Who authorised this agent, and what was it allowed to touch?

• Joint guidance from six agencies in five countries. US, UK, Australian, Canadian and New Zealand security agencies jointly advised limiting agents to low-risk tasks and narrow access, and named prompt injection as the hardest threat to stop. (summarised by Mayer Brown, June 2026)
• The missing paper trail. IDC put it plainly: "Agents can act and delegate without a human in the loop generating the paper trail traditional compliance depends on." (IDC, September 2026)
• Transparency rules in force. In the EU, the AI Act's transparency duties for AI output began on 2 August 2026. (Cooley, August 2026)

"Who in the agency authorised this agent, what was it allowed to touch, and can you show what it did?" Today the answer sits in logs kept by the same team being audited.

• Who authorised it: an official, under the organisation's own registered key, as of that moment.
• What it was allowed to touch: the rules the sandbox enforced, signed off by the person who authorised them.
• What it did: every exchange, recorded as it happened and sealed, so a later edit shows.
• Checkable outside: an auditor, a court or another agency can verify it offline, without access to your systems.

A receipt is not an accreditation and does not make an agent safe on its own. It is the record that lets someone outside check what happened, which is what the guidance asks for.

Where we are: Rootz Receipts is in alpha. It runs today on NVIDIA OpenShell, with a live demo and a bank-collection pattern working against a test bank. The compute behind today's demo is declared (a software TPM), not hardware-measured, and every receipt says so.

Try it on one workflow · See a receipt checked · Other examples