Platform · Architecture
Four principles. Held across every arm.
The architecture is the part that does not change between markets. The records and the regulators differ; the principles by which records are kept and verified are the same. This page documents the four principles and the reason each was chosen over its alternatives.
The principal holds the keys
What it means. The data is the institution's, not the platform's. The keys that decrypt it are the principal's, not the vendor's. The records are exportable in a structured form at any time, with no fee, no negotiation, no waiting period. Migration is a copy operation.
Why this instead of vendor-controlled data. The alternative pattern — vendor holds the data, principal rents access — turns the records into a hostage. The principal cannot leave without losing what makes the institution operate. Sovereignty makes the relationship voluntary in both directions.
The architecture does not sleep
What it means. Routine inquiries are answered, records are checked, provenance is verified around the clock. The principal is not required to be reachable for the institution to keep operating. Time zones, illness, travel, holidays — none of these stop the work that does not actually require the principal's judgement.
Why this instead of business-hours operation. The institution's clients do not live on the principal's schedule. An international collector in a different timezone, a museum lender on a deadline, a buyer who decided at 11 PM — none of them benefit from a system that waits for morning. Continuous operation is the difference between losing the opportunity and capturing it.
Records that survive the keeper
What it means. The records — provenance, attribution opinion, sourced documentation, exhibition history, correspondence, custody chains — are held in a structured, transferable form outside the principal's personal systems. When the principal retires, sells, or otherwise exits, the records pass intact to the next steward.
Why this instead of records-in-the-principal's-head. Institutional knowledge concentrated in one person is fragile. The cost of recovering it after that person exits is often higher than the value of recovering it at all. Transferable records eliminate that cost by separating the institutional record from the principal's personal memory and tools.
The principal is shown what matters
What it means. Routine work is handled silently. Exceptions — things that genuinely need the principal's judgement — surface clearly. The principal does not log in to a dashboard to find out what happened; the architecture shows them what required their attention and lets the rest stay quiet.
Why this instead of dashboards. A dashboard makes the principal responsible for noticing the right thing among the wrong things. Exception-surfacing reverses that: the architecture is responsible for filtering, and the principal is responsible only for the decisions that genuinely need them. The principal's time is the scarcest resource; the architecture protects it.
The four principles compose.
The principles are not separate features. Sovereignty without continuity gives the principal records they own but no one is using. Continuity without sovereignty gives them a busy system they don't control. Transferable provenance without exception-surfacing gives them a transferable mess. Exception-surfacing without sovereignty gives them a quiet system that another company can take away.
The four together describe one shape — verification infrastructure as it is shaped for working institutions, where the records, the operation, the future stewards, and the principal's time all matter at once.