Recorded decision record
This is the exact JSON written to your ledger on every recording. Fields marked system-set are computed by Decision Keep and cannot be forged by the caller. The record is append-only and tamper-evident: editing any line breaks the hash chain for everyone.
Identity & lifecycle
| Field | Type | Requirement | Notes |
|---|---|---|---|
| receipt_id | string | required | e.g. RCP-20260710-1A2B3C. The public handle used to verify. |
| org_id | string | required | Your organisation's id (root of trust). |
| system | string | required | Platform of origin, e.g. Underwriting, Salesforce, SAP. |
| decision_type | string | optional | What kind of decision, e.g. loan-approval. |
| agent | string | required | Model / agent that produced the decision. |
| version | string | required | Version of the agent. |
| received_at | string (ISO-8601) | required | When the decision was received. |
| expires_at | string | null (ISO-8601) | required | Retention boundary; drives cryptographic erasure. |
| retention_days | number | required | Organisation retention policy in days. |
| status | "valid" | "erased" | required | Erased records remain as a signed proof. |
| erased_at | string | null | optional | Set when cryptographically erased. |
AI-governance capture
| Field | Type | Requirement | Notes |
|---|---|---|---|
| reference_db_state | string | null | optional | Step 0. hash of external reference data queried (e.g. credit bureau). |
| session_id | string | null | optional | Step 0. links the decision to broader context. |
| actor_id | string | null | optional | Step 1. human who triggered it (set on record). |
| actor_type | "human" | "agent" | null | optional | Step 1. actor classification. |
| confidence_score | number (0..1) | null | optional | Step 3. model confidence. |
| input_tokens | number | null | optional | Step 3. model execution telemetry. |
| output_tokens | number | null | optional | Step 3. model execution telemetry. |
| model_inference_ts | string | null | optional | Step 3. when inference ran. |
| risk_score | number (0..1) | null | optional | Step 4. decision outcome risk. |
| overall_confidence | number (0..1) | null | optional | Step 4. overall confidence. |
| routing_outcome | "AUTONOMOUS" | "ASSISTED" | "ESCALATED" | null | optional | How the decision was routed. |
| routing_rationale | string | null | optional | Why it was routed that way. |
| human_verifier_id | string | null | optional | EU AI Act Art.12. human-oversight identifier. |
Cryptographic binding
| Field | Type | Requirement | Notes |
|---|---|---|---|
| payload | object | required | Send REFERENCES, not raw PII. Only its SHA-256 is asserted publicly. |
| parents | string[] | required | Upstream receipt ids. the chain of custody. |
| content_hash | string (SHA-256) | system-set | Computed over the canonical decision (keys sorted, undefined dropped). |
| prev_hash | string (SHA-256) | system-set | The previous entry's chain_hash. binds the chain. |
| chain_hash | string (SHA-256) | system-set | SHA-256(prev_hash | content_hash | receipt_id | org_id). |
| signature | string (Ed25519) | system-set | Your org key signs the chain_hash. |
| public_key_pem | string | system-set | Published at /.well-known/record-public-key. |
Trusted time (optional)
| Field | Type | Requirement | Notes |
|---|---|---|---|
| tsa_token | string | null (base64) | system-set | RFC 3161 token. only when TSA_URL is set. |
| tsa_url | string | null | system-set | The timestamp authority used. |
Example record
{
"receipt_id": "RCP-20260710-1A2B3C",
"org_id": "org_8f3c…",
"system": "Underwriting",
"decision_type": "loan-approval",
"agent": "credit-model",
"version": "v3",
"received_at": "2026-07-10T04:13:00Z",
"expires_at": "2028-07-10T04:13:00Z",
"retention_days": 730,
"status": "valid",
"payload": { "application_id": "APP-1", "amount": 50000 },
"parents": [],
"reference_db_state": "sha256:bureau-snapshot-2026-07-10",
"session_id": "sess-abc-123",
"actor_id": "user_2b9d…",
"actor_type": "human",
"confidence_score": 0.92,
"risk_score": 0.18,
"overall_confidence": 0.88,
"routing_outcome": "ASSISTED",
"routing_rationale": "High amount. human review",
"human_verifier_id": "reviewer-7",
"content_hash": "b4e2… (SHA-256 of canonical decision)",
"prev_hash": "a1c9… (prior entry's chain_hash)",
"chain_hash": "f7d1… (SHA-256 of prev|content|receipt|org)",
"signature": "Ed25519(chain_hash). base64",
"public_key_pem": "-----BEGIN PUBLIC KEY----- …",
"tsa_token": "RFC 3161 token (base64). only when TSA_URL set",
"tsa_url": "https://freetsa.org/tsr"
}Payload guidance: send references (ids, hashes), not raw PII. Only the SHA-256 of the payload is asserted publicly, so the ledger stays PII-free while remaining provable.
How integrity is proven
- content_hash. SHA-256 over the canonical decision (keys sorted, undefined keys dropped).
- chain_hash. SHA-256 over
prev_hash | content_hash | receipt_id | org_id. - signature. your org's Ed25519 key signs the chain_hash; verified against
public_key_pem. - tsa_token. optional RFC 3161 timestamp binds the chain_hash to trusted time.