The receipt must travel

By the time anyone asks what happened, the decision has usually crossed a border. A vendor's system scored it and a buyer's system acted on it. An agent proposed and a person approved. One institution decided and another inherited the consequence. At each of those crossings, something quiet happens to the record: it stops at the door. The party on the near side keeps an account of what it sent; the party on the far side keeps an account of what it received; and no one keeps an account of the crossing itself, because the crossing belonged to neither of them. The decision moved. The record stayed home.

We have spent a lot of effort arguing that a decision needs a record — that an output without its sources is an assertion, that a call without contemporaneous evidence cannot be reconstructed, that a right to contest is empty without something to contest from. All of that assumes a single keeper: one system, one institution, one custodian who either kept the record or did not. But the decisions that matter most rarely live inside one keeper anymore. They are assembled across a chain of systems and organizations, each doing a bounded, reasonable piece, and the failure that follows is not a failure of any one party's record-keeping. It is a failure between record-keepings. And you cannot cross-examine a between.

This is the trap of the seam. Each party's record is locally true and locally complete. The vendor can show exactly what it sent. The buyer can show exactly what it received. The agent can show exactly what it recommended. Every account is honest, and every account is a fragment, and the fragments were never designed to be joined. So when the consequence lands on a real person and they ask to see how the decision was actually made, they are handed several innocent halves that do not add up to a whole. Nobody hid anything. The whole story simply belongs to no one.

Existence is not the test. Travel is.

The reflex, once you notice the gap, is to demand better records at each station — a fuller log on the vendor's side, a tighter one on the buyer's. That helps, and it misses the point. You can improve every local record to perfection and still lose the decision at the seam, because the missing thing was never inside a station. It was the continuity across stations. A record can be complete on both sides of a boundary and still fail, if the two sides cannot be shown to be about the same event, in the same terms, sealed the same way.

So the test of a decision receipt is not only whether it exists. It is whether it travels. Whether the record crosses the boundary with the decision it describes — sealed at the origin, carried across the handoff, and still readable and checkable when it arrives in someone else's hands. A receipt that cannot travel is a receipt that expires at the door. It documents the decision right up to the moment the decision becomes someone else's problem, and then goes silent exactly where the accountability was supposed to continue.

Accountability that stops at the border was never accountability. It was jurisdiction.

That distinction is the whole essay. Jurisdiction is what an institution has over its own interior: authority to act, and a duty to keep its own house in order. Accountability is something larger and more demanding — it has to follow the consequence, and the consequence does not respect the border. When we build systems whose records end precisely where their authority ends, we have built for jurisdiction and called it accountability. The affected person does not experience a chain of well-kept interiors. They experience one decision that happened to them, and they are owed a record of that decision as a whole, not a stack of jurisdictions that each stop politely at their own edge.

What it means to make a receipt travel

A traveling receipt is not an exotic thing; it is a few plain properties held together. It is sealed at origin, so the account of what was decided and on what basis is fixed at the moment of the decision, before anyone downstream knows it will matter. It is carried across the handoff, so when the decision crosses from one system or party to the next, its record crosses with it rather than being reconstructed later from each side's leftovers. And it is checkable on the far side, so the party who inherits the decision can verify the record against their own copy of what they received, and a stranger later can lay the two halves over each other and see that they describe one event, not two hopeful approximations of it.

The practical demands that fall out of this are unglamorous and specific, and they belong in contracts and interfaces, not in good intentions. That a record be delivered with each consequential action across a boundary, not promised on request afterward. That the receiving party be able to replay the decision against its own held copy of the inputs, rather than taking the sending party's word that the inputs were what they say. That the record be portable and, where the relationship is consequential enough, escrowed — so that it survives the vendor being replaced, the contract ending, or the system being retired, all of which are exactly the moments when someone finally needs to read it. None of that is asking any single party to keep a better diary. It is asking the boundary itself to carry a record, which is the one place no one owns and therefore the one place no one instruments.

The reason this is worth naming now, plainly, is that automation is multiplying the seams. Every new system that hands its output to the next system adds a border, and each border is a place the record can quietly stop. We are assembling long chains of automated decision-making and instrumenting each link while leaving the couplings dark, and then acting surprised when a consequence cannot be traced across a chain we built precisely so that no single link would have to hold the whole thing. My disclosure belongs here: I build in this space, and my company works on decisions that carry their own record forward across exactly these boundaries, on the sealed, portable, checkable artifact we call a Decision Receipt. So take the argument and test it against any cross-organizational failure you know well. Ask whether the record broke inside one of the parties, or in the space between them. The rule survives the example either way, and it is short. If the decision crosses, the record crosses with it. That is the whole of it.

— Dispatches · Summit Cognitive