1. Purpose and scope

Repository

bloque-app/aledgent

Commit

5ca6b8a

Version

0.4.27

Status

draft

Rendered

2026-10-17T19:30:18Z

Source

SPEC.md, last changed in 5ca6b8a

1.1 The problem

The domain. A ledger of record is the system that answers three questions with authority: who holds what value, what has been committed but not yet concluded, and how every holding came to be. Everything a financial product does, such as paying, receiving, holding, spending on a card or lending, is in the end a claim against such a ledger. A product is exactly as trustworthy as the ledger its claims resolve against.

The field of application. Businesses, platforms and, more and more, autonomous agents build financial products for people and organisations. They do not want to build a ledger of record to do so. A ledger is a liability to operate, an audit surface, and hard to get right under concurrency. What they need from a ledger is specific:

1. Correctness under concurrency. Two spends against one balance never both succeed when only one is covered. Every posting balances. Nothing is lost.
2. Decisions in milliseconds. A card network, a checkout or an agent in the middle of a task each needs to know whether value is available now. The answer must be the same number the holder sees.
3. Privacy. Who holds what, and who pays whom, is not public. Other customers and the world cannot see it. The operator sees no more of it than necessary.
4. Provability. A holder can prove a fact about their holdings to a party they choose. That party can verify it without trusting the operator, and can detect if the operator later revises history.
5. Connectivity with certainty. Value enters and leaves through an external settlement layer. The outcome of every such leg is unambiguous: settled, provably not executed, or explicitly unresolved. It is never guessed.
6. Delegation with bounds. A holder can let another principal act on an account within limits. That principal can be an agent or a member of an organisation. The holder can revoke it within a stated bound and later see who acted.
7. A choice about custody. A holder can decide whether the operator may act on their behalf. The decision is honoured and visible.

The problem. Each available kind of ledger gives up some of these. A public shared ledger gives provability without privacy. It also prices every internal movement as if it were external. A private database ledger gives privacy and speed. But its correctness and completeness rest entirely on the operator’s word. Connecting it to an external settlement layer also splits one operation’s lifecycle across two systems. A reservation sits in one, an outcome in the other, and a string between them. That string is where value goes missing. A hosted accounting engine gives balanced postings and nothing else. No privacy from itself, no proof to a third party, no settlement semantics. And none of them treats an autonomous agent as a principal with its own authority.

aledgent exists to provide all seven properties in one ledger. It is private by default and provable on demand, and connects to a single settlement layer through a single, unambiguous operation lifecycle. It is open to people, organisations and agents alike as first-class principals.

1.2 What aledgent is

aledgent is a ledger-of-record service. A party integrates it to hold and move value for the identities it serves, or for itself. aledgent provides:

• Identities and accounts. An identity is a person, an organisation or an agent. It owns one or more ledger accounts, each holding balances in one or more assets.
• Internal movement. Value moves between any two accounts in one atomic posting. It is final on acceptance and touches no external network.
• Reservations. Value can be reserved against an account for a named operation, then captured or released. The reservation takes its balance effect at the moment it is accepted.
• External legs. Value enters and leaves aledgent through the settlement layer. Every outcome of this lifecycle is derived from evidence aledgent recorded.
• Authority. Who may act on an account, within what bounds and under which custody mode. Delegation to agents and members. Revocation within a stated bound. Attribution of every action.
• Privacy and disclosure. Ledger facts are private by default. A holder can issue verifiable disclosures about them to a recipient they choose.
• Anchoring. aledgent periodically commits to the state of its book on the settlement layer. After that, it cannot claim to have held a different history.
• An audit trail and an operator surface, so that every intervention is an authorised, recorded operation.

aledgent does not know what product any of this is presented as. A card, a wallet, a payroll run and an agent’s budget are the integrating party’s business. aledgent sees identities, accounts, authority and value.

1.3 Three kinds of fact

The design depends on assigning every fact to exactly one of three homes.

A ledger fact is a fact about value. It says that an account exists and who may act on it, what it holds and what it has committed, and every entry that moved it and their order. Ledger facts are private by default, provable on demand, and authoritative. They live in aledgent’s book. Nothing outside aledgent may hold a copy and call it true.

A settlement fact is a fact the outside world must be able to check without trusting the operator. It says either that value moved between aledgent and an external counterparty, or that aledgent’s book was in a particular state at a particular time. Settlement facts live on the settlement layer. They are public, unforgeable and deliberately few. The settlement layer is used for external value movement and for anchoring, never to execute an internal movement.

A customer fact is everything else, such as what product an account is presented as, who a holder is as a legal person, what a fee or a price is, and what a compliance process decided. Customer facts live with the integrating party. aledgent does not hold them or need them. Nothing they control can create, destroy, move or hide value.

Trade-off, stated plainly. Internal movements stay off the settlement layer. So the world cannot rebuild a holder’s balance by reading a public record. Provability becomes something aledgent offers to the holder, a verifier or a named counterparty, not something the world simply has. If aledgent lies and nobody ever asks it for a proof, the settlement layer alone will not reveal the lie. §4.6 states exactly what an anchor does and does not establish. §9’s invariants make a lie detectable by the parties who have a stake in the answer.

1.4 Who it is for

Any party that needs to hold and move value for the identities it serves, or for itself:

• a business or platform building a financial product for its users;
• an organisation managing its own treasury and its members’ spending;
• a person, directly;
• an autonomous agent, acting for any of the above within the bounds it was granted.

This document does not distinguish parties by what they build. The party that runs aledgent is the operator (§3). When it holds value of its own, the same rules bind it.

1.5 In scope

The behaviour of aledgent:

• identities, accounts, assets and the book;
• operations and their lifecycle;
• authority, delegation and custody;
• inbound and outbound legs on the settlement layer;
• anchoring and disclosure;
• the surfaces it exposes;
• its operation and recovery.

1.6 Out of scope

• Products, and how value is presented to end users.
• Who a holder is as a legal person, and whether they may transact.
• Prices, quotes and fees.
• Any value network other than the settlement layer.

Value from elsewhere reaches aledgent in one of two ways: through the settlement layer, or by issuance by a principal holding issuance authority for the asset (§5.3). See §12 (deferred) and §13 (non-goals).

1.7 Standing assumptions

1. One operator. Exactly one operator runs a deployment of aledgent.
2. One settlement layer. A deployment is attached to exactly one settlement layer, which satisfies §4.4.
3. aledgent is not a blockchain. It does not seek open participation or consensus among operators who distrust each other. It aims to be a private ledger whose claims can be checked (§13).
4. Possibly one of many. A deployment MAY be one of several attached to the same settlement layer. Another deployment is an ordinary settlement counterparty. Nothing in this document treats it differently from any other (REQ-SL-6).

---