Receipts and trust

A receipt is a signed record associated with a covered operation. It can identify the recorded decision, control results and Charter revision. Its contents depend on the receipt’s format and the operation being recorded.

Keep the original downloaded artifact for verification.

Three different questions

Question	Evidence needed
Has the signed record changed?	A valid signature checked against a trusted deployment signing key.
Is witness evidence present and valid?	The corresponding witness material and trusted witness keys.
Was the AI result correct, and was all expected activity covered?	Workload evaluation and separate coverage evidence; a valid signature alone cannot answer this.

Self-attested means the deployment has signed the record. Additional Notary evidence may be provided when witnessing is configured and completes. Glacis operates the public Notary; a separate signature alone does not establish organizational independence.

Pending, unavailable and failed witness checks are different from successful verification. A plan name or a reachable service does not prove that an individual receipt was witnessed.

Preserve the limits with the record

Signatures make unauthorized edits detectable when checked with trusted keys. They do not prevent deletion, prove that all traffic was recorded or guarantee the truth of every signed assertion. A compromised signing key changes what can be trusted.

A receipt can record a failed or withheld operation. Inspect the operation and delivery result rather than assuming that a receipt means an answer reached the application. Later review evidence, where present, should be interpreted as that recorded review.

For checks outside the portal, follow Verify a receipt. For content handling and retention, see Privacy and responsibilities.