---
title: "Preserve authority events in an append-only ledger."
description: "Model eligibility, missing conditions, denial, revocation, expiry, and supersession as append-only events in the local TEST_ONLY contract. Tamper resistance and independent audit remain unverified."
updated: "30 August 2026"
availability: "LOCAL SIMULATION · TEST_ONLY"
candidate_route: "/docs/raiffa/foundations/authority-ledger"
---

# Preserve authority events in an append-only ledger.

Model eligibility, missing conditions, denial, revocation, expiry, and supersession as append-only events in the local TEST_ONLY contract. Tamper resistance and independent audit remain unverified.

**LOCAL SIMULATION · TEST_ONLY:** Local validation surfaces and fixed fixtures only · no real login, organizational authority, operational API, external execution, or authority issuance

## The ledger preserves events before current state

- Grant candidate or eligible evidence
- Missing conditions and deny reason
- Revoke, expire, and supersede
- Tenant, case, actor, scope, and policy binding
- Nonce, revision, and hash-chain coordinate

> **Current implementation:** SQLite/WAL local simulation with independent audit still pending.

## Current state must be rebuildable from events

1. **Read append-only events** — Verify sequence and hash without mutating prior events.
2. **Project state by binding** — Derive the latest valid revision and lifecycle state.
3. **Rebuild after restart** — The same events must produce the same projection without memory state.
4. **Revalidate before use** — Compare projection, ledger head, and current request binding.

## The local ledger is not an authority issuer

Test functions named issue or grant do not create organizational authority. The package validates a fixture GateResultPort and local SQLite behavior; it is not an action dispatcher or production access-control system.

> **BOUNDARY:** LOCAL_SIMULATION · TEST_ONLY · AUTHORITY NONE · no dispatch

---

Published route: /docs/raiffa/foundations/authority-ledger