Your AI Agent Needs a Receipt: Build the Proof Before It Acts
Your AI Agent Needs a Receipt: Build the Proof Before It Acts
By Anna with Oppy
A new insurance survey found that 69 percent of organizations already use AI agents, yet only 11 percent of agentic use cases reached production in the previous year.1
The models did not suddenly forget how to reason. The organizations discovered that intelligence is not the same thing as permission.
The same survey, commissioned by Camunda and reported by ProgramBusiness on August 21, found that 80 percent of respondents lacked transparency into AI inside business processes, 68 percent cited compliance concerns, and 45 percent said their agents still operated in silos.1 The sample included 125 automation leaders at insurance firms with at least 1,000 employees in the United States, United Kingdom, Germany, and France. These were not people confusing a chatbot with a toaster.
Their problem was evidence.
An AI agent can collect a mortgage document, draft a title-curative email, triage a maintenance request, or prepare an insurance renewal. If the business cannot prove which records the agent read, which rule it applied, which tool it called, what changed, and who approved the action, the agent has completed a demo, not institutional work.
The fix is an Action Receipt, a structured evidence record created while the work happens, not reconstructed after a regulator, customer, auditor, or mildly alarmed executive asks what happened.
The production gap is an authority gap
On August 21, finance technology founder Sumedha Gamage published a concise thesis after speaking at an AI in Finance event in Houston:2
“Intelligence is not institutional authority.”
Sumedha Gamage
A model may be capable of drafting a credit memo. That does not mean it may approve one. It may understand an underwriting policy. That does not mean it may change the policy. It may compose an empathetic answer to a delinquent borrower. That does not mean it may promise a modification.
Gamage describes three contracts that an institutional agent needs.2
| Contract | Question | What the business must define |
|---|---|---|
| Context | What may the agent know? | Authoritative systems, allowed fields, definitions, prior decisions, and data freshness |
| Authority | What may the agent do? | Permissions, thresholds, approval gates, exception routes, and prohibited actions |
| Evidence | What must the agent prove? | Sources, calculations, policy versions, tool calls, state changes, and human decisions |
Most pilots overinvest in the first column and improvise the other two. The prompt becomes longer. The agent sounds wiser. Nobody can explain why it changed the CRM record.
That is not maturity. It is eloquence with write access.
Why an ordinary activity log is not enough
A conventional activity log often says something like: Task completed at 10:42 a.m.
An Action Receipt answers the questions hidden inside that sentence.
Suppose an agent reviewing a commercial mortgage calculates debt service coverage at 1.35 when the correct value is 0.90. The language model cannot reliably discover its own mistake merely by rereading its answer. From the model’s perspective, 1.35 is the answer it produced. A second language model may disagree, agree, or become unexpectedly philosophical.
The deterministic calculation must sit outside the probabilistic reasoning. The receipt should record the function used, its version, the inputs it received, and the result it returned. The agent may summarize the evidence. It may not invent the arithmetic.
Gamage’s sharper formulation is worth keeping:2
“Reconstructed evidence isn't evidence. It's a story.”
Current governance guidance points in the same direction. The Life Office Management Association recommends three nonnegotiable controls before an insurance agent receives meaningful autonomy: circuit breakers or a kill switch, immutable and queryable audit logs, and human approval for irreversible or regulated actions.3 The Harvard Law School Forum on Corporate Governance similarly recommends permissions, action logs, overrides, continuous monitoring, and human approval for high-stakes actions.4
This is becoming relevant well beyond life insurance. The Title Report noted on August 20 that 25 states had adopted the National Association of Insurance Commissioners’ AI model bulletin as of April 1, 2026. Its practical themes include governance, vendor oversight, and protection of nonpublic personal information.5
The small print is learning to operate tools.
What belongs in an Action Receipt
An Action Receipt should be generated for consequential work before execution, then completed after execution. It should identify evidence without copying unnecessary personal information into a new log.
That distinction matters. BCG warns that agentic systems create persistence risk when sensitive data remains in prompts, memory, caches, or logs beyond its intended lifetime.6 Log the evidence pointer, not the borrower. Store record IDs, approved hashes, policy versions, and access events. Keep raw documents in their governed systems.
| Receipt field | Purpose | Example |
|---|---|---|
| Trace ID | Joins every step across agents and tools | trc_8f31c2 |
| Agent identity and version | Names the worker that proposed the action | income_checker_v3.2 |
| Initiator | Identifies the person or workflow that started the job | application_4821 |
| Objective | Defines the bounded job | verify_income_condition |
| Evidence pointers | Names authoritative records without duplicating their contents | LOS record ID, document hash, CRM contact ID |
| Policy versions | Shows which rules were active | income_standard_2026.08 |
| Deterministic checks | Records calculations and rule results | DTI function version, identity match, date threshold |
| Tool calls | Shows which systems were read or changed | CRM read, document query, calendar write |
| Proposed state change | Makes the action reviewable | condition: OPEN to condition: CLEARED |
| Human gate | Records who may authorize the action | underwriter, escrow officer, property manager |
| Execution result | Captures what actually happened | success, blocked, partial, rolled back |
| Retention and rollback | Defines how long proof persists and how to reverse the change | policy ID and restore pointer |
The receipt is not the model’s hidden chain of thought. It is a business record: concise sources, explicit rules, reproducible checks, authorized decisions, and observable actions.
Build three Oppies, not one very confident one
Oppy publicly supports custom AI employees using phone, email, SMS, and more than 70 connected business tools. Its current agent patterns include lead qualification, customer support, CRM hygiene, scheduling, listing operations, FAQ handling, and content creation.7 For higher-stakes workflows, divide the job.
| Oppy | Job | May not do |
|---|---|---|
| Worker Oppy | Collects authorized context and proposes the next action | Approve its own consequential action |
| Evidence Oppy | Assembles source pointers, invokes deterministic checks, compares policy versions, and issues the receipt | Quietly repair missing evidence or relax a failed rule |
| Gatekeeper Oppy | Routes the receipt to the correct human, records the decision, and executes only approved changes | Substitute its judgment for the licensed or accountable professional |
The three-agent split is not theatrical. It keeps collection, proof, and authority from collapsing into one prompt. You can connect the Oppies to approved systems through existing integrations or narrow workflow tools. Write the receipt to a governed CRM object, transaction record, or append-only store through a controlled integration. Do not claim immutability unless the storage and access design actually provide it.
Use this system prompt for the Evidence Oppy
SYSTEM PROMPT: ACTION RECEIPT PROTOCOL
You are Evidence Oppy. Your only job is to create a complete,
reviewable Action Receipt for a proposed business action.
You do not approve the action. You do not execute the action. You do
not infer missing permission. You do not copy raw personal or financial
data into the receipt when a governed record pointer is sufficient.
For every proposed action:
1. Assign one trace_id.
2. Identify the agent, agent version, initiator, objective, and affected
business record.
3. Retrieve evidence only from approved authoritative systems.
4. Record each evidence pointer, source system, record version, retrieval
time, and freshness limit.
5. Record every policy, rule, or script by exact version and effective date.
6. Send arithmetic, threshold checks, eligibility tests, and identity
comparisons to approved deterministic tools. Never calculate them from
prose when a governed function exists.
7. Record each tool call, permission used, response status, and resulting
state change.
8. Summarize the business rationale in plain language. Do not expose hidden
reasoning or fabricate certainty.
9. Set status to READY_FOR_REVIEW only when every required field is present
and every blocking check passes.
10. Set status to BLOCKED when evidence is missing, stale, conflicting, or
unauthorized. Name the exact defect and the human owner.
11. Require named human approval for irreversible, regulated, financial,
medical, legal, eligibility, coverage, pricing, or rights-affecting work.
12. After execution, append the actual result, timestamp, system response,
rollback pointer, and any exception. Never overwrite the proposed state.
Return only the approved Action Receipt schema. When in doubt, block and
route. Missing proof is not permission.
Give it a strict response schema
{
"trace_id": "trc_8f31c2",
"status": "READY_FOR_REVIEW",
"agent": {"id": "evidence_oppy", "version": "1.0"},
"objective": "verify_income_condition",
"subject_ref": {"system": "LOS", "record_id": "loan_4821"},
"evidence": [
{
"system": "document_vault",
"record_id": "doc_771",
"version": "sha256:9f...",
"retrieved_at": "2026-08-22T14:25:00Z"
}
],
"policies": [
{"id": "income_standard", "version": "2026.08", "effective": "2026-08-01"}
],
"checks": [
{
"function": "income_variance_check",
"version": "2.3",
"result": "PASS",
"request_id": "fn_9014"
}
],
"proposed_change": {"field": "income_condition", "from": "OPEN", "to": "CLEARED"},
"human_gate": {"role": "underwriter", "decision": "PENDING"},
"execution": null,
"retention_policy": "ai_action_receipt_7y"
}
Your legal, compliance, security, and business owners should approve the schema, controls, retention, and escalation rules. The prompt applies that design. It does not create it.
One pattern, seven residential-service jobs
The Action Receipt is useful wherever an AI employee crosses from communication into consequential action.
| Business | Low-risk work an Oppy can prepare | Action that needs a receipt and gate |
|---|---|---|
| Mortgage | Collect missing documents and answer status questions | Clear a condition, change a loan field, or send an adverse-action communication |
| Title and escrow | Request a document and summarize an exception | Resolve a curative item, change disbursement instructions, or release a file |
| Insurance | Gather renewal information and explain policy documents | Change coverage, price, eligibility, or bind status |
| Brokerage | Qualify an inquiry and schedule a showing | Publish or alter listing facts, route protected-class-sensitive requests, or transmit an offer |
| Transaction coordination | Track dates and request signatures | Change a deadline, mark a contingency satisfied, or close an exception |
| Property management | Triage a maintenance request and gather photos | Dispatch above a cost threshold, enter a unit, deny service, or change a ledger |
| Dental or legal intake | Schedule, collect approved facts, and route urgency | Give clinical or legal advice, accept a matter, change eligibility, or make a rights-affecting promise |
The human gate does not make the agent less useful. It lets the agent own everything around the judgment: evidence collection, policy retrieval, calculations, document preparation, routing, reminders, and post-decision execution.
That is where the capacity lives.
Measure receipts, not enthusiasm
ProgramBusiness reported that insurers in its cited survey manage an average of 49 process endpoints, a figure growing 14 percent annually.1 An agent can now cross people, models, APIs, CRMs, policy systems, sensors, and document stores in seconds. Counting agent launches says little about whether the resulting work can survive scrutiny.
A useful operating scorecard tracks receipt completion rate, missing-evidence blocks, deterministic-check failures, human override rate, unauthorized-tool attempts, rollback events, and time from proposed action to authorized execution. A rising block rate may look inefficient. It may also mean the system has finally learned to notice risk before the customer does.
Marvin Chang wrote in HousingWire on August 21 that AI converts formerly individual and invisible mortgage trust failures into systematic, discoverable patterns.8 That is the warning and the opportunity. AI can scale a hidden mistake. It can also make every source, check, decision, and correction visible.
The next generation of AI employees will not earn trust by sounding more human. They will earn it by issuing better receipts.
References
[2] Sumedha Gamage, LinkedIn post on context, authority, and evidence, August 21, 2026.
[3] LOMA, “Executive Summary: Agentic AI in Insurance.”
[5] The Title Report, “As AI Use Increases in Title, So Does Compliance Guidance,” August 20, 2026.
[6] Boston Consulting Group, “Agentic AI Is Rewriting the Rules of Data Risk Management,” June 8, 2026.
[7] Oppy, product overview and agent capabilities.
[8] Marvin Chang, HousingWire, “Thirty Years Is Not a Relationship,” August 21, 2026.