Decision receipts for agent authorization

A decision receipt captures the evaluated request, authority and policy state, outcome and reason at a particular time; it is not proof that the downstream action happened.

01 / The operating case

What changes in a real workflow?

An incident responder needs to explain why an agent attempted to isolate a host during an alert and whether that isolation actually occurred.

Trace the authority boundary
  1. 01Authority origin
  2. 02Task and grant
  3. 03Current decision
  4. 04Observed outcome

02 / Decision contract

What the executor must check

Create a receipt when the authority decision is made, with a stable correlation ID. Bind it to principal, task, originating grant, exact operation, target, key parameters, policy version and decision time. Record the executor attempt and observed host state separately.

InputPrincipal · task · action · target
DecisionGrant ancestry · policy · current state
ResultEnforce · record · verify outcome

03 / Failure and evidence

What goes wrong, and what can be proven?

Failure mode

A log line reading “ALLOW” is later presented as evidence that the host was isolated, or a mutable policy hides what rules applied at the time.

Evidence to retain

Store the decision receipt with integrity controls, then correlate it to execution and observation records with explicit unknown and partial states.

04 / Canonical scope

Why this reference stands alone

Execution receipts own the attempted effect; this page owns the permission decision’s inputs, provenance and explanation.

Implementation review / distinct boundary

An ALLOW is a reasoned permission, not a success event.

Keep three records distinct: the decision at the authority boundary, the executor attempt, and the observed resulting state. The first explains why a request was allowed or denied under a particular policy and grant. The second says whether the protected system attempted the effect. The third, when independently available, says what changed. A single success flag cannot carry all three meanings.

Three separate evidence envelopes
DECISION: request digest / grant / policy / ALLOW
EXECUTION: attempted operation / provider response
OBSERVATION: source / observed state / time
UNKNOWN is valid until reconciliation
01

Reproduce

Retain normalized inputs, grant references and policy version sufficient to explain the decision without storing secrets.

02

Correlate

Use a stable correlation identifier across decision, execution and observation records.

03

Preserve uncertainty

Represent timeouts, partial writes and unverified outcomes explicitly instead of manufacturing a success or failure.

Source context: primary specification or guidance ↗. The worked test and mapping are ProofGrid analysis.

Continue with the runtime authorization library for neighboring decision and execution questions.

Architecture field test

A decision receipt explains permission, not execution

What did the policy service actually decide?

Decision path for this question
  1. 01Canonicalize action request
  2. 02Evaluate grant and policy version
  3. 03Record verdict and reason
  4. 04Link separate executor receipt

Work the boundary

A payment policy allows $8,400 to vendor V-8 under invoice I-42. The receipt records those values and the policy version. If the payment API later times out, the decision remains ALLOW but the execution state is UNKNOWN until reconciled.

Decision contract and failure case
Required factsDecision ID, request digest, principal, task, grant path, target, policy/context version, verdict and expiry.
Allow only whenThe receipt binds an ALLOW to one exact request and the executor checks it before use.
Deny whenA receipt is replayed for different arguments or treated as proof that the target changed.

Break the assumption

Modify only the beneficiary on the queued request while retaining the decision ID. The executor must compare the digest and reject. Then drop the provider response and check that the receipt is not rewritten as a completed payment.

Design tradeoff

A useful receipt needs enough detail to explain a denial without leaking secrets. Stable identifiers and selective redaction are safer than storing raw tokens or full financial payloads.

For a decision receipt explains permission, not execution, consult NIST NCCoE agent identity and authorization concept. This worked decision and negative test are ProofGrid analysis.

Continue with Execution receipts.

Primary references

Read the underlying material

Architecture discussion

Choose one consequential action and make its boundary explicit.

Request a Conversation