Execution Provenance

Government agencies must be able to reproduce a specific decision months or years later, with the exact same result. Dutch administrative law requires this (Awb Art. 3:46, the AERIUS rulings), and the EU AI Act makes it mandatory for high-risk systems from August 2026.

Determinism within a single execution is necessary but not sufficient. Reproducibility requires pinning three things: the regulation YAML, the schema version it conforms to, and the engine version that executed it.

The Execution Receipt

Every execution produces an Execution Receipt: an output envelope that contains everything needed to reproduce the result.

The receipt records which engine version and schema produced the result, which regulations were loaded (with content hashes), the input parameters, and the full output with trace.

Schema and engine versioning

The schema defines the regulation format. The engine interprets and executes regulations that conform to the schema. These are versioned independently:

• Schema versions are immutable directories under schema/ (e.g., schema/v0.5.1/schema.json). A published version is never modified.
• Engine versions correspond to GitHub Release tags. Each release declares which schema versions it supports.

This distinction matters because third-party organizations may build their own engine implementations. The schema is the specification; the engine is one implementation of it.

Cross-organization reproducibility

When a decision depends on values from other organizations (via Multi-Org Execution), the receipt captures the provenance of each accepted value:

When reproducing the decision, the engine uses these sealed accepted values rather than re-calling the other organization. The other organization may now be running a different engine version. A beschikking stands once issued; the accepted value at the time is a legal fact.

What this enables

A citizen can request their trace and see which rules applied. An auditor re-runs the computation and gets the same number. A court reconstructs the reasoning step by step. When a bug surfaces, every affected decision can be found by querying receipts for the engine version and regulation hash. Section 4.5 of the position paper, The Recipient’s Check, spells out what this needs in practice: the attested trace has to reach the addressee together with the decision, without a procedure of their own.

Further reading

• Hooks and Reactive Execution - Awb procedure hooks
• Multi-Org Execution - cross-organization value exchange
• RFC-013: Execution Provenance - full specification
• RFC-014: Engine Conformance - conformance test suite
• Rules as Executed, sections 4.4 and 4.5 - the position paper’s constitutional case for attestation and the recipient’s re-execution check