Require a transaction record your organization can keep.

Why the vendor’s logs are not always enough

Provider logs are useful, and Bulla does not replace them. But those logs usually use the provider’s schema, live in the provider’s account, and cover activity across its system. A customer reviewing one transaction later may depend on the provider’s access controls, export format, and retention policy.

If a provider exports the relevant event, binds it to the buyer’s request and accepted terms, authenticates it, and lets the buyer keep it, that export can become evidence for an ActionReceipt. Bulla standardizes the customer-facing transaction record so every buyer does not need a custom integration for every provider’s logs.

A file that stays with the customer

An ActionReceipt records one transaction in an open, versioned format the customer can retain. A customer, auditor, claims handler, or underwriter can check the file after the agent or provider endpoint is unavailable. The receipt does not by itself establish that the reported action occurred or that every action was recorded.

The constructed USD 125.00 example shows the exact separation used for a payment dispute. Download the retained receipt or run the local checks.

What to require

Contract language

Starting language for a procurement conversation, not legal advice. Adapt the terms and periods to the engagement.

Vendor will emit an ActionReceipt conforming to the Glyph ActionReceipt specification (v0.2) for each consequential action its agents take on Customer systems or on Customer’s behalf, including payments, writes, permission changes, and data egress. Each receipt will bind the acting principal, the governing policy, and the bounds that applied, and will carry a recourse envelope naming a challenge forum and window. Vendor will deliver the receipts together with a periodic coverage report reconciling them against a Customer-retained dispatch record and identifying each unmatched action. Vendor will also deliver the ActionReceipt v0.2 verification kit and its detached SHA-256 digest. Customer may retain the receipts, supplied evidence, coverage record, and verification kit for an agreed period after termination. Before acceptance, Vendor will demonstrate thatbulla receipt drill reproduces the declared local checks with network access blocked and reports unresolved external claims separately.

Acceptance checklist

This checklist accepts or rejects the delivered record set. It does not accept the action itself. The contract must state which signers, evidence sources, action-log coverage, and challenge terms are acceptable.

• The verification-kit archive matches the contracted detached or signed-release digest.
• The retained-receipt drill reports checker agreement and rejects its tamper control.
• Receipt integrity is reported as a named dimension rather than a global status.
• Authority is reported as authenticated, unauthenticated, forged, unresolved, or not applicable.
• The report identifies whether each evidence item is a provider statement, a reproducible computation, a counterparty-signed record, or another supported evidence class.
• The coverage report identifies the supplied action log and every unmatched action in it.
• The receipt names the challenge forum, window, remedies, and current reachability status.

Download the verification kit and its detached digest.

Storage and custody

Glyph does not host operational receipt sets. The customer and counterparty retain their own copies under an agreed policy. No independent receipt register is currently operated.

Why a provider would support ActionReceipts

Buyers, routers, and marketplaces can make receipt support a condition for routing work or accepting a delivery. A provider that supports the format can participate in those workflows and use the same agreed record for acceptance, audit, and disputes. The model itself does not need to create the receipt; the provider’s gateway or runtime can emit it.

Current evidence does not establish that receipt support makes payment faster, lowers insurance costs, or creates portable reputation. Those are possible outcomes to test, not claims of this standard.

Checking what you receive

$ bulla receipt verify receipt.json --format json
$ bulla receipt drill receipt.json --format json

from bulla import event_coverage

# Fact-bearing dispatch rows must carry record_sha256, and each delivered
# receipt must bind that digest in its result or evidence references.
report = event_coverage(
    vendor_dispatch_log,
    delivery_receipts,
    anchor="vendor-dispatch-log",
)
print(report["unreceipted_delta"])

Logging is already law

The EU AI Act requires automatic event logging for high-risk AI systems (Article 12) and retention of at least six months (Article 26(6)), with high-risk obligations applying from August 2, 2026. An ActionReceipt is not a substitute for those operational logs. It provides a separate customer-facing transaction record that another party can retain and check. Whether a given deployment is high-risk is a determination for the deployer and its counsel, and this page does not make it.

What the vendor has to implement

The standard is open and the Bulla reference implementation is Apache-2.0 licensed. A provider adds Bulla to the gateway, tool router, payment handler, or agent runtime that already accepts and records the action. The customer receives the resulting file and can run local checks without a hosted service.

Send this page to the vendor. The build path is the quickstart, and the Python interface is at Wrap your agent’s actions.