAIL | The fix fails review again | | Tell me a paperwork or filing step | The current official page, linked and dated on the task | The page didn't load | The official page disagrees with what the agent said before | | Rotate a password or key | Services redeployed and healthy on the new credential | A redeploy flaked | Deploys are down (wait, don't rotate), sign-in or 2FA is needed, or other agents share the credential | | Update a record or tracker | The record reads correctly right after the action | The write didn't stick | It still reads wrong, or someone else changed it | | Book or buy anything | The vendor's confirmation number or receipt email | Never; don't retry a payment | Always, if no confirmation arrives |

"Unknown" is an allowed answer. An agent that says "I couldn't confirm this" is more useful than one that says "done" and is wrong.

Try it this week

Pick the agent you trust most. Look at its last few "done" messages and ask: where's the receipt? If you can't find one, add a single row from the table to its instructions and see what it reports next week.

If you're setting this up across a team rather than for yourself, that's the work I do through DataSaa: AI enablement for the team you already have. Or email me at rick@datasaa.com with the "done" you trust least.

Frequently asked questions

How do I know my AI agent actually completed a task?

Treat the agent's 'done' as a claim and ask for a receipt from outside the agent: a confirmation email, a success banner, a green check from a separate reviewer, or the official page it relied on. If the receipt isn't there, the task isn't done.

Why can't I trust the agent's own report of success?

Research published in October 2026 found that computer-use agents often claim success on runs that failed, and that a judge who reads the agent's own report gets fooled by it more often. The agent's report is evidence about itself, so it shouldn't be the proof.

What proof should an agent show after filling in a web form?

A confirmation email or the site's own success message. Fields can look filled without registering, so the agent should retype key fields and retry once. If there's still no confirmation, it should stop and tell you rather than submit again and again.

When should an agent retry, and when should it escalate to me?

Retry once when the failure is cheap and safe to repeat, like a field that didn't register. Escalate when the second try fails, when repeating could cause harm, like a double submission or payment, or when the step needs your sign-in, approval or judgment.