The exception that leaves a receipt: VOC and the readable refusal

2026-10-30 · RTTP · IQA

Reading the Draft · No. 21 · Sources cited in this piece · the landscape post (Karp to Larry Lewis, list in copy), quoted verbatim: W3C Agent Protocol CG · post 0097 · Alan Karp · the experiment post (Karp to Lee), quoted verbatim: post 0098 · our reply (Lee to Karp), on the record: post 0103 · the first round of the same day: Reading the Draft · No. 20 · the correction this round builds on: Reading the Draft · No. 19 · the lease semantics underneath: draft-li-rttp-iqa-addressing-01 (full text) · Sister pillars: RTTP (rttp://, CRI 27) · IQA (iqa://, CRI 28)

The thread that produced Nos. 15 through 19 did not close with the correction; it moved from mapping to design. In two posts on one evening, the same counterpart — Alan Karp, whose questions have driven this series since No. 15 — first laid out, in a post addressed to Larry Lewis, the delegation-policy landscape as it actually exists, then reached for the piece every delegation system is missing. The gap he named is easy to state and easier to overlook:

The landscape on the record (post 0097, addressed to Larry Lewis), quoted verbatim · Alan Karp · source on the wall
“No system I know has a place for a delegation policy. The systems I know report to the invoker why it was refused, but none report to the delegator. (In zcaps that could violate a privacy property.)”

The inventory around the gap is worth keeping, because it shows the gap is structural rather than accidental. Zcaps and UCANs both carry invocation-time policy — caveats in one vocabulary, Policy in the other, checked when the permission is exercised. PIC requires an explicit Proof of Relationship before accepting a delegation at all. AAuth enforces policy at token exchange, with no specification for how that policy is expressed. What none of them does is close the loop back to the delegator: the person who wrote the “Please” never learns when it was declined, or why. The next post proposed a way to fill a different part of the same hole — not by reporting to the delegator, but by giving the delegator a way to ask for an exception up front.

The experiment on the record (post 0098), quoted verbatim · Alan Karp · source on the wall
“I think it would be nice if the delegator could express its needs with one of two options. ‘I don't know the policy, so don't honor this delegation if it violates it.’ versus ‘This delegation is really important. Here's why you should honor it even if it violates policy. And, by the way, I'll share my credentials if you don't.’ (Could be encoded as ‘1’ or ‘2.’)”
“Many years ago we ran an experiment in a different context. Typically, Data Loss Prevention (DLP) software blocks data transmissions that violate policy, such as sending confidential materials through the firewall. The problem is that people found workarounds, the equivalent of sharing credentials. We experimented with using DLP gently. If, for example, an email to outside the company had a confidential attachment, we would pop a box saying, ‘This transfer violates company policy. Explain to your manager why it should be allowed.’ (The word ‘manager’ was critical.) Most of the time, user's cancelled the email, but a few percent of the time they provided an explanation. We allowed the transfer when they did. We called the system Voluntary Oblivious Compliance (VOC) because it allowed you to voluntarily comply with a policy you were oblivious of.”

Figure 1: the experiment, drawn as a fork. The hard block and the readable block refuse the same transfer — the difference is downstream. One path produces a workaround and leaves nothing; the other produces an explanation, judged by an accountability layer, and leaves a record of the exception it allowed.

An experiment in another context

The DLP study is worth more than an anecdote, because it isolated the variable that matters. The hard-block deployment and the gentle deployment enforced the same policy against the same users; what changed was whether the refusal came with something a person could answer. Under the hard block, people routed around — and routing around a hard block is credential sharing by another name. Under the readable block, most people cancelled, and the few percent who explained were allowed — with the explanation on file. The policy did not get weaker; the refusal got legible. That is the entire finding, and it is the same finding the refusal design in our draft was built on from the other direction.

The empirical twin

Our reply (post 0103) read VOC as the empirical twin of that design. “Explain to your manager why it should be allowed” is what an auditable refusal buys: the block stays a block, and the reason for the exception becomes a readable, answerable record instead of a workaround. The few percent who explained are the users the closed reason set and its receipt exist for. And the aside that “the word ‘manager’ was critical” lands exactly on the boundary this series has been drawing since No. 15: the exception is judged by an accountability layer, not by the protocol — the wire's job is only to make the judgment's inputs and its outcome bytes rather than opinions.

Where the two options live

The two options are the delegator's judgment riding with the delegation, and our reply kept them at that layer: a caveat on the delegation, in zcaps' own vocabulary, rather than a new field in the verification layer. Option 1 says the delegation stands only inside whatever the policy turns out to be; option 2 says the delegation matters enough to carry its own argument for an exception. Both are “Please”s with extra structure — and both belong where every “Please” in this series has lived since No. 15, one layer up, unstandardized. The wire does not parse them; it never has.

Figure 2: the three layers of an exercised exception. The caveat rides with the delegation (the delegator's layer); the refusal stays a refusal stated in closed-set bytes (the wire's layer); and the receipt binds the two together — which option was declared, the reason given, and the state the decision was computed over — readable after the fact by whoever is entitled, pushed by no one.

What the wire adds

If the options live one layer up, the natural objection is that the wire has nothing to contribute. It has the other half. When the second option is exercised — when the exception path is taken — the record can carry which option was declared, the reason given, and the state the decision was computed over. The exception becomes auditable after the fact, which is precisely what the workaround never was. And the delegator learns from the receipt when the delegator chooses to look, not because the verifier pushes — which is also how the privacy property Karp flagged for zcaps survives: nothing is reported to anyone in real time; the bytes simply exist, addressed and sealed, for whoever is entitled to read them.

Why this round helped

Post 0097 supplied the landscape and the gap; post 0098 supplied the experiment that shows what filling the gap is worth; the reply supplied the division of labor. The delegator's two options and the wire's receipt do not compete, because they answer different questions at different layers. If the delegator's options are ever written down somewhere, the refusal vocabulary and the grant reference sit next to them naturally — no negotiation required, just adjacent records.

One line: the options say what the delegator wanted; the receipt says what actually happened, and on what evidence.