Chapter 2 · Why the World Depends on Ledgers
Who has the power to change the ledger?
- Capabilities practiced
- Mental ModelSystem Thinking
- Hands on
- List five kinds of assets you own. For each, state whose ledger records it and who can change that entry.
- AI Lab
- Have AI diagram the permission structures of bank, brokerage, land-registry, and payment-platform ledgers. Pick one error and explain why it is wrong.
A Real-World Problem
Someone is selling the home they have lived in for ten years. Halfway through the paperwork, a clerk says the area recorded in the system differs from the deed. It must be corrected first.
The correction takes forty days. Not one brick moves during those days, and the owner still lives there. But they cannot sell or mortgage it.
Do they “have” the home during those forty days?
The building exists, but the correct record does not. Every situation requiring proof that they own it relies on that record.
Now broaden the example. Open your phone and look through:
- A number in your banking app
- Holdings in your brokerage app
- A payment-platform balance
- Airline miles
- An account you have used for eight years with tens of thousands of followers
All of these are records. None is something you can hold in your arms. They sit in five different institutions' databases. Each is a row, and every row can be changed.
Chapter 1 described money as an accounting system. This chapter asks one level deeper:
Who holds each ledger? Who can change your row? Can you discover that change afterward?
Thought Experiment
Return to chapter 1's village, now in year seven.
One page in Wang's notebook is yours. At the start of the year, it says: you, 200 shells.
That page changes seven times this year.
First: You buy rice for three shells. You authorize the payment verbally and watch the change. Balance: 197.
Second: The farmer says you paid five shells, not three. Wang checks, finds a copying error, and corrects it. You are absent; Wang initiates the change himself.
Third: You lend a neighbor twenty shells. Wang subtracts twenty from your page and adds twenty to theirs. One transaction changes two places, and the increase must match the decrease, or the village's total shells would change from nothing. Balance: 177.
Fourth: Your cow eats someone else's vegetables. The village chief orders ten shells in compensation, and Wang complies. Neither you nor Wang initiates this change; a third person decides it. Balance: 167.
Fifth: Wang's nephew has gambling debts. One night, Wang moves two shells from your page to his nephew's. The numbers balance and the total stays unchanged. Balance: 165.
Sixth: The notebook fills up. Wang copies it into a new one and burns the old one. Your page in the new notebook says 165. You have no other evidence that the year started at 200.
Seventh: The neighbor repays twenty. Balance: 185.
At year-end, you reconcile your account and see 185. It looks fine.
Stop and answer three questions about each change:
- Which ones did you know about in advance?
- Which ones could you refuse?
- Which ones could you discover afterward?
You neither knew about, could refuse, nor could discover the fifth change. In the books, it looks exactly like the other six.
Your Decision
In year eight, the village forms a committee to redesign the ledger's management. You are a member. Four proposals are on the table.
What Happens
The four proposals seem different, but all answer the same questions.
Every ledger—on paper, in a database, or on-chain—must explain three things:
First, who can write. Who can add or change a row: the bookkeeper, the owner, a third party, or several parties agreeing together?
Second, who can read. The bookkeeper alone, the owner alone, or everyone?
Third, whether mistakes can be reversed. Can anyone erase or reverse an effective entry, and under what conditions?
Arrange the four proposals along these dimensions:
| Proposal | Who can write | Who can read | Can it be reversed? |
|---|---|---|---|
| Wang only, with owner's fingerprint | Bookkeeper executes; owner authorizes | Bookkeeper and owner | Yes; the bookkeeper can reverse it |
| Wang + chief | Either authority can change entries | Bookkeeper, owner, authorities | Yes, without owner consent |
| Three copies | Bookkeeper writes; multiple parties reconcile | Three parties | Yes, but mismatches leave evidence |
| Village wall, owners debit | Owner only | Everyone | No |
Replace the village with the real world. The parallels still hold:
| What you believe you own | What it actually is | Who can change the row |
|---|---|---|
| Deposits | A liability record in a bank database | The bank and authorities legally directing it |
| Shares | An ownership entry at a registry, through brokers and custodians | Registry, broker, and regulators |
| A home | A row in a property register | The registry, based on a judgment or application |
| Payment-platform balance | A row in a platform database | The platform, under its rules or risk controls |
| An eight-year-old account | A row in a platform user table | The platform, under its terms of service |
Focus on the third column. Nearly everything in your name has someone else who can change its record.
These institutions are not necessarily bad. Because someone can edit, mistaken transfers can be recovered, estates inherited, judgments enforced, and stolen accounts restored. Reversibility is a feature, not a bug.
But it also means ownership is conditional: the person able to edit must be willing and permitted to recognize it.
Build a Model
Compress everything into a portable model. Ask these five questions about any asset you encounter.
| Question | What it asks |
|---|---|
| Who records it? | Whose system holds the record? |
| Who can change it? | Who can add, edit, or freeze this row? |
| On what basis? | Owner consent, internal procedure, court order, or no conditions? |
| Can you detect it? | How soon will you know about a change, and how? |
| Can it be reversed? | Can an effective record be reversed, and who decides? |
The fourth and fifth questions are the least asked and the most important. Wang could issue excess receipts in chapter 1 because nobody regularly checked his books, not merely because he had permission.
Follow this chain whenever someone says “I have this much”:
- What you think you own
- A record
- The ledger holding it
- The ledger administrator
- Rules constraining the administrator
At the rightmost end, you discover that real-world ledgers earn trust through external constraints, including licenses, auditing, regulation, deposit insurance, and courts. The ledger is only paper; the constraints provide confidence.
This leads naturally to the next chapter's question:
What if those external constraints do not exist? Cross-border parties may have no shared court, competing companies may reject a shared administrator, and strangers may have no village chief. Can a ledger remain trustworthy in those settings?
What It Is Called
The phenomena we described have names.
Data recording asset ownership and changes. It can be a paper book, a database, or a public chain.
The key is who maintains it and who can change it, not the medium.
Every change is recorded in two places, with an increase on one side and an equal decrease on the other.
The third change in the thought experiment is an example: your balance falls by twenty and the neighbor's rises by twenty. This makes money appearing from nowhere hard to miss because the books immediately stop balancing.
Developed more than five hundred years ago, it still underpins accounting worldwide. On-chain ledgers inherit the same idea: every transfer needs a source, and rules reject balances appearing from nowhere.
Who physically or operationally holds an asset on your behalf.
Your shares are usually held through layers of brokers, clearing institutions, and custodian banks rather than registered directly in your name. Each layer adds a possible failure point and another party to trust.
Chapter 5 introduces the opposite: self-custody, with nobody holding assets for you.
Who can add or change a ledger row.
This is the chapter's central concept. What distinguishes financial systems is who can write, not what they record.
Whether an effective entry can be reversed, and who decides.
Credit-card chargebacks, bank-transfer recovery, and platform arbitration all depend on someone being able to edit a row.
On-chain transfers lack this mechanism. That removes a counterparty's ability to renege, but also your recourse after mistakes. Chapter 6 explains exactly when this happens.
Bring the model together in one sentence:
What you own is a row in a ledger, not merely the object itself.
The first question about any asset is whose book holds this row, and who can change it.
Hands-on
This takes thirty minutes but changes how you think about “how much money I have.”
List five kinds of assets in your name. Choose different types, such as:
A bank deposit, shares or a fund, a home or car, a payment-platform balance, and an online account you care about—games, social media, domains, and miles all count.
If you already have on-chain assets, add them as a sixth item.
Answer five questions for each asset. Copy this table and fill each cell.
| Who records it | Who can change it | On what basis | Detection time | Reversible? | |
|---|---|---|---|---|---|
| Bank deposit | |||||
| Shares | |||||
| Home or car | |||||
| Payment balance | |||||
| Online account |
Be honest about detection time: when did you last actively reconcile these records?
Find a cell you cannot answer at all. Everyone has a few.
Choose one and research it for ten minutes: read terms of service, regulatory disclosures, or call customer support. Record what you found and how much information was publicly available.
Mark two categories of assets.
First: someone can change it without your consent. Most people discover this covers nearly everything.
Second: nobody can restore it for you. You probably have none today. After chapter 5, you will have your first.
This table is the first page of your stage artifact. Return and add a row whenever you learn something new over the next twenty chapters.
AI Lab
Give AI this task:
Map the authority structures of these four ledgers in words, each as a top-down chain
from the final registry to the user:
1. Bank deposits
2. Shares held through a broker
3. Property registration
4. Third-party payment-platform balances
For each layer, state:
- What it actually holds or records
- Whether it can change the next layer's records
- The basis required for a change: owner consent / internal procedure / judicial document / unconditional
Then separately explain when users can lose control of assets in these four ledgers
without advance notification.
Mark uncertainty as “uncertain.” Do not invent details. Identify the country or region for institutional rules.When the result arrives, your task is to find one mistake, not merely understand it.
Check every item against the list on the right. When you find a mistake, write three sentences: what is wrong, what the correct answer is, and how you confirmed it.
This exercise matters more than it appears. It trains you to treat AI output as an unverified draft rather than an answer. That habit will repeatedly protect you over the next thirty chapters.
Verify these points yourself after using AI
- For shares, check that it includes broker and custody layers rather than assuming direct registration in your name is the only structure
- For banks, check who can freeze or debit deposits without depositor consent and on what basis
- For payment platforms, find matching clauses for the claimed rules in public terms of service
- For property, check that it distinguishes registration from authority to initiate changes
- Check that specific institutions, ratios, or deadlines identify a country or region; rules vary considerably
- Check that it does not equate never having seen something happen with it being impossible
Real-World Case
Venetian merchants recorded each transaction twice: its source and its destination, with equal amounts on both sides. In 1494, the method was systematically described in a mathematical work and spread worldwide.
Its significance was the ledger's first ability to check itself. Adding money from nowhere required inventing a corresponding source elsewhere, or the general ledger immediately stopped balancing.
Five hundred years later, on-chain ledgers accomplish the same thing differently.
Several major centralized cryptocurrency exchanges halted withdrawals or entered bankruptcy that year. Users opened their apps and saw balances identical to any ordinary day.
The problem was that the number lived in the exchange's own database. It recorded how much the exchange owed you, not how much on-chain value you controlled. Users discovered the mismatch only at the last moment.
The industry's frequently repeated lesson is not your keys, not your coins. Chapter 5 explains its technical meaning.
Creators and merchants often have accounts banned, balances frozen, or followers erased without advance notice. Usually the platform's actions comply fully with its own terms.
This cleanly illustrates the model: the platform holds the ledger, changes it under rules it sets and can revise unilaterally, and users discover changes afterward with little recourse.
Users are often angrier about “I never knew this could happen” than about the loss itself. After this chapter, at least that surprise should disappear.
Change One Variable
The fifth and sixth events in the experiment no longer work secretly: tampering leaves a trace, and replacing the notebook does too.
The benefit is clear: you need the ability to inspect rather than trust the bookkeeper.
But three problems arise: genuine errors also remain forever, privacy is sacrificed, and the ledger grows too large for ordinary people to retain a full copy.
These three problems are central to public-chain engineering today. Chapter 23 covers an unexpected benefit of the first.
Each ledger balances and can be audited independently, but together they count the asset twice.
This repeatedly causes problems in real finance: the same goods pledged to two banks, or the same asset recorded in two systems. The problem is that neither ledger can see the other, not necessarily that either is internally wrong.
Chapter 12 covers similar cross-chain risk: an asset locked on chain A is minted on chain B. If the sides stop matching, holders on both chains may believe they own it.
One day Wang leaves without warning and the notebook vanishes. Who owes whom depends on memories and scattered receipts.
The village does not instantly collapse, but transactions beyond personal relationships stop. A ledger's value depends on continued maintenance and shared recognition, not merely its existence.
A chain must answer exactly this question: how can a ledger remain accepted without any particular maintainer? That is the next chapter's topic.
You eliminate the risk of someone else moving your money. The fifth secret change becomes structurally impossible.
You also surrender every remedy: mistaken transfers cannot be recovered, fraudulent signatures cannot be reversed, keys cannot be reset, and assets may disappear when their owner dies.
This is an exchange: every recovery mechanism for exclusive control. Whether it is worthwhile depends on what and how much you exchange. Chapter 5 lets you make that exchange yourself.
Takeaway Questions
Choose three of the Eighteen Questions for this chapter.
When asking who the users are, also ask whether the ledger's users and owners are the same people.
They are separate in most financial systems: you use it, but the ledger is not yours. When a protocol claims users own their assets, first verify that this holds in its ledger structure.
The risk bearer is often not the person able to change the ledger.
Deposit insurance supports deposit losses, platform users bear account-ban losses, and on-chain users bear mistaken-transfer losses. Compare who can edit with who bears the consequences to see whether responsibility is aligned.
Why does Wang usually keep honest books? Licenses, audits, law, and reputation constrain him.
For any ledger, ask what its maintainer gains by acting correctly and loses by acting badly. “We will not abuse our power” means little if abuse has no cost. Chapter 4 provides the first engineering answer.
Chapter Check
Into three layers: the physical building, a record in a register, and the authority and basis for changing that record.
Normally they align, so the distinction is invisible. When they diverge—registration errors, seizure, or freezes—the middle layer determines what happens. Possessing the building alone does not decide it.
The seller in the opening example lives through forty days of these layers disagreeing.
It is an advantage because mistaken transfers can be recovered, unauthorized card charges disputed, judgments enforced, and estates inherited. All require someone able to change the row.
It is a disadvantage because that ability also means someone can change assets without your consent, making ownership conditional.
These are two sides of one structure; you cannot take only one. Ask any design claiming both where it hides the cost.
It makes money appearing from nowhere hard to miss. Both sides of every change must match, so an added amount needs a corresponding source.
It cannot establish truth if the bookkeeper fabricates both sides. The fifth secret change does exactly that: two shells leave your page and enter the nephew's, perfectly balanced.
Double-entry bookkeeping ensures internal consistency, not truth. Establishing truth still needs external reconciliation: auditing.
Two costs, the second greater than the first.
First, privacy disappears. Everyone's balance and counterparties are public.
Second, nobody can restore anything for you. No customer service, reset, or appeals desk exists. You have all the control and all the consequences.
Also notice an unstated prerequisite: someone must maintain the wall, and everyone must recognize its contents. Chapter 3 explains how that prerequisite can hold.
There is no answer key. Check three things:
Did you identify a specific institution rather than vaguely saying “the bank”? Did you state the basis for changes rather than merely “they can edit”? Did you honestly admit an unknown cell?
The third is most important. Knowing where you do not know is a central capability throughout this course. Research that cannot identify uncertainty is usually untrustworthy.
Key idea
Most of the assets you own are not physical things, but entries in someone else's ledger.