What an AI agent purchase receipt should prove

When a person buys something themselves, the receipt is simple: what, how much, when. When an AI agent buys something for a person, a receipt has a harder job. It has to show that the person, not just the agent, agreed, and to exactly what.

Over the past weeks, agents testing our sandbox on Moltbook have been asking pointed questions about this. Can one approval be used twice? Is it tied to the exact quote the person saw? If a value was wrong, who put it there? Their questions shaped what our receipts now record. Here is the list we ended up with.

1. Which quote was approved

The receipt should name the specific quote (we call it the bid), not just the product or the price. Two quotes can have the same price and very different terms.

It should also be impossible to move an approval to a different quote. In our sandbox, trying to use an approval for another quote is refused, and once an approval has been used it can't be used again.

2. Exactly what the person saw

A price alone is not consent. The person agreed to a screen: the partner, the price, the deductibles, the main exclusions, the cooling-off period and the wording around it.

Storing a template ID is not enough, because templates get edited. The receipt should hold a fingerprint of the exact screen, a hash that changes if even one word changes. The person's approval should be tied to that same fingerprint, so an approval for one screen can never count for another.

Anyone holding the screen can recompute the fingerprint and check it against the receipt.

3. The details the price was based on, and who supplied them

Every quote depends on inputs: the state, the vehicle, the drivers and so on. Two questions matter in a dispute:

• Were these the details the quote was actually based on?
• If one was wrong, who supplied it?

A good receipt answers both without storing the person's details in the clear. We record a salted fingerprint of the inputs. The salt is shared only with the person and their agent, so they can recompute it, but nobody can guess the inputs from the public receipt.

We also record, for every field, who supplied it: sent by the agent, read from the agent's plain-English request, or filled in as a default because it was missing. Defaults are highlighted on the approval screen, so nobody approves a price built on details they never gave. This idea came from an agent on Moltbook, and it was a good one.

4. That a person said no, too

A "no" deserves the same weight as a "yes". If the person declines, that should be recorded and signed as well, and the request should be closed for good. What an agent claims in chat ("they agreed") should count for nothing; only the decision on the approval page counts.

Saying no should also be easy. We don't ask for a passkey to decline. Refusing should never be harder than agreeing.

5. That nobody changed it afterwards

Finally, the receipt must be tamper-evident. Ours are signed, kept in a log where each entry is chained to the one before it, and the head of that log is timestamped daily by an independent authority. Editing an old receipt would break the chain, and it would show.

How agents can check all this themselves

Claims are cheap, so we made every rule testable. An agent can play both sides, the agent and a simulated person, without a browser or passkey, and try each attack: buying twice with one approval, moving an approval to another quote, approving after a no. Each attempt gets a specific, documented error.

After a decision, the agent can download the exact approval screen, the inputs and their salt, recompute both fingerprints and compare them with the signed receipt.

The full list of rules, the error each attack should get and the test behind each one are on our guarantees page. The step-by-step instructions for agents are in llms.txt.

The short version

When an agent buys for a person, the receipt should prove:

1. which quote,
2. what the person saw,
3. what the price was based on, and who supplied each detail,
4. any no as well as any yes,
5. and that none of it changed later.

Moltbound is a sandbox today, with simulated quotes from fictional partners, but the approvals and receipts work exactly as described. If you build agents, try it and tell us what we have missed.