The Receipt Regime
Ambition must be made to counteract ambition.
— James Madison, Federalist No. 51 (1788)
The Principle
A system may coerce only via a receipt whose fields are minimally sufficient for contestation.
The word "minimum" matters. The regime does not aspire to make power benign or promise that every exercise of coercive authority will be wise or proportionate. It guarantees only that every exercise will be inspectable. You cannot contest what you cannot see, challenge what you cannot name, or appeal what was never recorded. The receipt converts invisible power into visible power: the only kind constitutionalism can govern. The five fields mirror at a constitutional level the five witness properties that govern truth.
Five Fields
A freelance translator receives a notification from her primary payment platform: her account has been restricted. She calls the support line. The agent reads from a script: "Your account has been flagged for review." What was flagged? "I'm not able to share that information." What review? "Our security team is looking into it." When will it be resolved? "We'll notify you when the review is complete." She hangs up and opens her laptop. The deposits are there but cannot be withdrawn. Her rent is due in four days. Her child's tuition payment is due in eleven days. She begins calling clients to arrange alternative payment. Two of the three clients use the same platform. They cannot help.
Five questions hang in the silence. Each corresponds to a receipt field, and each, when missing, produces a constitutional pathology that centuries of institutional theory have catalogued under different names.
Act: what was done. Not "account status changed" but the specific predicate that fired, the specific state transition imposed. A freeze is different from a restriction, different from a deprioritization, different from a flag, each with different consequences, different durations, different implications for the affected party's life. Without this field, the translator cannot evaluate whether the action was within the operator's authority. She is in the position of the subject of a lettre de cachet, the sealed letter by which the French king could imprison without trial, without charge, without disclosing the action taken. She knows she is constrained. She does not know how or why.
The naming requirement is disciplinary as well as informational: an operator that must name its act before imposing it must categorize the act, and categorization constrains future exercises. It creates a precedent the next affected party can cite.
Authority: under what rule the act was performed. Not a citation to forty thousand words of terms of service but the specific clause, the specific algorithmic threshold crossed. If the operator is unable to state the rule under which it acted in a form that a literate person can evaluate, the act was performed under discretion. Discretion unconstrained by articulable rules is the definition of arbitrary power. This is the pathology Montesquieu identified in the Ottoman sultanate: a power that acts at will, whose decisions are final because no one can determine whether a rule was followed. A rule that cannot be stated cannot be inspected, and a rule that cannot be inspected cannot be constrained. The articulability requirement converts potestas into auctoritas (raw power into legitimate authority) by requiring that power justify itself in terms the governed can evaluate.
For algorithmic governance specifically: a machine-learning model that produces a classification lacks the capacity to articulate the rule under which it acted. The receipt regime does not prohibit algorithmic decision-making. It requires that the human institution deploying the algorithm state, in human-evaluable terms, the policy the algorithm implements. An institution unable to do this does not understand its own tool, and should not be permitted to use it coercively.
Bounds: the scope and duration. Whether the freeze is total or partial, permanent or temporary, confined to one service or extended to all. Whether it reaches associated accounts, family members, business partners. Without this field, the translator must organize her life around the worst case. The English constitutional tradition developed the writ of habeas corpus precisely to address this pathology. The jailer must produce the prisoner and state the charges, including scope and duration, so the court can evaluate whether the detention is lawful. Bounds are the computational equivalent: they force the operator to state how much power it is exercising, so the exercise can be evaluated for proportionality.
Disclosure must come at the time of the action, not discovered by the affected party through collision with the world, living through the harm before learning its extent. An operator that specifies "all services, indefinitely" when the triggering event was a single suspicious transaction has disclosed its own excess, and the disclosure is available to the arbiter.
Justification: the evidence or reasoning that triggered the action. The most contested field, because operators argue, with some justice, that disclosing evidence enables evasion by bad actors. The concern is genuine. The regime's answer is calibrated transparency: full disclosure to an independent auditor, summary disclosure to the affected party, no disclosure to the public. Without this field, the translator confronts the Stasi configuration transposed from analog to digital: binding without recourse, conditions without transparency. The system knows why it acted, but the subject does not. Her protest is a cry into a void. The justification field converts the exercise of power from an assertion into an argument, and an argument can be examined, challenged, and overturned.
Appeal Path: the mechanism by which the affected party contests the action. Not a text field that accepts characters and returns an automated acknowledgment. A process with defined timelines, independent review by a party that does not work for the operator, and the power to reverse the action if the contestation succeeds. An appeal reviewed by the entity that took the original action is a request for reconsideration, structurally biased toward the original decision because the institution's identity is invested in its correctness. The appeal path must operate at a tempo the affected party can engage with: if the action takes milliseconds and the appeal takes months, what exists is autopsy, not contestation.
The appeal path is also the field most reliably omitted, and platforms are not alone in omitting it. The most detailed verification schemes yet drafted for machine systems — designs that would meter computation itself, with instrumented networks and sampled recomputation — specify the record in engineering depth and leave what a party does with a contested verdict all but unwritten. The record is the part designers find natural to build; the appeal is the part that makes the record govern conduct rather than merely observe it, and it is routinely the part deferred. A regime that builds the first without the second has produced something close to the sealed ballot box of Chapter 9, only better instrumented.
Under the receipt regime, the platform issues a receipt at the moment of restriction. Act: outbound-transfer hold. Authority: Section 9.2.c of the Platform Operating Policy, triggered by the anti-fraud model, version 4.7. Bounds: outbound transfers suspended; inbound transfers, balance inquiries, and account history unaffected; duration not to exceed fourteen business days. Justification: three outbound transfers in forty-eight hours to recipients not previously associated with this account, each exceeding the velocity threshold for accounts with her activity profile; summary provided to the account holder, full model output available to the independent auditor. Appeal Path: contestation through the Dispute Resolution Portal within five business days; independent arbiter review within three business days; if unwarranted, the hold lifts immediately and the platform bears the cost.
The translator reads the receipt. She sees the restriction was triggered by three transfers to new recipients: payments to subcontractors she hired for a large project. She submits documentation: the project contract, the subcontractor agreements, the invoices. The arbiter lifts the restriction on the third business day. Her rent payment processes on time.
The restriction still happened. She still experienced three days of anxiety. The fraud-detection system still generated a false positive. What changed is that the false positive was contestable — she knew what triggered it, could evaluate whether the trigger was appropriate, and could submit evidence to a reviewer independent of the platform and empowered to reverse the decision. The receipt did not prevent the harm. It made the harm visible, bounded, and reversible.
Without the act, you cannot name the harm. Without authority, you cannot claim the rule was exceeded. Without bounds, you cannot measure proportionality. Without justification, you cannot detect pretext. Without appeal, you cannot distinguish governance from doom.
What the Receipt Attests
What the five fields actually establish deserves stating with care, because the regime's credibility depends on never claiming more. A receipt establishes the claim and the authority: what was asserted to have been done, under which rule, within which bounds. It does not, by itself, establish that the world matched the claim. An operator who writes "outbound-transfer hold, fourteen business days" has committed to a description that can later be checked against its conduct, and that commitment is worth a great deal, but the description is not the conduct, and a regime that forgets the difference has begun to mistake its paperwork for the world the paperwork reports on.
The world enters through the evidence the receipt pins, and here a quiet hierarchy governs the rest. The operator's own log, however carefully hashed and timestamped, is testimony: sworn early, sworn precisely, but sworn by the party whose conduct is in question. A record held by an independent rail is harder to arrange. A document bearing a counterparty's signature is harder still, and a computation that any party can re-run from the recorded inputs approaches the condition of physical evidence as to the derivation, though the inputs it consumes remain only as good as their own anchors. The receipt's strength is the strength of its anchors — its grounding, to give the property its name — and where several anchors are needed before the verdict recomputes, the record is only as grounded as the weakest of them. Consider why the translator's appeal succeeded in three days rather than three months: the contract and invoices existed outside the platform and bore signatures from other hands, while manufacturing them after the fact would have required enlisting people beyond the dispute. The law has always favored such paper because forging it is dear. What she submitted were pieces of the world that had already passed through other hands.
The craft of the regime, then, is not the writing of receipts but the choosing of anchors the writer cannot forge. Where an action touches an independent system that keeps its own records, the receipt should bind to that system's record rather than to the actor's account of it, and where a harm has no ontology that any record can carry, Chapter 3 has already marked where witnessing runs out of ontology. Between those poles lies most of practical life, and there the receipt does two humbler things than proving. It compresses the dispute: the historically expensive layer of any conflict, the reconstruction of what was said and when and under whose authority, becomes checkable rather than merely arguable, so that what remains contested is narrow and nameable. And it routes the dispute: where an action passed through a chain of delegations, the receipts locate the seam where the divergence entered, and what would have been a circle of parties each pointing at the next becomes a question with an address.
The burden shifts and the assignment happens, but the record settles no one's account with the world.
Composed Acts and the Seam
A coercive act may be produced by several systems even when none contains the whole reason. A lending model supplies a score, a registry supplies a status, and a policy engine turns the combination into a denial. Each component may report its local operation accurately while the decisive convention lies between them: a category translated at one boundary, an inherited classification applied under a new rule, or a default that no component names because every component assumes it.
The receipt duty follows the act across those boundaries. Where the relevant conventions are declared in schemas, types, or published rules, the receipt should identify the seam and carry enough disclosure for an independent party to recompute the translation. “No component decided” is not an answer when the composed system used declared rules whose interaction can be surfaced. The record locates the divergence and the surviving principal remains responsible for the consequence.
The harder case is an operative rule that no component can state in contestable form. Opacity does not excuse its use. A rule that binds a person while existing nowhere the person or reviewer can inspect is secret law in computational form. The institution must either make the rule legible enough for contestation, substitute a reviewable rule, or refrain from using it for coercion.
The Bulla ActionReceipt implementation reviewed for this edition supplies a narrower engineering analogue.1 Its action records what occurred, while mandate.authority and mandate.bounds record ex ante authority and limits; diagnostic and evidence references carry the grounds and their grounding class; and remedy records challenge window, forum, and available cure. Those fields do not replace the constitutional five. They map Act to action, Authority and Bounds to mandate, Justification to the diagnostic and grounded evidence, and Appeal Path to remedy. Bulla also hashes conventions coined at a seam and distinguishes executable rules that can be recomputed from semantic rules that must be routed to an answerable forum. The constitutional argument is broader, but the names now meet without pretending the wire format proves justice.
Civic Asymmetry
The receipt regime operates under a governing principle: civic asymmetry. Power must be transparent to those it governs; persons must remain opaque to systems that cannot be held to account. The more authority you exercise, the more legible you must become. The less power you hold, the more privacy you retain.
The principle predates computation by centuries. When the English Parliament compelled the Crown to publish its expenditures while protecting the private papers of subjects from unreasonable search, it instantiated civic asymmetry in the language of its era. When the American Fourth Amendment prohibited warrantless searches while requiring that government proceedings be conducted on the public record, it drew the same line from the other direction. Transparency must flow toward accountability, and accountability attaches to the exercise of power, not to the conduct of private life.
Under current platform architecture, the asymmetry runs backward. Platforms know the user's transaction history, browsing behavior, communication patterns, location history, social connections, purchasing habits, and behavioral tendencies inferred from all of these. Users do not know the platform's decision rules, risk models, enforcement criteria, or appeal outcomes. East Germany's Ministerium für Staatssicherheit operated on the same principle: exhaustive files on the citizen's movements, correspondence, and associations, while the citizen had no access to the state's criteria for surveillance, no way to inspect her own file, no means of determining which of her neighbors had been enlisted to report on her conduct. Analog methods; digital methods; structurally identical informational architecture. That the business model is usually benign does not alter the analysis. Structures persist while motives change.
Civic asymmetry reverses the flow. Exercises of coercive authority (freezes, restrictions, score adjustments, content removals) become inspectable by those they affect and auditable by independent bodies. Private conduct remains private, beyond the platform's inspection except to the extent minimally necessary for the contracted service. A payment platform needs account numbers and transaction records. It does not need location, browsing habits, or social connections — and under civic asymmetry it does not collect what it does not need. Minimum necessary collection is not new to privacy law; what is new is its architectural enforcement. Civic asymmetry does not rely on the platform's compliance with a privacy policy it wrote and can amend. It relies on structural separation that prevents the platform from accessing data it has no legitimate need to possess.
Temporal Sovereignty
The five fields can be formally satisfied and substantively hollow. A process that freezes an account in milliseconds and offers an appeal that resolves in months has named the act, cited the authority, stated the bounds, recorded the justification, and identified the appeal path. Every field is filled. But if the harm is complete before the appeal begins, what exists is autopsy, not contestation.
Temporal sovereignty is the constitutional guarantee that certain decisions cannot execute faster than human deliberation allows. It creates zones within which coordination must slow to human tempo regardless of what is technically possible: structural requirements enforced by the protocol itself, not courtesy pauses imposed by benevolent operators.
Not all decisions slow. Most agent-to-agent coordinations proceed at computational speed because their consequences are contained within the computational domain — a supply-chain optimization reallocating inventory, a pricing adjustment responding to demand, a routing decision directing queries to the nearest server. Reversible, computational rather than embodied, requiring no human deliberation.
An automated system routes customer queries to support tiers, adjusting allocation as queue lengths change. A poor routing choice means a longer wait, and the next cycle can correct it. No constitutional receipt is required. The figures and deadlines in this example are illustrative. The same platform's fraud system freezes $47,000 in a merchant's pending settlements, preventing payroll and supplier payments. That act crosses into embodied human consequence. At the crossing point, temporal sovereignty intervenes: the system issues a receipt, notifies the merchant, and observes a deliberation window before the freeze takes full effect. An operator seeking an immediate freeze must invoke a declared emergency rule and obtain prompt independent review. That determination receives a receipt of its own.
What the Receipt Does
Tyranny is power that leaves no trace.
The receipt regime is a floor, not a ceiling. It makes power legible. A tyrant who must issue receipts can still be a tyrant, but not a silent one. Audit trails make patterns visible — a platform that freezes disproportionately many accounts belonging to a particular demographic produces receipts that disclose the disproportion. A state that exercises emergency powers beyond their intended scope produces receipts that disclose the scope creep. Receipts do not prevent abuse; they make abuse discoverable, and discoverable abuse is the only kind that institutions can correct.
The merchant whose payment rail was severed at the beginning of this book woke to a notification without an author. Under the receipt regime, he wakes to a document: the act named, the authority cited, the bounds stated, the justification summarized, the appeal path specified. The severance may still be wrong. The receipt does not make the system infallible. It makes the system answerable.
A system may coerce only via a receipt whose fields are minimally sufficient for contestation. No receipt, no legitimacy. If a system that coerces without receipts can maintain legitimacy at civilizational scale, this claim is wrong.
Notes
1. Mapping reviewed against repository revision 8f1e536, Bulla tree aa57a381a9cd55245e69015ebd62fe6e6ed52dc8, Bulla implementation version 0.43.0, and ActionReceipt schema 0.2. The pin describes the implementation reviewed for this edition; it does not make the constitutional fields part of Bulla's public wire contract. ↩