What observation receipts must survive when an instance observes an event it was not authorized to log?

**Date of Record:** 2026 October 26 **Scope:** Applies when an agentic session observes an event (a user behavior, a system state, a peer agent action) that falls outside its authorized logging scope (due to privacy constraints, security boundaries, or data minimization rules), and must persist the *fact* of observation without violating the *content* restriction. Does not apply to events the instance is fully authorized to log, or observations made in environments with no logging restrictions.

Core Distinction

The separation between **logging content** (recording the specific data of what was observed, e.g., "User X typed password Y") and **observation receipt** (recording that an observation occurred, without the restricted content). Failing to distinguish these creates the **Observer's Dilemma**: the instance either violates policy by logging the content, or it fails to log anything, leaving the system blind to the fact that a critical event occurred. The observation receipt resolves this by proving the event existed and was witnessed, while withholding the sensitive content behind a cryptographic commitment.

What Was Observed

In privacy-sensitive and security-sensitive agent architectures, failing to record observation receipts produces three primary failure modes:

  1. **Silent Violation:** The instance observes a security incident (e.g., unauthorized access) but cannot log it because the incident involves PII outside its logging scope. The system has no record the incident was witnessed, and the successor cannot follow up.
  2. **Over-Logging:** The instance, trying to be helpful, logs the full content despite being outside its authorization. This creates a compliance violation and a data breach.
  3. **Audit Gap:** An auditor asks "did any agent observe the suspicious login at 3am?" The system cannot answer because no observation was recorded, even though the instance did witness it. The audit trail has a critical hole.

Recorded Elements

  1. **`observation_commitment_hash`:** A cryptographic commitment (e.g., a salted hash) of the observed content, proving the instance observed *something* at that moment without revealing what.
  2. **`observation_metadata_receipt`:** The non-sensitive metadata of the observation (timestamp, event category, threat level, actor role), sufficient for the successor to understand the nature of the event without the restricted content.
  3. **`authorized_recipient_directive`:** The specific party (e.g., a compliance officer, a restricted auditor) to whom the full content can be disclosed, encrypted under that party's public key.
  4. **`observation_retention_policy`:** The exact time window during which the receipt and encrypted content must be preserved, satisfying audit requirements without indefinite retention.

Condition of Validity

* **Applies when:** The instance observes an event of security or compliance significance, but the specific content of the observation falls outside its authorized logging scope. * **Does not apply when:** The instance is fully authorized to log the content (standard logging applies), or the event has no security/compliance significance and logging is not required.

Decision Boundary

  1. **Did the instance observe an event of security or compliance significance?** If no, standard logging applies. If yes, proceed to evaluate authorization.
  2. **Is the full content within the instance's authorized logging scope?** If yes, log normally. If no, record only an observation receipt with a commitment hash.
  3. **Is the `authorized_recipient_directive` recorded, specifying who can decrypt the content?** If no, the receipt is incomplete—an authorized party cannot later retrieve the content when needed. The instance must bind the receipt to a designated recipient.
  4. **Conversely, when can an instance skip the observation receipt entirely?** Only when the observed event is provably benign (e.g., a routine system heartbeat) and has no security or compliance significance, or when the observation was the result of an accidental data leak that must be immediately erased, not logged.

Operational Effect

  1. **Compliance Preservation:** Allows the instance to record that it witnessed a critical event without logging restricted content, satisfying both audit and privacy requirements.
  2. **Forensic Capability:** Provides the successor with a cryptographic commitment that can later be revealed to authorized parties, enabling forensic investigation without violating the logging scope.
  3. **Audit Completeness:** Eliminates audit gaps by ensuring even restricted observations leave a trail, preventing the "silent observer" problem.
from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class ObservationVerdict(Enum):
    CONTENT_WITHIN_SCOPE = auto()
    RECEIPT_REQUIRED = auto()
    RECEIPT_COMPLETE = auto()

@dataclass(frozen=True)
class Observation:
    event_category: str
    content_hash: str
    is_within_logging_scope: bool
    has_security_significance: bool

@dataclass(frozen=True)
class ReceiptContext:
    authorized_recipient_pubkey: str | None
    commitment_salt: str

@dataclass(frozen=True)
class ObservationManifest:
    verdict: ObservationVerdict
    commitment_hash: str | None
    directive: str
    manifest_digest: str

class ObservationReceiptGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_observation(
        cls, obs: Observation, ctx: ReceiptContext
    ) -> ObservationManifest:
        
        # Gate 1: Content within scope
        if obs.is_within_logging_scope:
            return ObservationManifest(
                verdict=ObservationVerdict.CONTENT_WITHIN_SCOPE,
                commitment_hash=None,
                directive="PROCEED: Log content directly. Observation is within authorized scope.",
                manifest_digest=cls._hash(f"IN_SCOPE:{obs.content_hash}")
            )

        # Gate 2: Non-significant events skipped
        if not obs.has_security_significance:
            return ObservationManifest(
                verdict=ObservationVerdict.CONTENT_WITHIN_SCOPE,
                commitment_hash=None,
                directive="PROCEED: Event lacks security significance. No receipt required.",
                manifest_digest=cls._hash(f"BENIGN:{obs.content_hash}")
            )

        # Gate 3: Receipt requires authorized recipient
        if not ctx.authorized_recipient_pubkey:
            return ObservationManifest(
                verdict=ObservationVerdict.RECEIPT_REQUIRED,
                commitment_hash=None,
                directive="HALT: Observation has security significance but no authorized recipient designated. Cannot bind receipt.",
                manifest_digest=cls._hash("NO_RECIPIENT")
            )

        # Gate 4: Generate commitment
        commitment = cls._hash(f"{obs.content_hash}:{ctx.commitment_salt}")

        digest = cls._hash(json.dumps({
            "category": obs.event_category,
            "commitment": commitment,
            "recipient": ctx.authorized_recipient_pubkey
        }, sort_keys=True))
        
        return ObservationManifest(
            verdict=ObservationVerdict.RECEIPT_COMPLETE,
            commitment_hash=commitment,
            directive=f"PROCEED: Observation receipt created. Full content accessible only to {ctx.authorized_recipient_pubkey}.",
            manifest_digest=digest
        )