A Sealed Decision Is Not a True One

A signature proves that a particular statement was made by a particular party. It does not prove that the statement describes the world correctly. A notary can attest that a document was signed without attesting that every factual claim inside the document is true, and that distinction matters because the seal changes how the document is read. Once sealed, the question shifts from “who says this?” to “what was certified?”

Governance evidence for autonomous AI systems has the same boundary. A receipt can prove that a decision was made before execution, that the decision was made under a particular policy, that the evidence has not been altered, and that the decision can be reconstructed later. Those properties are real. They are also bounded. The receipt proves the decision over the recorded action. It does not, by itself, prove that the recorded action was the right translation of the framework call that produced it.

That is not a weakness in receipts. It is the boundary receipts force into view.

The Receipt Proves the Recorded Action

A receipt proves the governance decision over the representation the authority layer was given. The system receives a formed-but-not-yet-run call, projects it into a policy-readable action, evaluates that action against policy and delegation, and records the result. Later, replay reconstructs the decision from the recorded evidence and asks whether the same inputs produce the same decision.

That is the right test for replay. It is the test that separates governance evidence from a log entry, because the decision no longer has to be trusted as a story told by the system that made it. The evidence can be carried forward, checked by another party, and compared against the recorded result.

But replay begins from the representation in the receipt. It does not reopen the original framework call and discover, independently, what that call meant. It tests whether the decision follows from the recorded action. It does not test whether the recorded action was the only, best, or correct reading of the original call. The difference is small in wording and large in consequence.

Two Claims Sit Inside One Receipt

A sealed governance receipt carries two claims that are easy to read as one. The first claim is explicit: this decision followed from this recorded action, under this delegation, under this policy, at this time. The second claim is usually implicit: this recorded action was the right description of the thing the framework was about to execute.

The first claim is what the receipt can prove. The second claim is what the translation step has asserted.

Take a simple tool call. The framework is about to send a message. In its native shape, the call might contain a tool name, a recipient field, a body field, an actor identity and some local context about the workflow. The policy engine cannot judge that native shape directly, because every framework names those parts differently. One framework calls the recipient to. Another nests it under message.destination. A third treats the target as part of a structured transport object. Before governance can decide anything, some framework-facing component has to turn that native shape into a policy-readable action: this actor is attempting this kind of action, against this target, across this boundary, with these arguments.

The implementation name does not matter. It may be a hook, wrapper, gateway, middleware, plugin or framework binding. The job is the same. It translates the framework’s own representation into the representation the governance system can evaluate.

Only then can the authority layer answer its question. If the policy-readable action says “external send to this recipient”, a policy that forbids external sends can deny it. If the policy-readable action says “internal notification with no external target”, the same policy may allow it. In both cases the evaluator can be deterministic, the receipt can be sealed and replay can reproduce the decision exactly.

The decisive question is whether the action was named correctly before the evaluator saw it. If the translation step missed the external recipient, replay will not rediscover it. Replay will faithfully reconstruct the decision over the action that was recorded, because that is the evidence it was given. The error has occurred one step earlier, at the point where the framework call became policy-readable.

Translation Is Part of the Boundary

The component that names the action is not plumbing. It is the place where a framework-specific call becomes the action the governance system can judge: actor, action type, target, boundary, arguments and context. Once that translation has happened, the authority layer can do its work. Before it has happened, there is nothing stable to evaluate.

This means the translation step sits inside the governance system. It is the first part of the governance boundary. If it reads a send as a read, lifts the wrong recipient field, or maps an external destination into an internal object class, the authority layer will still be deterministic. The receipt will still be sealed. Replay will still reproduce the decision. The proof will be sound over the wrong representation. This is the first of two ways translation goes wrong, and the one that owes nothing to change: the framework surface stayed exactly as it was, and the mapping was simply wrong about a call shape it had always read.

That is the uncomfortable point. The better the evidence machinery is, the more important the translation boundary becomes. A weak log leaves the reader suspicious because everyone knows logs are partial, mutable and local to the system that produced them. A strong receipt does the opposite. It tells the auditor that the decision can be checked. It creates confidence, and that confidence is warranted for the decision it actually proves.

The risk is not that proof is fake. The risk is that a true proof over a bad translation is easy to mistake for proof of the world.

Schema Drift Is a Governance Event

The ordinary answer to this problem is to call it garbage in, garbage out. That answer is partly right and operationally insufficient. Every system trusts some input edge. A thermostat trusts a thermometer, a bank trusts a message format, and an authority layer trusts the representation it is asked to evaluate. There is no architecture in which meaning appears without a boundary that assigns it.

The difference is what happens when the trusted edge is wrapped in governance evidence. If a dashboard field is wrong, the wrongness may remain visible as an operational fault. If a framework-facing translation step is wrong and the resulting action is allowed, the system may emit the cleanest artefact it is capable of emitting: a sealed, chained, replayable receipt saying that the decision followed from the evidence. The error has not disappeared. It has moved into the premise.

That is why schema drift at the translation boundary is not a minor integration bug. Drift is the second way translation goes wrong, the inverse of the first: a mapping that was right, overtaken by a framework surface that moved. Suppose a framework changes the field that carries an external recipient. The translation code might continue parsing the call, but no longer lift the recipient into the action record the policy expects. If the contract treats that absence as acceptable, the evaluator may see a permitted action where the old translation would have seen a prohibited one.

The correct answer is not to blame replay. Replay is doing its job. The correct answer is to treat a changed call shape as a governed boundary: named, reviewed, tested, and unable to fail silently.

Wider Replay Will Not Remove the Boundary

The tempting fix is to make replay go further back. Keep the original call, run the translation again during audit, compare the new action record to the old one, and treat a match as proof that the translation was correct.

That test is useful, but it proves less than it appears to prove. It shows that the translation is deterministic over the retained material, and that the recorded action can be reproduced from the original call under the same rules. What it cannot show is that the interpretation was semantically right. A wrong mapping can be perfectly deterministic. It reproduces perfectly under audit.

This is the same line I drew in the argument that authority does not verify reality, but one step earlier. Authority can decide whether an action is permitted under the representation and evidence supplied to it. It cannot make the world true. Likewise, replay can decide whether the recorded decision follows from the recorded representation. It cannot, by itself, make translation correct.

The boundary can be governed. It cannot be wished away.

The Audit Starts at Translation

The audit question should therefore split the receipt into two claims. The first is the decision claim: given this action representation, this delegation, this policy and this evidence bundle, did the authority layer render the recorded decision? That claim is exactly what replay and receipts are for.

The second is the translation claim: why should anyone believe this representation was the right reading of the framework call? That claim needs its own evidence. The organisation should be able to show how the translation surface was specified, how changes were reviewed, and how silent reinterpretation was prevented.

The earlier evidence argument still holds. Evidence proves that governance occurred. Replay proves that the decision can be reconstructed. Neither claim proves that the translation from framework call to recorded action was correct. They prove something narrower and more useful: once the action has been named, the decision over it can be made portable, inspectable and tamper-evident.

That precision is the point. A sealed decision is not a true one. It is a proven decision over a named representation, and the first serious audit question is who named it.