The Receipt Regime
Aa
Ambition must be made to counteract ambition.
— James Madison, Federalist No. 51 (1788)
The Principle
An institution exercising consequential power owes those it affects an inspectable account of the act and an effective means to challenge it.
The regime specifies duties that a receipt can help discharge: disclose what was done, identify the authority and bounds, make the evidentiary grounds examinable, and provide a route to contest and remedy. Five completed fields cannot make an unlawful act legitimate or a powerless appeal effective. Their value lies in the work the affected person and an independent forum can actually perform with them.
Five Fields
Consider a hypothetical freelance translator who receives a notification from her primary payment platform: her account has been restricted. She calls the support line. The agent reads from a script: "Your account has been flagged for review." What was flagged? "I'm not able to share that information." What review? "Our security team is looking into it." When will it be resolved? "We'll notify you when the review is complete." She hangs up and opens her laptop. The deposits are there but cannot be withdrawn. Her rent is due in four days. Her child's tuition payment is due in eleven days. She begins calling clients to arrange alternative payment. Two of the three clients use the same platform. They cannot help.
Five questions hang in the silence. Each corresponds to a receipt field, and each, when missing, produces a constitutional pathology that centuries of institutional theory have catalogued under different names.
Act: what was done. Not "account status changed" but the specific predicate that fired, the specific state transition imposed. A freeze is different from a restriction, different from a deprioritization, different from a flag, each with different consequences, different durations, different implications for the affected party's life. Without this field, the translator cannot evaluate whether the action was within the operator's authority. She is in the position of the subject of a lettre de cachet, the sealed letter by which the French king could imprison without trial, without charge, without disclosing the action taken. She knows she is constrained. She does not know how or why.
The naming requirement is disciplinary as well as informational: an operator that must name its act before imposing it must categorize the act, and categorization constrains future exercises. It creates a precedent the next affected party can cite.
Authority: under what rule the act was performed. Not a citation to forty thousand words of terms of service but the specific clause, the specific algorithmic threshold crossed. If the operator is unable to state the rule under which it acted in a form that a literate person can evaluate, the act was performed under discretion. Discretion unconstrained by articulable rules is the definition of arbitrary power. This is the pathology Montesquieu identified in the Ottoman sultanate: a power that acts at will, whose decisions are final because no one can determine whether a rule was followed. A rule that cannot be stated cannot be inspected, and a rule that cannot be inspected cannot be constrained. Stating the rule makes its use open to examination. The institution must also possess the authority it invokes; the statement does not confer it.
For algorithmic governance specifically: a machine-learning model that produces a classification lacks the capacity to articulate the rule under which it acted. The receipt regime does not prohibit algorithmic decision-making. It requires that the human institution deploying the algorithm state, in human-evaluable terms, the policy the algorithm implements. An institution unable to do this does not understand its own tool, and should not be permitted to use it coercively.
Bounds: the scope and duration. Whether the freeze is total or partial, permanent or temporary, confined to one service or extended to all. Whether it reaches associated accounts, family members, business partners. Without this field, the translator must organize her life around the worst case. The English constitutional tradition developed the writ of habeas corpus precisely to address this pathology. The jailer must produce the prisoner and state the charges, including scope and duration, so the court can evaluate whether the detention is lawful. Bounds are the computational equivalent: they force the operator to state how much power it is exercising, so the exercise can be evaluated for proportionality.
Disclosure must come at the time of the action, not discovered by the affected party through collision with the world, living through the harm before learning its extent. An operator that specifies "all services, indefinitely" when the triggering event was a single suspicious transaction has disclosed its own excess, and the disclosure is available to the arbiter.
Evidence: the grounds on which the action rests, together with the reasoning connecting them to it. The most contested field, because operators argue, with some justice, that disclosing evidence enables evasion by bad actors. The concern is genuine. The regime requires disclosure sufficient for effective challenge. Protected evidence may require confidential independent examination and a usable summary for the affected party; confidentiality must not conceal the grounds from every person able to test them. Without this field, the translator confronts the Stasi configuration transposed from analog to digital: binding without recourse, conditions without transparency. The system knows why it acted, but the subject does not. Her protest is a cry into a void. The evidence field converts the exercise of power from an assertion into an argument, and an argument can be examined, challenged, and overturned.
Contest: the mechanism by which the affected party challenges the action and can obtain a remedy. Not a text field that accepts characters and returns an automated acknowledgment. A process with defined timelines, independent review by a party that does not work for the operator, and the power to reverse the action if the contestation succeeds. An appeal reviewed by the entity that took the original action is a request for reconsideration, structurally biased toward the original decision because the institution's identity is invested in its correctness. The appeal path must operate at a tempo the affected party can engage with: if the action takes milliseconds and the appeal takes months, what exists is autopsy, not contestation.
The contest field is also the field most reliably omitted, and platforms are not alone in omitting it. The most detailed verification schemes yet drafted for machine systems — designs that would meter computation itself, with instrumented networks and sampled recomputation — specify the record in engineering depth and leave what a party does with a contested verdict all but unwritten. The record is the part designers find natural to build; the appeal is the part that makes the record govern conduct rather than merely observe it, and it is routinely the part deferred. A regime that builds the first without the second has produced something close to the sealed ballot box of Chapter 9, only better instrumented.
Under the receipt regime, the platform issues a receipt at the moment of restriction. Act: outbound-transfer hold. Authority: Section 9.2.c of the Platform Operating Policy, triggered by the anti-fraud model, version 4.7. Bounds: outbound transfers suspended; inbound transfers, balance inquiries, and account history unaffected; duration not to exceed fourteen business days. Evidence: three outbound transfers in forty-eight hours to recipients not previously associated with this account, each exceeding the velocity threshold for accounts with her activity profile; summary provided to the account holder, full model output available to the independent auditor. Contest: contestation through the Dispute Resolution Portal within five business days; independent arbiter review within three business days; if unwarranted, the hold lifts immediately and the platform bears the cost.
The translator reads the receipt. She sees the restriction was triggered by three transfers to new recipients: payments to subcontractors she hired for a large project. She submits documentation: the project contract, the subcontractor agreements, the invoices. The arbiter lifts the restriction on the third business day. Her rent payment processes on time.
The restriction still happened. She still experienced three days of anxiety. The fraud-detection system still generated a false positive. What changed is that the false positive was contestable — she knew what triggered it, could evaluate whether the trigger was appropriate, and could submit evidence to a reviewer independent of the platform and empowered to reverse the decision. The receipt did not prevent the harm. It made the harm visible, bounded, and reversible.
Without the act, you cannot name the harm. Without authority, you cannot claim the rule was exceeded. Without bounds, you cannot measure proportionality. Without evidence, you cannot detect pretext. Without contest, you cannot distinguish governance from doom.
What the Receipt Attests
What the five fields actually establish deserves stating with care, because the regime's credibility depends on never claiming more. A receipt establishes the claim and the authority: what was asserted to have been done, under which rule, within which bounds. It does not, by itself, establish that the world matched the claim. An operator who writes "outbound-transfer hold, fourteen business days" has committed to a description that can later be checked against its conduct, and that commitment is worth a great deal, but the description is not the conduct, and a regime that forgets the difference has begun to mistake its paperwork for the world the paperwork reports on.
The world enters through the evidence the receipt identifies. An operator’s log can establish an event its system recorded while leaving the accuracy of the inputs unsettled. An independent rail can corroborate a transfer. A signature can support attribution without proving the truth of everything signed. Recomputing a result can test its derivation while leaving the recorded observation beyond the examiner’s knowledge. These sources answer different questions. Their force depends on coverage, independence, and what the particular claim requires. In the translator’s example, the contracts and invoices let the reviewer examine the reason for the transfers instead of relying solely on the platform’s classification.
The craft of the regime, then, is not the writing of receipts but the provision of grounds that can survive examination independent of the writer. Where an action touches an independent system that keeps its own records, the receipt should bind to that system's record rather than to the actor's account of it, and where a harm has no ontology that any record can carry, Chapter 3 has already marked where witnessing runs out of ontology. Between those poles lies most of practical life, and there the receipt does two humbler things than proving. It compresses the dispute: the historically expensive layer of any conflict, the reconstruction of what was said and when and under whose authority, becomes checkable rather than merely arguable, so that what remains contested is narrow and nameable. And it routes the dispute: where an action passed through a chain of delegations, the receipts locate the seam where the divergence entered, and what would have been a circle of parties each pointing at the next becomes a question with an address.
The burden shifts and the assignment happens, but the record settles no one's account with the world.
Composed Acts and the Seam
A coercive act may be produced by several systems even when none contains the whole reason. A lending model supplies a score, a registry supplies a status, and a policy engine turns the combination into a denial. Each component may report its local operation accurately while the decisive convention lies between them: a category translated at one boundary, an inherited classification applied under a new rule, or a default that no component names because every component assumes it.
The receipt duty follows the act across those boundaries. Where the relevant conventions are declared in schemas, types, or published rules, the receipt should identify the seam and carry enough disclosure for an independent party to recompute the translation. “No component decided” is not an answer when the composed system used declared rules whose interaction can be surfaced. The record locates the divergence and the surviving principal remains responsible for the consequence.
The harder case is an operative rule that no component can state in contestable form. Opacity does not excuse its use. A rule that binds a person while existing nowhere the person or reviewer can inspect is secret law in computational form. The institution must either make the rule legible enough for contestation, substitute a reviewable rule, or refrain from using it for coercion.
The Bulla ActionReceipt implementation reviewed for this edition supplies a narrower engineering analogue.1 Its action records what occurred, while mandate.authority and mandate.bounds record ex ante authority and limits; diagnostic and evidence references carry the grounds and their grounding class; and remedy records challenge window, forum, and available cure. Those fields do not replace the constitutional five. They map Act to action, Authority and Bounds to mandate, Evidence to the diagnostic and grounded evidence, and Contest to remedy. The older labels Justification and Appeal Path remain identifiable in the dated constitutional materials; this crosswalk does not amend their text or the pinned wire format. Bulla also hashes conventions coined at a seam and distinguishes executable rules that can be recomputed from semantic rules that must be routed to an answerable forum. The constitutional argument is broader, but the names now meet without pretending the wire format proves justice.
Civic Asymmetry
The receipt regime operates under a governing principle: civic asymmetry. Power must be transparent to those it governs; persons must remain opaque to systems that cannot be held to account. The more authority you exercise, the more legible you must become. The less power you hold, the more privacy you retain.
The principle draws together two constitutional commitments: public authority must answer for its conduct, and private people must be protected against unjustified intrusion. The Fourth Amendment’s protection against unreasonable searches and seizures addresses the latter. A separate institutional duty is needed to make the exercise of public power inspectable. Neither commitment can stand in for the other.
Under current platform architecture, the asymmetry runs backward. Platforms know the user's transaction history, browsing behavior, communication patterns, location history, social connections, purchasing habits, and behavioral tendencies inferred from all of these. Users do not know the platform's decision rules, risk models, enforcement criteria, or appeal outcomes. East Germany's Ministerium für Staatssicherheit operated on the same principle: exhaustive files on the citizen's movements, correspondence, and associations, while the citizen had no access to the state's criteria for surveillance, no way to inspect her own file, no means of determining which of her neighbors had been enlisted to report on her conduct. Analog methods; digital methods; structurally identical informational architecture. That the business model is usually benign does not alter the analysis. Structures persist while motives change.
Civic asymmetry reverses the flow. Exercises of coercive authority (freezes, restrictions, score adjustments, content removals) become inspectable by those they affect and auditable by independent bodies. Private conduct remains private, beyond the platform's inspection except to the extent minimally necessary for the contracted service. A payment platform needs account numbers and transaction records. It does not need location, browsing habits, or social connections — and under civic asymmetry it does not collect what it does not need. Minimum necessary collection is not new to privacy law; what is new is its architectural enforcement. Civic asymmetry does not rely on the platform's compliance with a privacy policy it wrote and can amend. It relies on structural separation that prevents the platform from accessing data it has no legitimate need to possess.
Temporal Sovereignty
The five fields can be formally satisfied and substantively hollow. A process that freezes an account in milliseconds and offers an appeal that resolves in months has named the act, cited the authority, stated the bounds, recorded the evidence, and identified the contest process. Every field is filled. But if the harm is complete before the appeal begins, what exists is autopsy, not contestation.
Temporal sovereignty is the constitutional guarantee that certain decisions cannot execute faster than human deliberation allows. It creates zones within which coordination must slow to human tempo regardless of what is technically possible: structural requirements enforced by the protocol itself, not courtesy pauses imposed by benevolent operators.
Not all decisions slow. Most agent-to-agent coordinations proceed at computational speed because their consequences are contained within the computational domain — a supply-chain optimization reallocating inventory, a pricing adjustment responding to demand, a routing decision directing queries to the nearest server. Reversible, computational rather than embodied, requiring no human deliberation.
An automated system routes customer queries to support tiers, adjusting allocation as queue lengths change. A poor routing choice means a longer wait, and the next cycle can correct it. No constitutional receipt is required. The figures and deadlines in this example are illustrative. The same platform's fraud system freezes $47,000 in a merchant's pending settlements, preventing payroll and supplier payments. That act crosses into embodied human consequence. At the crossing point, temporal sovereignty intervenes: the system issues a receipt, notifies the merchant, and observes a deliberation window before the freeze takes full effect. An operator seeking an immediate freeze must invoke a declared emergency rule and obtain prompt independent review. That determination receives a receipt of its own.
What the Receipt Does
Power must leave evidence against itself.
The receipt regime is a floor, not a ceiling. It makes power legible. A tyrant who must issue receipts can still be a tyrant, but not a silent one. Audit trails make patterns visible — a platform that freezes disproportionately many accounts belonging to a particular demographic produces receipts that disclose the disproportion. A state that exercises emergency powers beyond their intended scope produces receipts that disclose the scope creep. Receipts do not prevent abuse; they make abuse discoverable, and discoverable abuse is the only kind that institutions can correct.
The merchant whose payment rail was severed at the beginning of this book woke to a notification without an author. Under the receipt regime, he wakes to a document: the act named, the authority cited, the bounds stated, the justification summarized, the appeal path specified. The severance may still be wrong. The receipt does not make the system infallible. It makes the system answerable.
The institution must substantiate its exercise of power and make an effective challenge possible. A receipt serves those duties; filling its fields does not discharge them.
Notes
1. Mapping reviewed against repository revision 8f1e536, Bulla tree aa57a381a9cd55245e69015ebd62fe6e6ed52dc8, Bulla implementation version 0.43.0, and ActionReceipt schema 0.2. The pin describes the implementation reviewed for this edition; it does not make the constitutional fields part of Bulla's public wire contract. ↩