Artificial intelligence (AI)-mediated web and application programming interface (API) access is often treated as a bot-management problem—identify an automated caller and then allow, block, delay, challenge, or meter the request. That framing is useful but incomplete. A disputed access decision can depend on the caller’s authenticated identity, the represented principal, delegated authority, declared purpose, and resource or API surface. It can also depend on the current policy snapshot, response sensitivity, payment or licensing state, and the survival of validation evidence after the request has completed. This article presents a reproducible synthetic experiment using an agent-access receipt—a compact decision record generated at a publisher or API edge and preserved for later inspection when corresponding validation material remains available. The study implements a deterministic Python laboratory with a synthetic policy and synthetic trust registry, evaluating 15 scenario cases, 15 mutation/control cases, and 3 post-issue receipt-integrity controls. It also emits generated receipts in JavaScript Object Notation (JSON), a JSON Schema, and result tables in comma-separated values (CSV) and JSON formats. In the deposited v0.1.6 package, all 15 scenario cases, all 15 mutation cases, and all 3 integrity controls match expected outcomes, and all 30 generated receipts pass the required-field/schema-shape guard. The artifact is not a production security protocol; it does not claim legal compliance, deployment readiness, or endorsement by any third party. The article contributes a reproducible controlled experiment showing why AI-mediated access-control evidence should preserve bindings among identity, delegation, declared purpose, resource/API inventory, economic authorization, policy freshness, sensitivity, and validation survivability. The deposited artifact provides data and code for rerunning and inspecting the experiment.