Most companies using AI agents don’t trust them. A Forrester study for Boomi, published in July, found that 86% of organisations have moved AI agents beyond the pilot stage. Only 34% said they trust the actions those agents take.
That gap should worry anyone who works with this technology. An agent that books travel, moves money or approves an invoice is acting on someone’s behalf. When it gets something wrong, the usual answer is to go through the logs and hope they tell the whole story.
I spend much of my working life explaining hard technology to journalists. One of the hardest ideas I pitch is the zero-knowledge proof. I have come to think it is also one of the most useful ideas for anyone trying to work out how we will learn to trust AI.
It goes back to 1985, when three researchers, Shafi Goldwasser, Silvio Micali and Charles Rackoff, showed that you could prove a statement is true without revealing anything else about it. Goldwasser and Micali later won the Turing Award, computing’s highest honour, in part for that work.
Here is the way Eli Ben-Sasson, co-inventor of STARKs, a type of zero-knowledge proof, and CEO of StarkWare, often explains it. Think about walking into a bar. The bouncer needs to know you are old enough to drink. He doesn’t need your name, your address or your exact date of birth, but your ID shows him all of it. A zero-knowledge proof lets you prove the one fact that matters and keep the rest to yourself.
Until recently, these proofs were mostly used in crypto, and mostly for scale. Blockchains use them to show that a large batch of transactions was processed correctly, so the network can check one short proof instead of re-running every transaction. Checking the proof takes a fraction of the effort of doing the work again. Privacy plays a smaller part in most of these systems today, but the zero-knowledge property is still built into the technology, ready for uses that need it.
That property is what makes them interesting for AI. Two questions come up whenever a company hands work to an agent. Did the agent do what it says it did? And can anyone check that without seeing the data it used?
Today, the answer to the first question usually depends on trusting whoever runs the system. You rely on the vendor’s logs and the vendor’s word. A cryptographic proof works differently. It lets a system produce evidence that a computation ran as stated, which anyone can verify without seeing the inputs.
Researchers are already working on this, in a field sometimes called zero-knowledge machine learning. The aim is to prove that a particular model produced a particular output while keeping the model and the data private. It is early. Proving the computation inside a large neural network is still slow and expensive, and the tools are some way from everyday use.
A narrower job is already within reach. Many of the rules companies set for agents are simple and deterministic: a spending cap, an approved list of suppliers, a sign-off required above a set amount. Proving that an agent’s actions stayed inside rules like these is a small computation, and it is practical with tools available today. The direction deserves far more attention than it gets.
Take a bank using an agent to screen loan applications. A regulator wants to know the agent applied the approved criteria to every applicant. The bank doesn’t want to hand over its customers’ financial records, or the model it spent years building. A proof could show the rules were followed without disclosing either. The same logic would let a hospital show how it used AI on patient records, or let a company show an auditor that an agent stayed within its spending limits.
There is a communications lesson in this too, and it is the part I know best. When I pitch zero-knowledge technology, the maths loses people within a sentence. The bar analogy keeps them. Editors want to know what a technology lets them stop worrying about, and the analogy tells them in one breath.
AI companies could learn from that. Much of the industry’s response to the trust problem has been to ask for more trust: in its safety teams and in its testing. Those things matter. They are also what a sceptical customer, regulator or journalist is least inclined to take on faith.
“Prove it, don’t show it” is a better offer. It gives people something they can check, and it protects the data that makes companies reluctant to open up in the first place.
That 34% figure will move when people can check what their agents did. Cryptographers started building the tools for that four decades ago. The AI industry should start paying attention.
