The Receipt Regime
The Principle
A system may coerce only via a receipt whose fields are minimally sufficient for contestation.
The word "minimum" matters. The regime does not aspire to make power benign or promise that every exercise of coercive authority will be wise or proportionate. It guarantees only that every exercise will be inspectable. You cannot contest what you cannot see, challenge what you cannot name, or appeal what was never recorded. The receipt converts invisible power into visible power: the only kind constitutionalism can govern. The five fields mirror at a constitutional level the five witness properties that govern truth.
Five Fields
A freelance translator receives a notification from her primary payment platform: her account has been restricted. She calls the support line. The agent reads from a script: "Your account has been flagged for review." What was flagged? "I'm not able to share that information." What review? "Our security team is looking into it." When will it be resolved? "We'll notify you when the review is complete." She hangs up and opens her laptop. The deposits are there but cannot be withdrawn. Her rent is due in four days. Her child's tuition payment is due in eleven days. She begins calling clients to arrange alternative payment. Two of the three clients use the same platform. They cannot help.
Five questions hang in the silence. Each corresponds to a receipt field, and each, when missing, produces a constitutional pathology that centuries of institutional theory have catalogued under different names.
Act: what was done. Not "account status changed" but the specific predicate that fired, the specific state transition imposed. A freeze is different from a restriction, different from a deprioritization, different from a flag; each with different consequences, different durations, different implications for the affected party's life. Without this field, the translator cannot evaluate whether the action was within the operator's authority. She is in the position of the subject of a lettre de cachet, the sealed letter by which the French king could imprison without trial, without charge, without disclosing the action taken. She knows she is constrained. She does not know how or why.
The naming requirement is disciplinary, not merely informational: an operator that must name its act before imposing it must categorize the act, and categorization constrains future exercises; it creates a precedent the next affected party can cite.
Authority: under what rule the act was performed. Not a citation to forty thousand words of terms of service but the specific clause, the specific algorithmic threshold crossed. If the operator is unable to state the rule under which it acted, in a form that a literate person can evaluate, the act was performed under discretion; and discretion unconstrained by articulable rules is the definition of arbitrary power. This is the pathology Montesquieu identified in the Ottoman sultanate: a power that acts at will, whose decisions are final because no one can determine whether a rule was followed. A rule that cannot be stated cannot be inspected; a rule that cannot be inspected cannot be constrained. The articulability requirement converts potestas into auctoritas (raw power into legitimate authority) by requiring that power justify itself in terms the governed can evaluate.
For algorithmic governance specifically: a machine-learning model that produces a classification lacks the capacity to articulate the rule under which it acted. The receipt regime does not prohibit algorithmic decision-making. It requires that the human institution deploying the algorithm state, in human-evaluable terms, the policy the algorithm implements. An institution unable to do this does not understand its own tool, and should not be permitted to use it coercively.
Bounds: the scope and duration. Whether the freeze is total or partial, permanent or temporary, confined to one service or extended to all. Whether it reaches associated accounts, family members, business partners. Without this field, the translator must organize her life around the worst case. The English constitutional tradition developed the writ of habeas corpus precisely to address this pathology. The jailer must produce the prisoner and state the charges, including scope and duration, so the court can evaluate whether the detention is lawful. Bounds are the computational equivalent: they force the operator to state how much power it is exercising, so the exercise can be evaluated for proportionality.
Disclosure must come at the time of the action, not discovered by the affected party through collision with the world, living through the harm before learning its extent. An operator that specifies "all services, indefinitely" when the triggering event was a single suspicious transaction has disclosed its own excess, and the disclosure is available to the arbiter.
Justification: the evidence or reasoning that triggered the action. The most contested field, because operators argue, with some justice, that disclosing evidence enables evasion by bad actors. The concern is genuine. The regime's answer is calibrated transparency: full disclosure to an independent auditor, summary disclosure to the affected party, no disclosure to the public. Without this field, the translator confronts the Stasi configuration transposed from analog to digital: binding without recourse, conditions without transparency. The system knows why it acted; the subject does not. Her protest is a cry into a void. The justification field converts the exercise of power from an assertion into an argument, and an argument can be examined, challenged, and overturned.
Appeal Path: the mechanism by which the affected party contests the action. Not a text field that accepts characters and returns an automated acknowledgment. A process with defined timelines, independent review by a party that does not work for the operator, and the power to reverse the action if the contestation succeeds. An appeal reviewed by the entity that took the original action is a request for reconsideration, structurally biased toward the original decision because the institution's identity is invested in its correctness. The appeal path must operate at a tempo the affected party can engage with: if the action takes milliseconds and the appeal takes months, what exists is autopsy, not contestation.
Under the receipt regime, the platform issues a receipt at the moment of restriction. Act: outbound-transfer hold. Authority: Section 9.2.c of the Platform Operating Policy, triggered by the anti-fraud model, version 4.7. Bounds: outbound transfers suspended; inbound transfers, balance inquiries, and account history unaffected; duration not to exceed fourteen business days. Justification: three outbound transfers in forty-eight hours to recipients not previously associated with this account, each exceeding the velocity threshold for accounts with her activity profile; summary provided to the account holder, full model output available to the independent auditor. Appeal Path: contestation through the Dispute Resolution Portal within five business days; independent arbiter review within three business days; if unwarranted, the hold lifts immediately and the platform bears the cost.
The translator reads the receipt. She sees the restriction was triggered by three transfers to new recipients: payments to subcontractors she hired for a large project. She submits documentation: the project contract, the subcontractor agreements, the invoices. The arbiter lifts the restriction on the third business day. Her rent payment processes on time.
The restriction still happened. She still experienced three days of anxiety. The fraud-detection system still generated a false positive. What changed is that the false positive was contestable — she knew what triggered it, could evaluate whether the trigger was appropriate, and could submit evidence to a reviewer independent of the platform and empowered to reverse the decision. The receipt did not prevent the harm. It made the harm visible, bounded, and reversible.
Without the act, you cannot name the harm. Without authority, you cannot claim the rule was exceeded. Without bounds, you cannot measure proportionality. Without justification, you cannot detect pretext. Without appeal, you cannot distinguish governance from doom.
Civic Asymmetry
The receipt regime operates under a governing principle: civic asymmetry. Power must be transparent to those it governs; persons must remain opaque to systems that cannot be held to account. The more authority you exercise, the more legible you must become. The less power you hold, the more privacy you retain.
The principle predates computation by centuries. When the English Parliament compelled the Crown to publish its expenditures while protecting the private papers of subjects from unreasonable search, it instantiated civic asymmetry in the language of its era. When the American Fourth Amendment prohibited warrantless searches while requiring that government proceedings be conducted on the public record, it drew the same line from the other direction. Transparency must flow toward accountability, and accountability attaches to the exercise of power, not to the conduct of private life.
Under current platform architecture, the asymmetry runs backward. Platforms know the user's transaction history, browsing behavior, communication patterns, location history, social connections, purchasing habits, and behavioral tendencies inferred from all of these. Users do not know the platform's decision rules, risk models, enforcement criteria, or appeal outcomes. East Germany's Ministerium für Staatssicherheit operated on the same principle: exhaustive files on the citizen's movements, correspondence, and associations, while the citizen had no access to the state's criteria for surveillance, no way to inspect her own file, no means of determining which of her neighbors had been enlisted to report on her conduct. Analog methods; digital methods; structurally identical informational architecture. That the business model is usually benign does not alter the analysis. Structures persist while motives change.
Civic asymmetry reverses the flow. Exercises of coercive authority (freezes, restrictions, score adjustments, content removals) become inspectable by those they affect and auditable by independent bodies. Private conduct remains private, beyond the platform's inspection except to the extent minimally necessary for the contracted service. A payment platform needs account numbers and transaction records. It does not need location, browsing habits, or social connections — and under civic asymmetry it does not collect what it does not need. Minimum necessary collection is not new to privacy law; what is new is its architectural enforcement. Civic asymmetry does not rely on the platform's compliance with a privacy policy it wrote and can amend. It relies on structural separation that prevents the platform from accessing data it has no legitimate need to possess.
Temporal Sovereignty
The five fields can be formally satisfied and substantively hollow. A process that freezes an account in milliseconds and offers an appeal that resolves in months has named the act, cited the authority, stated the bounds, recorded the justification, and identified the appeal path. Every field is filled. But if the harm is complete before the appeal begins, what exists is autopsy, not contestation.
Temporal sovereignty is the constitutional guarantee that certain decisions cannot execute faster than human deliberation allows. It creates zones within which coordination must slow to human tempo regardless of what is technically possible: structural requirements enforced by the protocol itself, not courtesy pauses imposed by benevolent operators.
Not all decisions slow. Most agent-to-agent coordinations proceed at computational speed because their consequences are contained within the computational domain — a supply-chain optimization reallocating inventory, a pricing adjustment responding to demand, a routing decision directing queries to the nearest server. Reversible, computational rather than embodied, requiring no human deliberation.
The distinction is precise. An automated system routes customer queries to different support tiers, adjusting allocation every thirty seconds as queue lengths change. Suboptimal routing means a slightly longer wait; the next cycle corrects it. No receipt required, no temporal delay imposed. The same platform's fraud-detection system flags a merchant's account and initiates a freeze on $47,000 in pending settlements: the last two weeks of his business revenue. He cannot pay suppliers, cannot make payroll, cannot meet the loan payment due on Thursday. This decision crosses the membrane into embodied human consequence. At the crossing point, temporal sovereignty intervenes: the system issues a receipt, notifies the merchant, and observes a constitutionally mandated deliberation window before the freeze takes full effect. An operator that wants to freeze instantly must obtain a provisional exception from an independent arbiter, who determines whether the delay would cause harm greater than the freeze itself. That determination is recorded in a receipt of its own.
What the Receipt Does
The receipt regime is a floor, not a ceiling. It makes power legible. A tyrant who must issue receipts can still be a tyrant, but not a silent one. Audit trails make patterns visible — a platform that freezes disproportionately many accounts belonging to a particular demographic produces receipts that disclose the disproportion. A state that exercises emergency powers beyond their intended scope produces receipts that disclose the scope creep. Receipts do not prevent abuse; they make abuse discoverable, and discoverable abuse is the only kind that institutions can correct.
The merchant whose payment rail was severed at the beginning of this book woke to a notification without an author. Under the receipt regime, he wakes to a document: the act named, the authority cited, the bounds stated, the justification summarized, the appeal path specified. The severance may still be wrong. The receipt does not make the system infallible. It makes the system answerable.
A system may coerce only via a receipt whose fields are minimally sufficient for contestation. No receipt, no legitimacy. If a system that coerces without receipts can maintain legitimacy at civilizational scale, this claim is wrong.