One sealed packet per consequential action. Seven fields, and a hash link that makes editing the past visible.
actor
who or what took the action
The agent identity, and the person or authority it acted for.
┃
The action as requested: send, spend, sign, change, delegate.
┃
policy
which rule applied
The specific policy the gate evaluated, by version.
┃
verdict
allow · escalate · block
What the deny-by-default gate returned, and who decided on escalation.
┃
evidence
what the decision saw
References to the reviewed inputs, by digest, never by pasting private content.
┃
prev_hash
link to the receipt before
The cryptographic link that makes the chain tamper-evident.
┃
hash
seal of this receipt
Recomputable by anyone. Change one byte and the chain breaks, visibly, here.
THE CHAIN
receipt n-2→
receipt n-1→
receipt n→
altered ⇢ hashes stop matching
A third party can recompute the chain, confirm it is intact, and replay the decisions independently. The break does not hide; it shows exactly where.