A flag rests on an authorisation, and cannot be turned on while that
authorisation is not held. Record the authorisation with its evidence and the flag opens
on its own — the order is deliberate, so the permission always exists before the thing
it permits. Changing a flag needs a new reason: the old one explains the old state.
Jurisdictions
—
A jurisdiction cannot be opened to an instrument the platform is not
authorised to offer anywhere. Saying a country permits something is a claim about that
country; being able to do it is a claim about us, and this only lets you make the first
once the second is true.
Ledger
—
Append-only. Nothing here can be edited or deleted — a correction is the
opposite entry, posted with a memo saying what it corrects, so the mistake and the fix
both stay visible.
Reporting
—
Computed, never typed. This is the position the platform could be asked to
state about itself: what came in, from where, under what instrument, what went out, and
which permissions were in force while it happened.