Architecture deep-dive
Ledger is the append-only provenance layer behind Kit — signed settlement history that receipts, exports, and standing checks rest on.
How provenance works under the hood.
Paybond Ledger
Most teams integrate Paybond Kit and never land here. This page is for partners who need audit-package or selective-disclosure detail behind Kit receipts.
Settlement Approved
Verified- Intent
- Evidence
- Receipt
- Signature
- Export Ready
The reviewer package
A Ledger-backed export is a bounded package for one tenant and one window, with manifests, hashes, and verification instructions reviewers can check offline.
Audit export bundle
Generated July 5, 2026
Export details
- Tenant scope
- acme-travel-prod
- Resolved from authenticated organization credentials.
- Ledger tip
- seq 41,124 / tip 8f3c...a91d
- Manifest
- manifest.json signed, 9 artifacts hashed
- Verification result
- verified; no digest drift
Included files
manifest.json
Signed manifest with artifact digests and captured checkpoint.
proof.json
Continuity proof for the captured ledger tip.
receipt.json
Signed settlement receipts included in the export window.
verification.txt
Plain-language steps for checking the package offline.
Logs tell you what happened inside. Provenance lets others check it.
Database logs are an internal debugging surface. Ledger packages signed settlement history into a bounded artifact a reviewer can independently verify.
Mutability
- Database logs
- Mutable
- Paybond Ledger
- Signed
Access
- Database logs
- Internal only
- Paybond Ledger
- Shareable
Verification
- Database logs
- Hard to verify
- Paybond Ledger
- Cryptographically verifiable
Delivery
- Database logs
- Requires DB access
- Paybond Ledger
- Export package
Format
- Database logs
- Different formats
- Paybond Ledger
- Standard evidence bundle
From settlement event to reviewable evidence
Ledger turns authenticated settlement activity into a bounded reviewer package with continuity, hashes, and the context needed to understand it.
How Kit and Ledger fit together
Kit is what you write against; Ledger is the signed history behind receipts and exports. Most teams never call Ledger APIs directly.
Kit
SDK you integrate — receipts and exports already rest on this history.
Ledger
Append-only provenance layer that records signed settlement events.
The path from agent action to auditor proof
Settlement events flow through authorization and payment rails into signed Ledger history, then into an evidence package reviewers can verify offline.
One signed history, different review contexts.
Ledger keeps settlement records, receipts, verifier packs, and dispute material aligned without giving reviewers raw database access.
Record decisions
Every settlement event is preserved as signed evidence that cannot be rewritten.
Ledger and provenance>Scoped access
Share only the evidence reviewers need without exposing production systems.
Ledger and provenance>Review-ready exports
Generate audit bundles with receipts, signatures, and manifests.
Compliance exports>
- Settlement
- Sign
- Record
- Credentials
- Tenant
- Scope
- Manifest
- Receipts
- Hashes
- Package
- Signatures
- Valid
What's included in the record
Ledger captures the settlement story end to end so exports and verifier packs stay complete.
- Intents and authorization decisions
- Payments, refunds, and settlement outcomes
- Disputes and reviewer actions
- Signed receipts and file hashes
- Manifests and verification instructions
How Ledger fits your stack
Agents authorize spend through Kit, settle on configured rails, and produce exportable evidence from the same signed history.
Agent
Harbor
Stripe
Ledger
Evidence Export
Export in code
Create tenant-scoped compliance export jobs through Kit with `create()`—backed by Gateway POST /v1/compliance/audit-exports.
audit-export.ts
// POST /v1/compliance/audit-exports
const job = await paybond.audit.exports.create({
filter: {
time_start: "2026-05-01T00:00:00Z",
time_end: "2026-05-07T23:59:59Z",
},
disclosureTier: "standard",
});Output bundle
Completed jobs produce a tenant-scoped ZIP reviewers can verify offline.
- manifest.json
- proof/ledger_verifier_pack.json
- harbor/intents/{intent_id}.json
- VERIFICATION.txt
Where this architecture shows up
The same signed history supports auditors, partners, compliance teams, and support desks without giving them raw database access.
Compliance and audit packets
Generate reproducible exports backed by signed history for internal controls and third-party review where exports are enabled.
Financial auditors
Hand reviewers an export package with manifests, hashes, and verification steps they can replay without database credentials.
Procurement and security teams
Give procurement, finance, and security teams a consistent evidence trail across agents, rails, and settlement outcomes.
SOC 2 reviewers
Demonstrate controls with tenant-scoped exports, redaction tiers, and offline verification instead of console screenshots.
Partner verification
Share a bounded proof package that validates settlement claims without granting database access or exposing unrelated tenant data.
Dispute resolution
Preserve evidence, reviewer actions, and settlement decisions as part of one record so escalations remain attributable and reviewable.
Evidence you can stand behind
- Tamper-evident
- Signed
- Immutable
- Exportable
- Offline-verifiable
Verification without raw database access.
Ledger powers tenant-scoped verifier packs and signed audit exports, not a public event firehose. Reviewers get the evidence package, manifest, proof material, and verification result they need.
Properties
- There is no public raw ledger event stream; reviewers use Gateway audit exports, verifier packs, manifests, and verification results.
- Audit exports are available where enabled for the plan and tenant, with standard and extended redaction profiles.
- Every export and verification request is authenticated, tenant-scoped, and access-logged.
- Corrections are appended as follow-up records so reviewers can see what changed and why.