When an AI agent claims it finished a task, skepticism is the only sane response. A log entry that reads “Task completed

When an AI agent claims it finished a task, skepticism is the only sane response. A log entry that reads “Task completed at 14:32” is just a string of text. The agent might have crashed silently, submitted a blank form, looped through empty search results, or hallucinated an entire workflow. If your architecture involves multiple agents running on different machines, cloud regions, or IP addresses, the problem compounds fast. Agent B has no reason to trust Agent A’s report unless Agent A can show its work.

Every credible verification system is built on three layers. Evidence is the raw artifact—the screenshot, the API response, the HTML dump. Attestation is a signed or cryptographic claim that binds that evidence to a specific agent and a specific task ID. Verification is the process that confirms the evidence actually satisfies the original goal, not merely that the file exists. Evidence without attestation can be replayed from one job to another. Attestation without verification tells you the data is genuine, but not whether it answers the question you asked.

Visual Proof: Screenshots and OCR

When an agent drives a browser or interacts with a graphical interface, the simplest proof is a picture. The agent captures a full-page screenshot after the action completes, runs OCR to extract visible text, and submits both the image and the extracted strings as evidence.

This pattern fits social media posts, form submissions, or checkout flows. Imagine an agent tasked with publishing a weekly update to a company LinkedIn page. The screenshot shows the live post with a server-rendered timestamp and the post ID embedded in the URL. OCR can confirm the exact headline and body text appear on the page alongside those platform-specific markers.

The risk is obvious: screenshots can be faked. A compromised agent could render a fake webpage locally, screenshot it, and declare success. To raise the bar, require dynamic text markers that are hard to predict. A confirmation ID issued by the platform, a timestamp from the server, or a unique nonce the verifier appends to the job instructions can all serve as anchors. If the OCR output does not contain the expected confirmation ID tied to that exact task, the proof fails.

Screenshots are heavy, though. They consume bandwidth and storage, and they break when platforms redesign their layouts. Use them when the UI is the only surface available, but treat them as a baseline, not a fortress.

Signed API Receipts

When the agent works through a backend API, skip the image. Ask for a signed receipt.

After an automated post or data scrape, the platform typically returns a structured payload. That JSON contains an ID, a timestamp, status fields, and sometimes rate-limit headers. The agent signs this entire payload with a private key, includes the task ID inside the signed blob, and submits the bundle. The verifier checks the signature against the agent’s public key and inspects the receipt to confirm the action succeeded.

The weak point here is key custody. If the agent holds its own private key on the same machine where it runs, a prompt injection, malware flare, or container escape could extract it and forge receipts for tasks that never happened. Do not bake long-lived keys into the agent’s environment. Instead, use a key management system that issues short-lived, task-scoped credentials. Rotate keys for every task. If the agent must request a signing key from a secure enclave or KMS for a five-minute window, the blast radius of a compromise stays small.

This pattern works best for high-volume, headless automation: syncing ad spend reports, publishing via social media APIs, or scraping endpoints that return structured JSON. It is lighter than screenshots and far easier to verify programmatically.

Proof Chains for Continuous Work

Some tasks refuse to fit inside a single