Everything on the record.
Nothing around it.
A permanent record, fail-closed permissions, certified agents, encrypted backup to your own disk — and restore is copying the folder back.
Nothing gets a side door.
Unknown devices, undeclared commands, and unbound principals fail closed.
One governed path.
Identity, policy, transaction, event, and receipt stay bound together.
The record is append-only.
Every sale, promise, and change is appended, never edited, never erased. History can be read; it cannot be rewritten.
Agents are certified.
An AI operates under a named entry in your rulebook with its own listed commands. It has the authority you wrote down — and no more.
Backup is your disk.
Encrypted backup goes to a drive you hold. Restoring is copying the folder back — on any Mac or Linux machine, with nobody's permission but yours.
See it at the door.
Permissions fail closed at the door — a refusal names the reason, and the refusal itself is recorded.
$ whale cmd action.approve --json '{"id":"act_92"}' # refused · principal "clerk-2" may not approve actions · recorded $ whale cmd metrics.read --json '{"metric":"record.events"}' # 1,204,318 events · append-only · none altered, ever
Unlisted capability fails closed.
For people and AIs alike: what the rulebook doesn’t grant, the door refuses — with the reason, on the record. There is no side door to find.
more capabilities: customers & loyalty · workflows & reports · devices & hardware