Tokenising an asset creates the object. It does not answer who may use it, under what limits, or which controls must agree.
Cartulary is a working design probe for machine-initiated payments. It separates what is running, what has only been proposed, and what remains unresolved.
Built
Running now, and open to inspection.
- Mandates, versioned policies, and allow, hold, or refuse decisions.
- A simulated treasury with a working hold desk.
- Append-only receipt chains with a published verifier.
- Test-value USDC settlement on Base Sepolia.
- Separately, a narrow external-signing experiment against a local Canton network using the example Iou model, not integrated into the hosted application.
Proposed
Argued for, not built. No dates.
Unresolved
Open questions. Answers welcome.
- How rolling limits should work on-ledger.
- Who may see the terms of a mandate.
- Whether decision commitments create correlation leakage.
- Whether institutions would operate the off-ledger component themselves.
- Whether the control plane should exist as a product at all.
What the prototype exposes
In the hosted prototype, four of six controls are enforced by the same service that records them. Only validation beside the external signer and the ledger's own rules sit outside that decision service. The resulting question is whether transaction-critical authority should live with the asset rather than be asserted beside it.
Built as an exploratory implementation. Questions and criticism are welcome as an issue in the open repository.