elan1 GOVERN · L3 PROVEN
Does this survive the vendor?
L3 Proven: begins on auditor acceptance
L3 Proven is elan1 Govern's third assurance level: evidence that stays checkable even if elan1 is gone. It has no launch date. It begins for a tenant when an outside auditor accepts that tenant's L2 Attested evidence bundle in writing, and the L3 price applies only from that point.
Levels are levels of a claim, not separate products or brands. L3 is a claim we may only make once someone outside elan1 has accepted our evidence.
01The trigger
L3 begins when an outside auditor accepts an L2 bundle in writing.
The auditor must not work for elan1 and must not be paid by elan1. They must accept an L2 evidence bundle as evidence in a real engagement, and say so in writing. L3 capabilities are available on request; the L3 claim applies from the day that acceptance is in writing, never before. That is why this page has no date.
No date. An event: an outside auditor accepts an L2 bundle in writing.
02What L3 requires
Five things, none of which we can grant ourselves.
Each is a condition, not a feature. All five must hold before we use the word Proven.
- The trigger event above.Event
- A second seal implementation, written independently, that produces identical bytes across every published test vector.Required
- Published test vectors for the record format.Required
- A counter-signature from an organisation that is not elan1.Required
- The Action Receipt specification (
action-receipt/1) published so that others, competitors included, can implement it.Required
03What it adds
Checking that crosses organisations.
Available on request. The L3 claim applies only after the trigger event.
- Cross-organisation checking.
The receipt is the unit that crosses. A receiving organisation records its acceptance as its own governed write, under dual control.
- Selective disclosure.
Show an auditor or a lender the fields they need, and no others.
- Customer-held keys,
for buyers whose key policy requires them.
- Sovereign deployment,
a deployment shape for buyers who need elan1 Govern under their own control.
- Precedent and earned autonomy.
A deterministic score, with no model, over a write type's own record. Only A2 Propose can graduate to A3 Act reversible, under dual control.
- The same record.
16 fields. No seventeenth, at L3 or ever.
In the console
Earned autonomy builds on the autonomy grants the Govern console already shows from L1: per write type, A0 Observe to A5, with raising a grant itself a governed write under dual control.
- A missing grant reads A0 Observe, never a blank.
- Raising a grant is itself a governed write with dual control; taking it back is one press.
- No reversal plan means no A3 or above.
Illustrative specimen. Not customer data. Fictional sandbox data from the console.
04Who it's for, and what it connects to
For organisations that check each other's receipts.
Who
Two organisations that exchange receipts and need to check each other’s. Regulated enterprises with their own key policy. Government and sovereign buyers. Teams that must disclose part of a record and keep the rest private. Operations owners who have outgrown approving every change.
Connects to
The same write path, packs and record as L1 and L2. Modes do not change: Mode A stays enforced, Mode B stays attested advisory. L3 adds no new meter.
05What it costs
Floors, on auditor acceptance. No date.
| What | Price · excl. GST | Includes |
|---|---|---|
| L3 Proven | ₹24,00,000 per tenant per year | 42,00,000 governed actions a year includedApplies once an outside auditor accepts your L2 bundle in writing. |
| Beyond allowance, L3 Proven | ₹0.90 per governed action | |
| Refusal beyond allowance, L3 Proven | ₹0.36 per refusal | 40% of ₹0.90 |
| Sovereign or on-premises deployment | ₹1,20,00,000 per deployment per year | Your own residency domain and keys; the floor carries the fixed cost |
| Sovereign deployment | ₹0.55 per governed action | |
| Refusal, at any level | 40% of one governed action | Within the allowance, a refusal uses 0.4 of an included governed action; beyond it, it is billed at 40% of your level's rate |
All prices are exclusive of GST. Prices are current list prices; GST is added at the applicable rate on the invoice.
No date: L3 prices apply once an outside auditor has accepted your L2 bundle in writing. No per-seat price, and no outcome pricing.
All prices are exclusive of GST. GST is added at the applicable rate on the invoice.
06Status
On auditor acceptance.
When an acceptance happens, we say so on What's next, and describe it with the auditor's permission.
Status: On auditor acceptance
- L1 and L2L1 Guarded and L2 Attested: available now.Available
- L3 ProvenWhen an outside auditor accepts an L2 bundle in writing. No date.On auditor acceptance
Available now. Future improvements are listed, in order and without dates, on What’s next.
07What it does not do
The edges of the L3 claim.
L3 widens who can check a record. It does not change what a record can prove.
- It does not make a record impossible to alter. It makes alteration visible, to more people.
- It does not prove a transaction was genuine.
- It is not a certification, and it does not mean a regulator approved anything.
- It does not make an agent safe because it earned A3. Earned autonomy can be revoked by one person.
- Until another organisation's implementation passes, we call the Action Receipt published, not open.
08FAQ
Six direct answers about L3.
When an outside auditor accepts a tenant's L2 bundle in writing. There is no date: L3 is reached on that event, and its capabilities are available on request.
An L2 Attested evidence bundle, as evidence in a real engagement, confirmed in writing. The auditor must not work for elan1 and must not be paid by elan1.
The L3 Proven platform floor is ₹24,00,000 per tenant per year with 42,00,000 governed actions included, and actions beyond that cost ₹0.90 each. These prices apply only once an outside auditor has accepted your L2 bundle in writing, and all prices are exclusive of GST.
Because the trigger is someone else's decision. A date would be a promise we cannot keep on our own.
It is published as part of L3, so others can implement it. We call it open only when an implementation that is not ours passes.
Only if your counterparties must check receipts without trusting your vendor, or your key policy requires you to hold your own keys. L1 and L2 answer the earlier questions.
Next steps
One write path, four layers
Work and Decide propose. Govern and Run assure. Only Govern allows.
// elan1 GOVERN · L3
A receipt that outlives the vendor.
L3 Proven has no date. It begins when an outside auditor accepts an L2 bundle in writing. Until then, talk to us about what L1 and L2 already answer.