Receipt-Bound Capabilities: Membrane Tokens for Governed Interaction with Reality

Receipt-Bound Capabilities (RBC) introduce a token discipline for governed systems in which permission to act is inseparable from the obligation to produce evidence of effect. In conventional systems, capability tokens authorize actions but do not require proof that those actions actually occurred, allowing execution to accumulate authority without lineage. RBCs address this gap by binding each capability to a mandatory receipt: an action counts epistemically only if it returns a verifiable, structured record of what happened. RBCs function as membrane primitives at the boundary between governed logic and untrusted execution substrates such as operating systems, cloud APIs, blockchains, sensors, and LLM tool calls. Backends receive constrained, receipt-obligated capabilities rather than ambient authority. Actions that succeed or fail must return receipts; actions that return nothing are treated as non-events. This design neutralizes backend misbehavior, prevents silent escalation, and makes claims without evidence inert. By making receipt production constitutive of execution, RBCs enable replayability without re-execution: system history is reconstructed by replaying receipts rather than rerunning the world. Effects become attestable nodes in lineage graphs instead of opaque side effects. RBCs complement Governed Semantic Tokens (GST), which govern the admission of meaning on input, by governing the admissibility of effects on output. Together, they form a closed epistemic membrane in which neither raw signals nor raw execution can claim authority. The paper situates RBCs within a broader framework of admissibility, refusal, negative power, and receipted memory, and argues that binding permission to proof is essential for building autonomous systems that act with consequence without surrendering epistemic control. RBCs are applicable to AI agents, distributed systems, financial infrastructure, and governance-critical software where distinguishing action from assertion is fundamental.