# Acceptances

Some changes can break someone else, such as removing a field clients
read. `jadpo check` fails on them until a person accepts them. An
acceptance is one file per **decision**, listing every change it allows,
with the reason in a `///` line. Each entry is `subject: Kind.change`,
with the subject and the change copied from the compiler's message:

```jadpo
// acceptances/20261020T1400_remove_todo_priority.jadpo
/// Priority was never shown by any client; the mobile app stopped sending it in 3.2.
acceptance {
    changes: {
        main.TodoView.priority: ApiChange.output_field_removed
        main.TodoSummary.priority: ApiChange.output_field_removed
    }
}
```

- **It counts only in the change that adds it.** Acceptances already on
  the before side are history, and editing one is an error. `check` fails
  when a change needs a person and no added acceptance lists it, when a
  listed entry matches nothing, or when the reason is missing.
- **Drafting is a command.** `jadpo acceptance new <purpose>` writes a
  file listing every change not yet accepted, with no reason. An agent
  may run it, then stops: the missing reason keeps `check` failing until
  a person writes one.
- **The git host is the gate.** `acceptances/` and `api/` are owned in
  CODEOWNERS, so the owner's approval of the pull request is what lets a
  decision in, and the host records who gave it
  ([Review and sign-off](review-and-sign-off.md)).

| Needs a person | Kind | Where it is described |
|---|---|---|
| A route removed, a required input field added, a rule tightened, an output field removed or retyped, a failure code changed | `ApiChange` | [The public API record](the-public-api-record.md) |
| A column or table dropped, an entity moved to another store | `DataChange` | [Migrations](migrations.md) |
| Any widening of who can do what, however it arises | `PolicyChange` | [Policy](policy.md) |
| A domain created or renamed | `DomainChange` | [Domains](domains.md) |
| A risky package change ([Package upgrades](package-upgrades.md)) | `PackageChange` | [Integrations](external-services.md) |
| A package's service: a new or changed container image, before it runs | `PackageChange` | [Integrations](external-services.md) |
| Installing a third party's package from git rather than the registry (an unverified publisher) | `PackageChange` | [Integrations](external-services.md) |
| A connection that receives personal data but can't erase it, with the reason the data stays | `ErasureNotPossible` | [Integrations](external-services.md), [Erasure](erasure.md) |
| A threshold raised or removed | `ThresholdChange` | [Monitoring thresholds](monitoring-thresholds.md) |

Changes that only add need no acceptance: a new route, a new optional
input field, a new output field, tightened policy. The diff still shows
them.

Acceptances aren't built yet ([What is built](records-and-manifest-built.md)).