Principles
DAR is intentionally narrow. The product is evidence—issued at action time, held under customer custody, and verifiable later. These principles protect that boundary.
Core framing
In disputes, audits, and investigations, the system is not the witness. The receipt is.
Invariants (must always be true)
- Issued at action time — emitted after an action commits (non-blocking).
- Append-only — receipts are not edited; corrections are new receipts.
- Customer custody — stored under customer control and retention.
- Independent verification — cryptographic integrity can be checked without trusting the issuing system.
- Minimal payload — references context; does not store sensitive content by default.
- Portable evidence — remains meaningful across migrations and vendors.
- Non-reinterpretation — historical receipts are never retroactively reinterpreted or invalidated.
Non-goals (what DAR will not become)
- Not monitoring — no surveillance layer, no always-on observation.
- Not decision logic — DAR does not approve, deny, score, or interpret outcomes.
- Not enforcement — DAR does not block actions or act as a gatekeeper.
- Not a system of record — source systems remain authoritative for data and state.
- Not a data lake — receipts do not store sensitive payloads by default.
Receipt neutrality
DAR follows a principle of receipt neutrality. It asserts that an action occurred, not whether it was correct, compliant, appropriate, or justified. Interpretation and judgment always occur outside the receipt.
Evidence over narrative
Narratives change. Logs are internal. DAR is an externalizable artifact that preserves facts. When the question becomes “what happened?”, DAR answers with verifiable evidence that can be placed in a timeline.
Reference, don’t retain
DAR preserves accountability without becoming a repository of private data. When context matters, receipts point to it.
What “customer custody” means
Receipts are written into storage controlled by the customer—under their retention policies and permissions. DAR may provide issuance or verification tooling, but does not become the owner of the evidence.