Security and complete mediation
Provider credentials remain in your executor; Receipt evaluates authority and issues one-time admissions.
Test-mode artifacts use a distinct issuer and signing purpose and always say NOT VALID FOR PRODUCTION AUTHORIZATION.