Log AI agent runs in hash-chained receipts with OpenAI and Data Tables

Description

Quick overview
This workflow exposes webhook endpoints to run an OpenAI-powered agent per client, log each run into an n8n Data Table as a SHA-256 hash chain, and email daily integrity reports and anchors, with an additional verification endpoint clients can query.

How it works
Receives a POST webhook request with client_id and prompt, validates the client and prompt rules, and rejects invalid requests immediately.
Runs a LangChain AI agent using OpenAI Chat and an optional Calculator tool to generate an answer or capture an agent failure.
Builds a log entry that hashes the prompt and answer (optionally storing clipped text), counts model/tool calls, and sets the outcome as ok, refused, or error.
Reads the latest entry for that client from the agent_run_log n8n Data Table, links the new entry to the previous hash, computes a new entry_hash, and appends it to the table.
Re-reads the just-written area to confirm the entry is the canonical next sequence (retrying with a short backoff on collisions), then returns the answer or error along with a receipt containing seq and entry_hash.
If the run cannot be reliably logged, withholds the agent output, returns HTTP 503 to the caller, and emails the owner with the failure details.
Runs daily on a schedule to recompute and verify every client’s hash chain in agent_run_log, stores new anchors in agent_run_anchors, and emails the owner a report (or a failure notice if the tables can’t be read).
Receives a GET webhook request for verification, loads that client’s log and anchors from the Data Tables, verifies chain integrity and optional receipt fields, and returns a hash-and-count-only status response.

Setup
Create two n8n Data Tables named agent_run_log and agent_run_anchors with the columns and data types expected by the workflow (keeping logged_at and anchored_at as strings).
Add an OpenAI credential for the OpenAI Chat model used by the LangChain agent.
Configure Header Auth for both webhooks and update your calling app to send the required header and payload/query parameters.
Add SMTP/Email credentials for the email send steps and set owner_email and sender_email in both Settings sections.
Review and adjust logging and guardrail settings (allowed/paused clients, prompt length, retries, and whether to store prompt/answer text) before activating the workflow.

Additional info
Who's it for
Agencies and freelancers who let an AI agent draft replies for clients but need the client's yes before anything is sent. The approver needs no n8n account.

How it works
Your helpdesk or another workflow POSTs the customer's message to the webhook. An AI Agent drafts the reply in the client's voice, and the draft gets a SHA-256 fingerprint. The approver gets an email with a link to a short form: approve, edit and approve, request changes or reject. Opening the link only shows the form, so link scanners can't approve. No answer by the deadline means expired, never approved. Every decision is stored in a Data table. Just before sending, the text is fingerprinted again; if it differs from the approved text, nothing is sent.

How to set up
Create the Data tables approval_clients and approval_requests (columns in the sticky note).
Add OpenAI, SMTP and Header Auth credentials.
Fill in Settings: sender, deadline, reminder, revision rounds and model.
Publish the workflow and send a test request with curl.

Requirements
n8n with Data tables, an OpenAI API key and SMTP.

How to customize
Replace "Send the approved reply" with your own step (Gmail, a helpdesk reply, a CMS post) and keep the fingerprint check in front of it.

Prepared with AI assistance. Editorial responsibility: PowerQuant ApS.