Concept

What is Decision Admissibility?

Logs record events. A Decision Receipt records the policy evaluation of a proposed action.

A definition first, because the word is borrowed. "Admissibility" here is our term for evidence completeness under a policy: the decision was evaluated against a stated policy, the evidence it relied on was recorded, and the result is reproducible. It is not the evidentiary sense. Nothing on this page or in any receipt is a determination that a record is admissible in a court or acceptable to a regulator — those are decisions for a court and a regulator, not for us. Our standing position is that a receipt is built to be court-credible, never court-admissible.
The problem

Autonomous agents produce outputs. They do not automatically produce decision evidence.

AI agents are writing code, merging pull requests, deploying infrastructure, and modifying production systems. Devin writes features. Codex refactors libraries. Jules triages bugs. Copilot suggests changes that ship the same day.

Many agents produce outputs and logs without a portable record of the policy evaluation that authorized a proposed action. A Decision Receipt records the evaluation; it does not prove the policy was correct or that the action executed.

Today, when an autonomous agent merges a pull request, the best you get is a log entry: "PR #4712 merged by bot at 14:32 UTC." That tells you what happened. It tells you nothing about whether the merge was evaluated against your security policy, whether the evidence the agent relied on was authentic, or whether a second run with the same inputs would produce the same decision.

This is the gap where liability lives. Where compliance failures originate. Where trust erodes — not in a single dramatic failure, but in thousands of unverified decisions compounding daily.

Five distinctions

How admissibility differs from what you already have

Decision admissibility is not a replacement for observability, guardrails, audit logs, governance, or explainability. It is the layer that was missing underneath all of them.

01 / Observability
Observability records runtime behavior. Admissibility records a policy evaluation.
Observability tools collect metrics, traces, and logs from running systems. They answer: did the agent run? How long did it take? Did it error? They do not answer: was this action evaluated against policy before it executed? Observability is necessary. It is not sufficient.
02 / Guardrails
Guardrails filter bad outputs. Admissibility verifies the decision chain.
Guardrails intercept obviously harmful outputs — toxic content, malformed code, out-of-scope responses. They operate on the output. Admissibility operates on the decision process: was the right evidence consulted? Was the policy applied correctly? Was the chain from input to decision to action intact and verifiable?
03 / Audit Logs
Audit logs record events. Admissibility replays them deterministically.
An audit log records an event. A Decision Receipt captures the recorded inputs, policy version, and evaluation result so a relying party can replay that evaluation. It does not establish that the action executed or that the result was substantively correct.
04 / Governance
Governance documents policy. Admissibility evaluates it at decision time, on the record.
Governance frameworks define what should be allowed — approval matrices, compliance rules, risk thresholds. A Decision Receipt binds a specific proposed action to the recorded policy version and evaluation outcome.
05 / Explainability
Explainability generates reasons. Admissibility records replay results.
Explainability tools produce human-readable rationales for AI decisions. A Decision Receipt addresses a narrower question: whether the recorded evaluation can be replayed from the recorded inputs and policy, not whether the rationale is true.
Three pillars

All three must hold for a decision to be admissible

Pillar I
Evidence Provenance
Was the evidence authentic and complete at decision time? Every decision rests on inputs — source code, configuration, policy documents, prior decisions. Evidence provenance means capturing what the agent saw, when it saw it, and whether it was the real thing — not a stale cache, not a partial fetch, not a hallucinated reference. This is the chain of custody for decision inputs.
Pillar II
Deterministic Replay
Does the same recorded input produce the same recorded output? Deterministic replay captures enough state for another implementation to re-run the evaluation and compare the result. That comparison is evidence about reproducibility, not proof that the policy or inputs were correct.
Pillar III
Authority Attestation
Was this action authorized by policy — not just permitted by access control? Access control answers: does this agent have credentials? Authority attestation answers a harder question: should this agent perform this action, given the current policy, the specific context, and the evidence at hand? Having the key to the door is not the same as being authorized to walk through it.
Why now

Autonomous agents are scaling faster than the infrastructure to hold them accountable

AI assistants increasingly write code, open pull requests, review changes, run deployments, and modify infrastructure, sometimes with limited human oversight.

Logging, monitoring, access control, and policy documents do not by themselves create a portable record binding a proposed action to the policy evaluation that authorized it.

Liability
When an autonomous action causes harm, who is accountable? Without admissibility, the answer is unclear — and unclear is the most expensive answer in a legal proceeding.
Compliance
Regulated industries require demonstrable controls. Policy never enforced at runtime creates compliance exposure with every action.
Trust
Engineering and security teams lose confidence in systems they cannot verify. This slows adoption and eliminates the efficiency gains that justified the investment.
Legal analogy

Borrowed deliberately from evidence law

Three legal standards map directly to the three pillars. These standards exist because courts learned, over centuries, that unverified evidence leads to wrong outcomes. The same principle applies to autonomous AI decisions.

FRE 901
Authentication
Before evidence is admitted in court, someone must establish that it is what it claims to be. This is evidence provenance: the requirement that decision inputs are genuine, not assumed.
Daubert Standard
Reliability + Reproducibility
Can the methodology be tested? Is it reproducible? Deterministic replay lets another party compare a recorded evaluation result with a re-run of the same recorded inputs and policy.
Chain of Custody
End-to-End Integrity
Physical evidence must be tracked from collection to courtroom. Any break in the chain can render it inadmissible. This is the requirement that connects provenance, replay, and attestation into a single verifiable record.
These standards exist because courts learned, over centuries, that unverified evidence leads to wrong outcomes. The same principle applies to autonomous AI decisions. The stakes are different. The logic is identical.
Decision Receipt

Admissibility as a product

Decision Receipt by Summit Cognitive evaluates a proposed agent action against recorded policy, binds evidence digests, records replay results, and issues a cryptographically signed receipt.

A Decision Receipt records that an evaluation occurred; it does not assert the underlying action executed. Its signature makes later payload changes detectable to a relying party that has established the verification key out of band.

Try in Playground Get API Key