AI Receipts: A Technical Framework for Provenance, Audit, and Governance
An AI receipt is a signed, tamper-evident record of an AI interaction, written at the moment the interaction happens and anchored to storage the party that generated it cannot alter. Weilliptic builds this under the name Receipts. Here's the problem it solves, why conventional logging can't solve it, and how the mechanism actually works.
The problem receipts solve
Every workday, a modern enterprise generates thousands of AI-shaped decisions. Code gets written. Contracts get drafted. Customer responses get generated. Financial models get stress-tested. Almost none of it leaves a trace that would hold up to scrutiny.
Ask a straightforward question: which parts of this document were AI-generated, which model produced them, what prompt led to that output, and who authorized the use? In most enterprises today, no one can answer that with proof. Not because anyone was careless. Because the infrastructure never captured it.
This is not a new problem for software. Source control gives every line of code an author and a commit history. Financial systems give every transaction an immutable ledger entry. Supply chains give every component a chain of custody. AI arrived without any of that. The output of a model is a string of tokens with no attribution, no signature, and no link back to the prompt, model version, or identity that produced it.
The gap shows up in three places inside a typical enterprise: direct chatbot use (employees pasting confidential context into ChatGPT, Claude, or Gemini), autonomous agents acting in the background (filing, approving, retrieving, executing), and coding agents generating production code with no record of which lines were AI-authored or what prompt drove them. All three produce real decisions with real consequences, and none of them are currently provable.
Why logs are not evidence
Most organizations assume they already have this covered because they log API calls to their model providers. They don't, and the reason is structural rather than a configuration gap.
A real provenance record has to clear four bars conventional logging was never built for:
Complete. It has to capture the full prompt, the model version, the output, the identity of the user or agent, and the context of use. Most application logs capture a fraction of this.
Tamper-evident. A record that the same system that generated it can also silently alter has no evidentiary value. If an auditor cannot prove the log was untouched between the event and the inquiry, the log does not function as proof.
Independently verifiable. A record signed and stored by the system that produced it cannot serve as proof to a third party. Verification has to be possible without trusting the party under review, including when that party is the vendor whose product is in question.
Portable. The record needs to outlive the application, the model version, and often the vendor. A log locked inside a SaaS provider's own database does not survive a vendor dispute, a platform migration, or an incident three years later.
Standard application logs fail the tamper-evidence test. Vendor-side logs fail the independence test. Both usually fail completeness, because neither was designed to capture prompt-level lineage in the first place. Closing this gap requires infrastructure that sits outside the AI execution path and produces proof instead of asking for trust.
How receipts actually work
Receipts covers this across three surfaces: browser, coding agents, and non-browser agents. Start with the browser layer, WAuth. WAuth gives every employee a personal, verifiable identity for AI interactions and writes a signed record of each one to WeilChain. It intercepts the prompt and response on major AI platforms client-side, without requiring cooperation from the model provider. No changes required from OpenAI or Anthropic.
Every interaction produces two signed events, a prompt submission and a model response, along with metadata: timestamp, page context, and the identity that produced it. Each one is sealed at the moment it happens and anchored on WeilChain.
Two design choices matter here and both are deliberate.
The record itself, not the underlying content, is what gets anchored. The prompt and response stay off the ledger and are revealed only during an authorized audit. This is what makes the model privacy-preserving: the organization gets a verifiable record that an interaction happened, exactly as specified, without every prompt and response sitting in a permanent, broadly accessible store by default.
Verification does not depend on Weilliptic. A signed, anchored receipt can be checked directly against WeilChain's block explorer, Marauder, by an auditor or a regulator, without needing Weilliptic's cooperation or the model provider's.
That is the core distinction between a receipt and a log. A log describes what a system says happened. A receipt is signed and sealed at the moment of the action, before anyone has a reason to ask, and it can be checked independently of the system that produced it.
The same mechanism, two more surfaces
The same core process, capture, sign, seal, anchor, extends past the browser under two more names.
On the coding side, call it the ghost code problem. Coding agents like Claude Code and Codex now write a meaningful share of merged commits in many engineering organizations, but source control still records only a human author, and code review still assumes a human wrote what it's reviewing. When an agent produces the code and a developer accepts it, the prompt that drove the work disappears with the chat session, and six months later nobody, including the developer of record, can reconstruct why the code was structured the way it was. That gap compounds silently: the codebase ships, the features work, and it only becomes visible during an incident, a security review, or an audit request, by which point the trail is cold.
Codensics closes it. A lightweight audit hook intercepts Write and Edit actions in Claude Code before they touch the filesystem, converts the change into a structured record built to the open Agent Trace specification, and anchors a signed version of it on WeilChain, tied to the developer who accepted the change. That interception point is deliberate: it's the last moment the full causal chain is still intact, the prompt that triggered the change, the model and session that produced it, the exact lines affected, and the developer identity about to accept it. Capture it there and a repository gains something conventional source control cannot provide: for any line of code, a verifiable answer to which prompt produced it, which model generated it, and which developer accepted it.
On the agent side, Cerebrum extends the same primitive to backend agent frameworks like LangChain and Google ADK. Every agent gets its own identity, and every subsequent action it takes is captured, signed, and anchored the same way.
WAuth, Codensics, and Cerebrum all sit under Receipts as one substrate. Every actor, human or agent, has its own distinct identity rather than a static API key or a shared service account, so a receipt always resolves to a specific, non-repudiable actor. The result is one ledger covering what employees ask AI directly, what coding agents write, and what autonomous agents do on their own, all in the same verifiable format, under the same identity model.
What this looks like against what else is on the market
Most platforms that claim to track AI agents are really offering some combination of three things: application logs, which are editable and get rotated out on a normal retention schedule; agent traces, which live inside the vendor's own system rather than the customer's; and transcripts, which show what was said but not what was actually done. None of these function as a record the customer controls, and none of them exist as proof until someone goes looking for one after the fact.
A 2026 Kiteworks survey found that half of organizations cannot produce a complete AI data access audit record within one business day. A policy is a document describing intended behavior. It is not a record of what an agent or employee actually did.
Receipts are signed and sealed at the moment of action, before anyone asks the question. Append-only and tamper-evident. Verifiable independently of the vendor whose product is under question.
Frequently asked questions
What is an AI receipt? A signed, tamper-evident record of a specific AI interaction (a prompt and response, a coding-agent edit, or an autonomous agent action), written at the moment it happens and anchored to a ledger the originating system cannot retroactively alter. Weilliptic's Receipts covers all three cases through WAuth, Codensics, and Cerebrum.
How is a receipt different from a log? A log is written and stored by the same system that produced the event it describes, so it can be edited or lost without an independent way to detect the change. A receipt is signed and anchored externally at the moment of the event, so alteration is detectable and verification does not depend on trusting the system under review.
What's the difference between WAuth, Codensics, and Cerebrum? All three are capture layers under Receipts. WAuth covers browser-based AI (ChatGPT, Claude, Gemini). Codensics covers AI coding agents (Claude Code). Cerebrum covers backend agent frameworks (LangChain, Google ADK). All three give every actor its own identity and anchor a signed record to the same WeilChain ledger.
Does Receipts require cooperation from AI providers like OpenAI or Anthropic? No. WAuth captures browser-based interactions client-side through a browser extension, and Codensics captures coding-agent interactions through integration hooks like the ones Claude Code exposes. No changes required from OpenAI or Anthropic.
Is the content of every prompt and response stored publicly? No. Only a signed record of the interaction is anchored on WeilChain. The underlying content is revealed only during an authorized audit, which keeps the model privacy-preserving rather than a permanent, broadly accessible archive of everything employees asked AI.
Not logs. Receipts.