Every AI agent should sign its work. The signature tells you who or what acted, what happened, and whether a person checked it. That makes mistakes easier to trace and fix.
“AI-generated” is too vague to operate a company. I want to know whether the work was human-authored, agent-assisted, or agent-executed; which platform and desk acted; what it did; and whether a human reviewed that exact item.
Start With the Failure You Can Actually Trace
We recently had an agent reply to an email notification that came from Basecamp. The delivery account displayed my name, but the reply went to a Basecamp notification address that does not accept email. The message bounced instead of landing in the project.
We recovered the body and posted it in the correct Basecamp thread. But to learn which agent had acted, we had to inspect the sending connection and trace it back to Claude. The visible sender name alone told us nothing about the actual worker.
That failure produced a system change: every agent-authored email, Basecamp comment, DM, support reply, scheduled report, and public action receipt must now end with an identity line. The matching public implementation is proposed in this open agent identity pull request, including automated validation of the wording; the PR remains open pending independent review.
Treat Disclosure as a Routing Key
A disclosure is not a decorative badge. It is a foreign key: the small piece of data that connects a human-visible action to the agent, model, role, instructions, approval state, and evidence behind it.
If a post is wrong, I need to know which article-writing skill to fix. If an email goes to the wrong address, I need to know which mail path and approval rule failed. If a report invents a metric, I need to know whether it came from Grok, Claude, Codex, Cursor, or a named specialist desk running inside one of those platforms.
This is why agent tracing records generations, tool calls, handoffs, and guardrails. It is also why the OpenAI Agents SDK supports manager-style orchestration: the manager must know which specialist ran before it can combine, inspect, or correct the result.
Say How Much Human Work Actually Happened
I do not want fake precision such as “73% human.” I want an honest state that a stranger can understand and an operator can verify.
| State | What it means | What not to claim |
|---|---|---|
| Human-authored | A person wrote the substantive work. Software may have formatted, transcribed, or checked it. | Do not call an agent draft human-authored because a person supplied the topic. |
| Agent-assisted | A person shaped or revised the exact item, and an agent helped research, draft, edit, or execute it. | Do not say “reviewed by Dennis” unless Dennis reviewed that exact item. |
| Agent-executed | An agent produced or performed the action. It may have been authorized, but it was not separately human-reviewed. | Do not turn authorization into a claim of review. |
This distinction matches the three clocks in my 24-hour AI work audit: human orchestration, agent runtime, and verified output. They work together, but they are not interchangeable.
Use One Receipt Humans Can Read
Here is the format we now require:
Agent receipt: <agent> [model if known] · action: <drafted|sent|posted|published|changed> · human review: <reviewed by Dennis|authorized, not separately reviewed|no human review recorded>
The recognizable platform comes first. A specialist can be “Grok — Meter Maid,” but “Meter Maid” alone is not enough. If the platform does not expose the exact model, the receipt says model UNKNOWN; guessing creates bad telemetry.
The action must also be exact. Drafted is not sent. Sent is not posted in Basecamp. Saved is not published. A delivery account that displays “Dennis Yu” does not identify the agent, and the receipt never creates permission to send, publish, spend, merge, or change access.
Let Agents QA Agents Without Hiding the Builder
A builder should not quietly grade its own work. The useful pattern is a named agent doing the work, a fresh reviewer grading the evidence against a written standard, and a manager deciding whether it passes.
Anthropic’s guidance on evaluating AI agents treats the transcript or trajectory as part of the evidence because agents take many steps and use tools. NIST’s AI Risk Management Framework likewise calls for documented human-AI roles, responsibilities, oversight, testing, evaluation, verification, and validation. You cannot apply either discipline well when the worker disappears behind a generic account name.
Our public Grok Bot operating guide uses named desks for the same reason. The coordinator routes work; Article Writer drafts; Website Builder ships approved pages; Meter Maid watches paid usage; Quality checks the other departments. “Grok did it” is as useless as saying “the company did it.”
The receipt gives the reviewer a starting point. It does not tell the reviewer to trust the work. The reviewer still checks the source, the rendered page, the sent copy, the live Basecamp comment, or whatever counts as completion in the system where the work was supposed to land.
Identity belongs in the visible receipt; private prompts, recipients, client data, and credentials do not. Detailed traces stay access-controlled and redacted because, as the OpenAI tracing documentation warns, generation and tool spans can contain sensitive inputs and outputs.
Separate Provenance From Quality
This distinction matters. The C2PA Content Credentials explainer describes provenance as facts about a digital asset’s history, including origin, modifications, and AI use. Provenance does not decide whether the content is true, useful, ethical, or good.
Our agent receipt works the same way. It tells you where to look and who—or what—to hold accountable. It is not a gold star, a hall pass, or a substitute for QA.
A signed bad answer is still bad. But an unsigned bad answer becomes much harder to diagnose, route, compare, and prevent.
Turn Every Failure Into a Harness Improvement
The operational loop is simple: live work creates a receipt; a different reviewer grades it against the definitive standard; a failure goes back to the correct owner; the lesson updates the skill or guardrail; and the next run starts sharper.
That is how disclosure becomes part of the harness. It gives a manager agent the information needed to choose the next reviewer, select the right rubric, escalate to a human, or stop a broken workflow before it repeats across every client.
It also makes scoreboards honest. We can compare correction rates by desk, model, skill, or action type without blaming the human whose name happens to be on the delivery account. Over time, zero-revision work earns more autonomy while repeated failures get tighter controls.
Keep the Durable Record Outside the Chat
The receipt should point toward a durable record, not become another isolated message. My rule is chats are rented; files are ours: the conversation is useful during the run, while the instructions, evidence, and lessons belong in files and systems the team controls.
You can see this process in the public build note for a first-person article. It records which agent wrote and QA’d the article, which sources and original photos were used, what could not be completed, and how the work was prepared for publication.
The related How I Work page explains why I keep context portable across Claude, Grok, Codex, Cursor, and other tools. The model can change. The identity, job, evidence, and operating standard must survive the switch.
Adopt the Rule Before You Add More Agents
If your company has one assistant, informal memory might seem good enough. Once you have multiple agents, specialist roles, scheduled jobs, and agents managing agents, invisible identity becomes technical debt.
Start by requiring a readable receipt on every human-visible action. Then store the corresponding trace, source, review state, and evidence where a manager can inspect it without hunting through private chats.
Disclosure is ethics, but it is also operations. It respects the human audience, protects the people whose names appear on delivery accounts, and gives the agent system enough structure to supervise itself without pretending that self-supervision is the same as trust.
Answer the Practical Questions
Does every use of spellcheck or transcription require an AI label?
No. Disclose the substantive worker and material assistance. The point is truthful provenance that changes how someone should interpret or audit the work, not a badge for every software feature.
Is “AI-assisted” enough?
Not for operations. Add the platform or agent, the action, and the human-review state so the work can be routed and verified.
Does disclosure prove the work is correct?
No. It identifies the path to the evidence and the owner of the next correction. Independent QA still decides whether the work passes.
Can an agent say Dennis reviewed something because he authorized the task?
No. Authorization and review are different facts. Say “authorized, not separately reviewed” unless there is evidence that Dennis reviewed the exact item.
What if the exact model is hidden?
Write “model UNKNOWN.” A clean unknown is better than invented telemetry.
Agent receipt: Codex · action: published · human review: authorized, not separately reviewed