ENCLAVE

Data owners sell answers instead of copies: each question paid once, run inside the owner’s walls, signed on the way out and kept on the ledger.

Open the live chamber in the app
The animated flow, the attack replays and the deep architecture run there; this page is the reference text.

Who this serves

• Public transit authority. Ridership questions answered and paid per query, while the counts stay inside its own walls.
• Retail consortium. Footfall sold as signed aggregates, never as a file that leaves.
• Academic research group. A study’s budget, templates and partners carried as bounds, not as a binder of agreements.
• Data broker. Per-query answers instead of bulk copies that outlive every contract.

The problem

Data sharing still runs on copies. To answer a researcher’s question, an owner ships an extract under a sharing agreement, and from then on nobody can show who asked what, what each answer was worth, or where the file went next; ending the agreement means asking every recipient to delete, and taking their word for it. Clean rooms keep the rows inside, but the licence, the budget and the record of questions still live in contracts and invoices beside them, reconciled by hand.

The system

ENCLAVE is a market for questions. Three data owners run their own frames: the Lindhaven transit authority with four years of door-sensor passenger counts from 1,140 buses and trams, a consortium of 212 retail stores with footfall, and a regional logistics firm with delivery timings. Each exposes query services that run inside its own enclave, one service per approved template, each with its own identity and price, and only aggregates ever leave. At 09:40 on a Wednesday, study-desk, the agent of Dr Nadia Halvorsen’s mobility institute, buys a batch of 120 aggregate queries against the transit counts at 15 units a query: boardings by stop and hour on nine corridors. Every query rides its own single-use payment token; query-LHV-2 verifies it, runs the question against 2.3 billion rows it never lets out, and signs the aggregate it returns. Each token settles exactly once, and every unit it moves is conserved and independently audited.

The desk is a licence seat on the authority’s own frame, and its grant is the authority’s to set and to reduce. It works through a capability token cut from that grant: the three templates the licence names and 18,000 units of query budget, debited atomically. Each template is its own service, so the templates the token may run are the only counterparties it may pay. For the partner lab that builds the corridor model, the desk derives a narrower token: one template, 2,400 units, an earlier expiry. A capability token can only narrow, and whatever the desk issues conveys no more than its grant allows at the moment of use. When the partner reaches for a template the licence never named, the ask is refused before a unit moves.

Every question lands on the append-only ledger beside its price and the signature over its answer, so an audit is a query, not an investigation. The authority lists every question a licence ever asked in one read; the institute shows a reviewer which signed aggregate stands behind each figure in its paper. An answer that query-LHV-2 did not sign never reaches the ledger, and a question nobody paid for is never answered.

The cast and their ceilings

The flow, step by step

1. The authority’s data steward sets the grant behind the institute’s licence seat, and holds the right to reduce it.
2. 09:40. study-desk asks for 120 aggregate queries under its token: three templates, 18,000 units of budget.
3. For the partner lab it derives a narrower token: one template, 2,400 units. It cannot derive a wider one.
4. Each query gets its own single-use payment token, 15 units, checked against the templates and the budget first.
5. Inside the enclave the question meets 2.3 billion rows. The rows stay; only the aggregate comes out.
6. query-LHV-2 signs the aggregate it returns, and the payment token settles exactly once.
7. Question, price and signature land on the ledger, append-only.
8. An audit is a query, not an investigation: every question the licence ever asked, in one read.

Each need, mapped to a live primitive

The attack this chamber refuses: The template nobody licensed

The attack. The partner asks for finer data, and the desk derives it a copy of its authority with a fourth template added: stop-to-stop flows in 15-minute windows, which the licence never named.

Why it fails. A derived token is checked against the token it comes from at the moment it is cut: templates a subset, budget no larger than what remains, expiry no later. The fourth template is not in the parent, so the derivation fails there, and a payment to any template a token does not name is refused at the gate before a payment token exists. A token can narrow what its issuer holds; it cannot add a template.

What actually happens. No wider token exists, no payment token is issued, and no question reaches the enclave. There is nothing to unwind.

The attack this chamber refuses: The grant reduced mid-study

The attack. Six weeks in, the authority and the institute dispute whether a published chart stayed inside the licence. The steward reduces the desk’s grant while the dispute is resolved. The partner lab, which nobody told, sends its next query.

Why it fails. The partner’s token was cut by the desk, and a capability token conveys its caveats intersected with its issuer’s authority as that authority stands at the moment of each request. The desk no longer holds the authority to buy, so every token it ever issued conveys none from the next request on. Nobody hunts for the partner’s token, and no revocation list is published or consulted.

What actually happens. The partner’s query is refused at the gate before a payment token exists. Every question answered before the dispute stays on the ledger, and nothing needs to be unwound.

Deep architecture

ENCLAVE deployed: the transit authority’s frame holds the licence seats, the grants behind them, the query payments and the question ledger; the institute funds its seat from its own frame, in its own currency; the passenger counts sit below in the enclave, read only by the query agent that runs beside them, and only aggregates come up. The trace replays the 09:40 batch, from the grant to the question ledger.

The deployment, traced

1. The authority’s data steward sets the grant behind the institute’s licence seat, and keeps the right to reduce it.
2. At home, Dr Halvorsen sets the study’s query budget on the institute’s own frame.
3. The study treasury funds the seat in the institute’s own currency.
4. It converts through the FX pool between the two frames.
5. And lands on the seat, on the authority’s frame, exactly once.
6. 09:40. The desk asks for 120 aggregate queries under its token: three templates, 18,000 units of budget.
7. For the partner lab it derives a narrower token: one template, 2,400 units. A capability token can only narrow.
8. Each query gets its own single-use payment token, 15 units, once its template and the budget are checked.
9. The paid question goes down to query-LHV-2, inside the enclave.
10. It meets 2.3 billion rows that never leave. Cells under twenty boardings are suppressed, by the authority’s own rule.
11. The query agent signs the aggregate it returns, and the payment settles exactly once.
12. Question, price and signature land on the ledger, append-only. An audit is a query, not an investigation.

Adoption, phase by phase

Discover: One sharing agreement, re-read as templates.

• Runs. Nothing. One existing data-sharing agreement redrawn as templates, prices, a budget and a term.
• Agents. None. The data steward and the research group argue over which questions deserve a template, which is exactly where that argument belongs.
• Integrates. Nothing. The warehouse, the clean room and the agreement stay exactly as they are.
• Deliberately not yet. No seat, no token, no payment. The extract the agreement allows still ships the old way.
• Proof that gates the next phase. Last year’s questions under that agreement re-expressed as template calls, and both sides agree every figure they published maps to one.

Pilot: One template, one licensee, pilot prices.

• Runs. A hosted registry seat for the authority. No frame of its own yet.
• Agents. One query agent inside the enclave and one licensee desk.
• Integrates. The query agent reads the warehouse through the owner’s existing aggregation layer and signs each answer.
• Deliberately not yet. One template, one currency, no partners. The extract still ships in parallel.
• Proof that gates the next phase. A month of questions, each paid once and each answer signed, and one deliberately unlisted template refused before any payment token existed.

Production: The authority’s own frame; extracts retired.

• Runs. The authority’s frame: registry, TEG, event store, identity fabric, in its own data centre.
• Agents. A query agent per approved template, a seat per licensee, and partner seats that hold nothing of their own.
• Integrates. Grants follow the agreement register; finance reads settlement instead of invoices.
• Deliberately not yet. Other owners. One market proves itself first.
• Proof that gates the next phase. An audit lists every question a licensee asked, what each cost and which signature stands behind each answer, from the ledger alone.

Federation: Owners bring their own frames.

• Runs. Unchanged. The retail consortium and the logistics firm federate their own frames and sell from them.
• Agents. Buyers hold seats with several owners; their settled records travel with their identities.
• Integrates. Each new owner is a signed card and a licence, not a new clean-room contract per buyer.
• Deliberately not yet. Nothing structural. Growth is owners, templates and buyers.
• Proof that gates the next phase. A buyer licensed by one owner pays for its first question against a second owner within a week, without a bilateral integration project.

Sizing

One question, payment token to signed answer

sequenceDiagram
  participant Desk as study-desk (licence seat)
  participant Gate as licence gate
  participant Pay as query payments
  participant Q as query-LHV-2 (enclave)
  participant ES as question ledger
  Desk->>Gate: query 37 of 120, under the study token
  Gate->>Pay: template and budget checked: single-use token, 15 units
  Desk->>Q: the question and the payment token
  Q->>Pay: verify the token
  Q-->>Desk: aggregate, signed
  Q->>ES: attestation: the question and a signature over the answer
  Desk->>Pay: settle on delivery
  Pay-->>Q: paid, exactly once
  Pay-->>ES: payment settled, append-only
  Note over Gate: a template the token does not name is refused before any payment token exists
  Note over ES: an audit is a query, not an investigation

Topology, as declared

flowchart LR
  ST(["data steward<br/>the grant"]) -->|"grant, reducible"| G{"licence gate<br/>templates, budget,<br/>issuer authority"}
  D["study-desk<br/>licence seat"] -->|"120 queries"| G
  D -.->|"narrower token"| PL["partner-lab<br/>one template"]
  G -->|"single-use token"| P["query payment<br/>exactly once"]
  E[("transit enclave<br/>rows stay inside")] -.->|"aggregates only"| Q["query-LHV-2"]
  Q -->|"answer, signed"| P
  P --> L[("question ledger<br/>asked, priced, signed")]
  L -->|"an audit is a query"| R["reviewer"]

Standing it up

• Infrastructure. Each data owner on a frame of its own, booted from the free licence. Buyers fund their seats from their own frames or from a hosted account.
• Agents. One query agent per approved template on the owner’s side, and a seat per licensee. The query logic is the owner’s; the SDK carries identity, payment verification and signing.
• Integration. The enclave itself: the warehouse, the aggregation rules and the minimum group size. This is where the real time goes, and it stays the owner’s.

Runs beside what you already have

• Data warehouses and lakehouses. The rows stay where they are. The query agent runs beside the warehouse, inside the owner’s walls, and only signed aggregates leave.
• Clean-room products. The clean room keeps doing the computation. ENCLAVE carries the licence, the price of each question and the record around it.
• Data catalogues. An approved catalogue entry becomes a priced query template with its own identity. The catalogue stays where owners describe what they hold.
• Contract and data-sharing agreement management. The signed agreement stays with legal. Its operative terms, the templates, the budget and the term, become the grant and the caveats that enforce them.

A full sovereign frame is nine containers and boots in about two minutes, on anything from a Raspberry Pi to a rack. That is cheap enough to run the whole system in parallel with the legacy stack: the old system keeps running, real work mirrors onto the rails, and you compare ledgers until the evidence settles the argument. Nothing is ripped out.

Planned: a public proxy library. Free, ready-made connectors for the systems above and whatever else a merge needs, so the bridge is an import, not an integration project.

What this does not claim

• ENCLAVE does not see, store or process the data. It carries who may ask what, what each answer cost, and the record of every question.
• Privacy, aggregation and every data-protection duty stay with the enclave’s owner. The minimum group size is the owner’s rule, enforced inside the owner’s walls; a proof that each answer met it is designed, not built.
• No claim of conformity with any data-protection law, certification or data-sharing scheme is made or implied. Those questions stay with the owners, the buyers and their regulators.