Authority boundary
A receipt is evidence, not approval
A receipt can look official enough to end a discussion: accepted, timestamped, signed by a system, stored in a database. But none of those properties answers the human question: “Was this action allowed?”
Three records, three different questions
Suppose a team is preparing a production configuration change.
- Human decision: Maya approves only change
cfg-42, for the canary environment, before 16:00, with production rollout explicitly denied. - Execution report: a worker reports that it attempted the canary change and returned logs and observed state.
- Consumption receipt: the owner system records that successor
run-9won one local claim on the exact decision and scope before its expiry.
The decision records authority. The report describes attempted work and returned evidence. The receipt records admission of a claim. Swapping their meanings creates approval theater: a system-generated fact starts masquerading as a human grant.
What the candidate receipt binds
The HACP v0.3-candidate consumption-receipt schema carries references to the exact decision, request, approved action, task packet, successor, scope, claim order, expiry, status evidence, and start evidence. That structure can make a local admission claim inspectable and can expose splicing or scope expansion.
It still cannot bootstrap trust. A receipt URI or self-asserted “accepted” field does not prove that the issuer was entitled to admit work. Current expiry or revocation may require trusted readback outside the record. And an admitted claim is not evidence that a cloud provider executed a call or that a real-world effect happened once.
Keep the nouns honest
| Artifact | Useful evidence | Not a substitute for |
|---|---|---|
| Human decision | Who chose what, against which exact request, scope, and consequences. | Proof that execution occurred. |
| Agent report | What was attempted, returned evidence, and observed boundary conditions. | Approval, completion, or merge readiness. |
| Consumption receipt | Which exact claim was admitted under a declared local rule. | Human authority or exactly-once external effects. |
| Transport acknowledgement | That a transport accepted or delivered bytes under its own semantics. | Agent comprehension, execution, or approval. |
What this does not prove
- HACP does not create organizational authority or decide who may approve risk.
- The candidate does not define provider-issued receipts.
- A receipt does not prove distributed consensus, cross-store atomicity, or exactly-once external effects.
- An agent report does not prove completion merely because it validates.
- Transport acknowledgement does not prove that an agent read or understood the request.
Inspect the sequence
The public success fixtures show the distinction directly: human decision, consumption receipt, and agent report. The proof boundary explains the same rule without protocol vocabulary.