I would say what the evidence actually proves. It proves an authenticated reviewer activated an approval control associated with a particular stored action hash. It does not by itself prove that the UI showed the destination, exact log range, data classification or effect size encoded by that hash. Hashing hidden parameters does not make the human understand them. Calling this “human approved” would overstate the record.

The fix starts at the review unit. Construct a canonical proposed action with destination, recipient, resource selectors, time range, data classes, expected record count or size, redaction policy, expiry and a stable proposal ID. Render a preview from that immutable proposal. Store the exact rendered review payload or a versioned, reproducible representation of it, plus its digest, UI version and any expanded details that the approval policy requires the human to see. Do not claim to know the reviewer's mental state or that every pixel was perceived. The record can show what the service delivered for display and which action the click authorized.

Approval binds a review payload to one executable action
Bind the review artifact to the exact action later executed.

Bind the approval to both the review artifact and the canonical action. The UI posts the proposal ID and nonce, not arbitrary new action parameters. The executor reloads the immutable proposal, checks that reviewer identity and authority still hold, verifies its expiry and policy version, and compares the action fingerprint with the one approved. A change in destination or scope means a new review. If the export job dynamically discovers new files after approval, cap the allowed set or require another approval when the proposed scope is exceeded. The downstream effect ledger records the actual export receipt, not merely the agent's intention.

For privacy, an audit artifact may need an encrypted, access-controlled snapshot with retention limits. A digest alone proves integrity only if the reviewed bytes remain retrievable from a trusted store. A screenshot alone can be misleading if it omits collapsed controls or rendered values, so store structured content and rendering version as well. AWS's human oversight guidance calls for recorded reviewer decisions and scoped grants. Its observability guidance emphasizes decision artifacts and traceable actions. The specific binding design here is an application decision.

What if the reviewer only saw the redacted sample? Then the approval was for the sample as presented, unless the UI clearly stated and exposed the full export scope. We cannot repair that historical evidence after the fact. For the disputed export, preserve the existing artifacts, compare what the UI version could display against the actual effect, and report the gap. Do not backfill a nicer preview and pretend it was present at approval time.

Audit an agent's actions without dumping private conversations asks how to audit effects without dumping full private conversations. The human approved a preview. The world changed before commit. covers approval binding for an agent's planned action. This case focuses on the human-facing half of that binding. The release gate is a replay test that changes the proposal after preview, tampers with the review artifact, or expands the export during execution. Each must either fail closed or require a new explicit review.