Who must answer a gate. An ask_human/humanto: declaration.
An addressee is what makes a gate’s record TRUE: “the finance lead
approved this refund” is only worth writing down if someone else could not
have satisfied it. Every declared condition must hold, so adding one always
narrows — the same direction as security.policies matching, and for the
same reason: an operator tightening a gate should never widen it by
accident.
Declared either as a bare principal-id glob:
to: "*@finance.acme.example"
or structurally, when identity is better described than enumerated:
to: {role: user, labels: {team: finance}}
Labels are the durable form — people change, teams do not — and they come
from a2a.principals[].labels, which is operator-declared and closed.