System boundaries & non-goals
Digital Action Receipts are intentionally constrained. This page states what DARs do — and what they explicitly do not do. The purpose is clarity: receipts remain neutral artifacts that record occurrence and support integrity verification later, independent of representation or explanation.
In scope
The minimum commitments that define the primitive.
When a digital system takes a Digital Action, a Digital Action Receipt may be generated contemporaneously with that action.
A receipt provides a stable reference identifier and integrity information sufficient to support later verification.
Receipts are stored in an append-only record sequence in which previously stored receipts are not modified or removed.
Verification confirms whether a receipt has been altered (integrity confirmed vs mismatch detected) — nothing more.
Explicit non-goals
These are intentionally excluded to preserve neutrality and avoid turning receipts into a monitoring or enforcement product.
A receipt does not prove that an action was correct, appropriate, compliant, or desirable. It records occurrence only.
Receipts do not provide explanation, rationale, model reasoning, decision justification, or human intent interpretation.
Receipts do not permit/deny actions, apply rules, trigger approvals, or function as an authorization layer.
DARs do not provide dashboards, alerting, behavioral scoring, performance monitoring, or surveillance.
DARs coexist with logs, metrics, audits, and system records. They provide an independent reference artifact, not a replacement.
Boundary of responsibility
The boundary is deliberate: the originating system is responsible for deciding and acting; the receipt system is responsible for recording occurrence and verifying integrity later.
- Defines policies, rules, workflows, and models.
- Determines whether and how an action occurs.
- Maintains operational records (logs, audits, case records).
- Generates a receipt at the moment of action.
- Stores receipts in an append-only record sequence.
- Supports integrity verification by reference.
What “verification” means here
Verification is intentionally narrow. It is the ability to confirm that a receipt has not been altered since issuance.
- Integrity confirmed: the receipt matches the stored record.
- Mismatch detected: the receipt or associated integrity information does not match.
Optional extension boundary
Event-triggered receipts are a separate extension pattern. It introduces an event-triggering system that determines when to trigger receipt generation, while the receipt service remains responsible for generating the receipt independently.
Observes signals/state over time, determines when a receipt-worthy event has occurred, and emits a trigger signal at a trigger moment.
Generates the Digital Action Receipt when invoked. It does not perform event detection or decide when to trigger.