All four platforms available
Talk to usSee a governed action

Compare the levelsAll of elan1 Govern

elan1 GOVERN · L1 GUARDED

Can I let this run?

L1 Guarded: a tamper-evident record of every agent write

L1 Guarded is elan1 Govern's first assurance level. Every agent write takes the Right Path, passes approvals where your rules ask, is committed by a single writer and is recorded in a SHA-256 hash-chained proof record, so any later change to a record is evident to you. It is tamper-evident, not tamper-proof.

L1, L2 and L3 are levels of a claim, not separate products or brands. There is one elan1 Govern and one record shape. The level says what a record can prove, and to whom.

Status: L1 · Guarded · Available
See a governed actionRead the proof record
L1 GuardedAvailableL2 AttestedAvailableL3 ProvenOn acceptanceL1 GuardedAvailableL2 AttestedAvailableL3 ProvenOn acceptance

01What it does

The full write path. The cryptographic tail comes at L2.

L1 is not a cut-down version of elan1 Govern. Every write climbs the whole Right Path, from rung 0b STOP to rung 9 METERED. What L1 does not add is a signature and an outside clock; those come with L2.

  • Nine pre-gates.

    G1–G9 run on every write. Six can never be skipped: consent, residency, retention, dual control, counterparty and precondition.

  • Rules with no model.

    evaluate() applies your versioned rules. No model sits on the allow path.

  • Guardrail and autonomy.

    The blast radius is measured. Autonomy levels A0–A5 decide when a person must approve.

  • Named approvals.

    The approver is never the asker, and sees the change, the gate results and the policy version first.

  • One writer.

    A single-use credential that lasts 10 minutes, sandbox first.

  • The record.

    16 fields under Seal v6, SHA-256 over a length-prefixed preimage, hash-chained per tenant. Evidence rows cannot be updated or deleted.

  • Refusals.

    A typed code, a proof record, and 0.4 of a governed action on the meter.

02Who it’s for

The people asked to let an agent touch the books.

  • The operations or finance owner who is asked to let an agent touch the books.
  • Financial controllers and heads of internal audit who must show who allowed each write, under which rule.
  • Agent vendors whose product writes to someone else's system of record, and who have been asked who approved what.

03How it works

Ask, check, approve, act, record.

Five plain steps map onto the ten rungs, and any rung can refuse. To check a record at L1, recompute its digest and compare it with prev_digest on the next record. A changed or missing record breaks the chain.

  1. AskAn agent proposes a write intent. The stop switch is read first; then who is asking, and through which write type.Rungs 0b STOP · 1 IDENTITY · 2 WRITE DOOR
  2. CheckNine pre-gates, your versioned rules with no model, and the blast-radius guardrail.Rungs 3 PRE-GATES · 4 evaluate() · 5 GUARDRAIL
  3. ApproveAbove the autonomy ceiling, a named person who is not the asker decides.Rung 6 AUTONOMY
  4. ActA single writer makes the change with a single-use credential, sandbox first.Rung 7 ACT
  5. RecordThe 16-field proof record is sealed and hash-chained, and one meter event is written. A refusal is recorded too, metered at 0.4 of a governed action.Rungs 8 PROOF · 9 METERED

Walk through every rung

Illustrative specimen — not a customer recordL1 · Available
Illustrative specimen — not customer dataL1 · Guarded
Proof record · Seal v6 · 16 fields “no seventeenth field, ever”
F01tenant_id
tnt_specimen_01
F02seq
1042
F03prev_digest
sha256:9f3c…e41a
F04write_id
wr_specimen_7c2
F05write_type
journal_entry.post
F06declaration_id
decl_month_end_close
F07declaration_version
7
F08policy_version
2027.06.1
F09actor_id
usr_specimen_approver
F10actor_kind
human
F11autonomy_level
A2
F12record_id
je_specimen_5531
F13record_version
2
F14payload_hash
sha256:51b0…7d9a
F15lexicon_hash
sha256:e2c4…0b16
F16recorded_at
2027-07-14T10:42:07+05:30
Committed · approved by a named person · metered: 1 governed action
when · who · hash — checked and recorded by elan1 Governtamper-evident (L1)
Illustrative specimen. Not customer data.

At L1 the signature field is absent, not stubbed.

Check the chain yourself

Two records linked by digest. Change one field and the chain shows the break.

Record 1042 carries the digest of record 1041 in F03 prev_digest. Recompute both with SHA-256 in this browser, then change a field and recompute again. Nothing is sent anywhere. Illustrative specimen. Not customer data.

Evidence object · Illustrative specimen. Not customer data.Tamper-evident (L1)
Press “Recompute records 1041–1042” to hash both records with SHA-256 in this browser.

Illustrative specimen. Not customer data.seq 1041 · L1 · Guarded

Rendering · shown beside the record, never a seventeenth field

Outcome
Refused Refused at rung 3 · PRE-GATES
Approver
None. The write stopped before approval.
Refusal code
GATE.PRECONDITION_FAILED (illustrative)
Meter
0.4 governed action
4 of 16 fields: F01–F03, F14
tnt_specimen_01
1041
sha256:058169bb8da3e9f6b1b8511193b43b0636ffe1ecc6e4c46ce8a8a905964023f8
wr_specimen_7c1
purchase_invoice.post
decl_ap_purchase
4
2027.06.1
agt_specimen_ap01
agent
A1
00000000-0000-0000-0000-000000000000
0
sha256:5f105d2d818bc7fe36a7c1b7e367196610df5ee6e8d4c5296c9d8cc4b28428d8
sha256:1d967c9d1c583efd0a3135e57aa1035ebdd5ab4766f0572f10304feae7516d53
2027-07-14T10:39:12+05:30
Digest of seq 1041Not yet recomputed in this browser

Checked and recorded by elan1 Govern · tamper-evident (L1)

Record 1042 points back to record 1041 by digest (F03 prev_digest).

Illustrative specimen. Not customer data.seq 1042 · L1 · Guarded

Rendering · shown beside the record, never a seventeenth field

Outcome
Committed Committed at rung 7 · ACT
Approver
usr_specimen_approver, a named person who is not the asker
Refusal code
None
Meter
1 governed action
4 of 16 fields: F01–F03, F14
tnt_specimen_01
1042
sha256:8e37839e9548dfa9a4a8948b723c1517afb532a7eaceb617a7db6eff0ffdeac0
wr_specimen_7c2
journal_entry.post
decl_month_end_close
7
2027.06.1
usr_specimen_approver
human
A2
je_specimen_5531
2
sha256:e1eb0d8f0a7399695abf290e8fd2b6abc738ffd2fbdb8297f9ae44eb1a32ab6a
sha256:fd8e4d0b12b24bf22a591e735f211d8d7bb2bdf480058fdf89bb9d44666b2633
2027-07-14T10:42:07+05:30
Digest of seq 1042Not yet recomputed in this browser

Checked and recorded by elan1 Govern · tamper-evident (L1)

Next record · seq 1043 · F03 prev_digestsha256:f2423aa3d4559b7fd54b390a724f2a989744c10db034caa4a0e047cb5aca2c18

Verify offline (simulated)

L2 · Available Simulated here. The real check runs in the free offline verifier.

  1. 01

    Signature

    Check the Ed25519 signature on record 1042 against the residency domain's public key, obtained out of band.

  2. 02

    Anchoring

    Check the Merkle root that contains record 1042 against timestamps from two RFC 3161 authorities, anchored within 15 minutes.

  3. 03

    Evidence bundle

    Open the eight-member evidence bundle and run the free offline verifier, elan1-verify, on your own machine with no network.

At L1 records are hash-chained, not signed, and the check needs elan1. The three steps above describe the L2 design. Nothing on this page was signed or anchored.

How the browser recomputes: the preimage is the 19-octet domain string elan1.proof.seal.v6, then each of the 16 fields as a 4-octet big-endian length followed by its bytes. SHA-256 runs through WebCrypto on this device; nothing is sent. Where this is weak: the specimen encodes every field as UTF-8 text, while Seal v6 encodes identifiers and digests as fixed binary octets. It shows the method, not a production verifier.

04In the console

The record and the chain, as an auditor would see them.

Two Govern console screens that show L1 at work: a single proof record, and the standing of the whole chain. Each says plainly what L1 cannot claim.

elan1 Govern · Illustrative specimen/govern/assurance/proof/4101
Illustrative specimen: the elan1 Govern console Proof record screen. The proof record for a committed invoice: who proposed it, who approved it, under which declaration and policy.
Proof record. The proof record for a committed invoice: who proposed it, who approved it, under which declaration and policy.
  1. Each record carries the digest of the one before it, so the chain can be re-walked.
  2. The screen says what it cannot claim: hash-chained, not signed, at Assurance Level 1.
  3. Enforcement mode, channel and autonomy level are recorded on the entry itself.
elan1 Govern · Illustrative specimen/govern/assurance/chain
Illustrative specimen: the elan1 Govern console Chain standing screen. Is the record complete and unbroken? The answer is continuous, broken at a sequence number, or not checked.
Chain standing. Is the record complete and unbroken? The answer is continuous, broken at a sequence number, or not checked.
  1. A nightly full walk plus a re-walk of the head every few minutes, each printed with its scope.
  2. Refusals and waiting writes sit in the same chain as committed ones.
  3. The scope is stated, not implied: 19 of 23 write types.

Illustrative specimen. Not customer data. Fictional sandbox data from the console.

05What it connects to

Writes go through elan1 Govern.

Work and Decide reach Govern through KernelPort, six calls: define, assert, seal, verify, scope, refuse. Agents you already run connect over MCP or HTTP. elan1 Run carries Govern's work under contract.

Consumers of elan1 Govern at L1, their mode, and what we may say
ConsumerModeWhat we may say
elan1 Work, hosted ERPNextMode A · Enforced“No write reaches the system of record without a gate decision and a proof record.”
elan1 Work Attach · elan1 Decide · elan1 Run toolingMode B · Attested advisory“Evaluated against your rules and recorded.”
Third-party agentsMode B · Attested advisory Mode A by agreementNo “runs on elan1” claim until conformance tests C1–C14 pass

Contracts and integrations

06What it costs

Paid per governed action. A refusal costs 40% of one.

L1 Guarded prices. Exclusive of GST.
WhatPrice · excl. GSTIncludes
L1 Guarded₹1,80,000 per tenant per year4,80,000 governed actions a year included
Beyond allowance, L1 Guarded₹1.60 per governed action
Refusal beyond allowance, L1 Guarded₹0.64 per refusal40% of ₹1.60
Refusal, at any level40% of one governed actionWithin the allowance, a refusal uses 0.4 of an included governed action; beyond it, it is billed at 40% of your level's rate

All prices are exclusive of GST. Prices are current list prices; GST is added at the applicable rate on the invoice.

The floor includes a yearly allowance of governed actions, consumed first; only actions beyond it are billed. First purchase: a 90-day ledger1 pack pilot through your CA or audit firm. No per-seat price, no outcome pricing, and the floor is not discounted.

All prices are exclusive of GST. GST is added at the applicable rate on the invoice.

See L1 Guarded pricing

07Status

Available now.

L1 Guarded is available. Production keys are never self-serve.

  1. KernelPort v1Six calls, frozen, with one record shape.Available
  2. L1 GuardedThe full Right Path and a tamper-evident proof record on every write.Available
  3. Third partiesAgents you already run connect over KernelPort, MCP or HTTP.Available

Available now. Future improvements are listed, in order and without dates, on What’s next.

Sandbox keys are self-serve. Production keys are issued by elan1 after an onboarding checklist, never self-serve.

See what’s next

08What it does not do

The edges of the L1 claim.

Every claim on this page has an edge. These are the ones at L1.

  • It does not sign records. Signing comes from L2.
  • It does not let someone check a record offline without us. That comes from L2.
  • It does not make a record impossible to alter. It makes alteration visible.
  • It does not prove the business decision was right, or that your rules were good.
  • In Mode B it does not block. It evaluates and records.
  • It does not make you compliant with any regulation on its own.

09FAQ

Eight direct answers about L1.

Next steps

Related reading

One write path, four layers

Proposeselan1 WorkProposes what should changeProposeselan1 DecideProposes the answerControl planeelan1 GovernAllows, refuses, recordsRuntimeelan1 RunCarries every call under contract

Work and Decide propose. Govern and Run assure. Only Govern allows.

// elan1 GOVERN · L1

See one write climb the whole path.

Follow a governed action from write intent to a tamper-evident proof record, and watch a refusal write its own record, metered at 0.4 of a governed action. L1 Guarded is available now.

See a governed actionTalk to usCompare the levels