What is a Digital Action Receipt?
A Digital Action Receipt (DAR) is a signed, tamper-evident evidence artifact emitted after a digital action commits.
It exists to prove that an action happened, at a particular time, under a particular referenced context—without relying
on internal logs or vendor-controlled databases as the ultimate authority.
A DAR proves occurrence — not correctness, intent, authorization, or compliance.
DARs are evidence, not enforcement.
In disputes, the question is not “what does the system say now?” It’s “what can be proven happened then — and under what referenced conditions?” DAR makes that proof portable.
What DAR is
- Evidence of an action that committed
- Issued at action time (not reconstructed later)
- Append-only (corrections are new receipts, not edits)
- Customer-custodied (stored under customer control)
- Independently verifiable (cryptographic integrity can be checked outside the issuer)
- Minimal by design (references to context; does not default to storing sensitive payloads)
What DAR is not
- Not monitoring — no continuous surveillance layer
- Not decision logic — DAR does not approve/deny or score outcomes
- Not a compliance engine — DAR does not judge correctness or compliance
- Not enforcement — DAR does not block actions
- Not a system of record — source systems remain authoritative for data/state
- Not a data lake — receipts do not default to storing sensitive payloads
What a receipt preserves (conceptually)
A receipt preserves a defensible statement about an action and the references needed to evaluate that action later—without copying private data. The key word is references: a receipt points to context registries and records; it doesn’t replace them.
- Who/what acted (as asserted at action time: human, service, agent)
- What action committed (a stable action label)
- What the action targeted (a durable reference to the object/resource)
- When it committed (timestamp)
- How to correlate it (a stable reference that ties related receipts into a timeline)
- Which context applied (references to policy/model/config versions, when relevant)
- Integrity proof (so tampering is detectable)
Custody: where receipts live
Receipts should be stored in customer-controlled immutable storage. This preserves chain-of-custody and reduces a common dispute failure mode: the vendor controlling the authoritative evidence.
- Customer-controlled storage location and permissions
- Immutable / append-only retention and write protections
- Portable across vendors and system migrations
Verification: how proof holds up
Verification is about integrity and consistency: confirming the receipt hasn’t been altered and still matches the referenced context. Verification does not require trusting the system that issued the receipt.
- Validate integrity proof (tamper evidence)
- Confirm the receipt belongs to the customer’s evidence store
- Resolve referenced context (policy/model/config) as needed
- Render a human-readable timeline for review (audit, dispute, investigation)
Why DAR exists
DAR exists because modern systems change quickly—especially AI and automated workflows. When accountability arrives, organizations need durable evidence that survives migrations, refactors, and vendor turnover. DAR does not replace existing systems. It exists alongside them—as portable evidence.