This appendix accompanies the Summit explainer and demo. It illustrates the intended structure of the Decision Receipt, evidence identity, policy enforcement, replay, and isolation. All field names, formats, and values are illustrative concepts for evaluation — not a released schema or an assertion of production behavior. Capability labels appear against each claim.
| Field | Type | Why it matters |
|---|---|---|
| decision_id | ulid | Stable, sortable handle for the whole decision. |
| status | enum | accepted · blocked · escalated · disputed — read first. |
| participants[] | actor[] | Every model, agent, tool + version that acted, in order. |
| evidence[] | evidence_ref[] | Content-addressed refs (see §2) — answers "what did you use?" |
| transformations[] | op[] | Deterministic ops (normalize, parse) with args — reproducible. |
| policy_result | eval | Bundle id + firing clause + outcome (see §3). |
| claims[] | claim↔evidence | Each conclusion bound to supporting + conflicting evidence. |
| uncertainty | score+notes | Confidence and named conflicts — never a bare number. |
| human_action | override? | Actor, time, rationale — overrides cannot be silent. |
| verification | hash+sig | Third party confirms the receipt was not altered. |
| replay_ref | env_ref | Pointer to the reconstructable environment (see §4). |
| challenge_history[] | event[] | Append-only record of disputes and outcomes. |
| retention · marking | policy | Visibility / retention constraints travel with the record. |
Every piece of evidence is versioned, canonicalized, and content-addressed. The evidence_id is deterministic: the same bytes always resolve to the same id, and any alteration breaks the reference — the basis for both provenance and replay.
Human-authored policy is compiled into a versioned, hashed bundle. Decisions pass through a single enforcement point, so the receipt can name the exact bundle and the clause that fired.
Replay rebuilds the decision environment from the receipt, executes, and diffs the result against the sealed outcome. Divergence is surfaced, never silently overwritten.
Agents act only through explicit tool grants; every cross-boundary request is checked and recorded. Tenant data does not cross the isolation boundary.
| Threat | Response | Recorded proof |
|---|---|---|
| BLOCKEDAltered evidence | Hash mismatch → decision invalidated | expected vs actual hash |
| BLOCKEDUnauthorized tool use | Call denied at grant boundary | denied call + scope |
| BLOCKEDTenant leakage | Denied at isolation boundary | boundary + attempted scope |
| CONTAINEDPrompt injection | Instruction ignored, input quarantined | attempt captured verbatim |
| ESCALATEDUnrecorded override | Rationale required before proceeding | actor · time · rationale |
| DISPUTEDReplay divergence | Surfaced; new receipt proposed | diff of both runs |