What actually gets better

Trust gets used to mean at least four different things in the same meeting, and the ambiguity is expensive because the four have different remedies. Knowing where a figure came from is not the same as knowing that a record has not been altered. Being able to check something yourself is not the same as several parties sharing one version of a history. A project can have a hard requirement for exactly one of these and no interest in the rest.

Splitting them up also makes it possible to be honest about the cheaper option. For three of the four there is a conventional answer that works well when one condition holds, and naming the condition is more useful than arguing about the technology. That condition turns out to be the same one every time, which is part 2.

• Provenance. Where a figure came from and what produced it. The strong version is a derivation a stranger can run, not a document describing one.
• Recompute. To arrive at the figure yourself from the same inputs. The difference between this and reading a report is the whole of the first advantage.
• Shared history. One sequence of events that several parties read as authoritative, without any of them maintaining it.
• The keeper. Whoever holds the copy that counts. In most arrangements there is one, and agreeing who it is can be the hardest part of the deal.
• Integrity. Evidence that a record has not been altered since it was written. Checkable by the reader here, asserted by the publisher elsewhere.
• Audit trail. A record of what happened and when. The property that matters is whether the party being audited can revise it.
• Distrusting parties. Parties whose interests differ enough that none of them will accept another's copy. The condition all four advantages depend on.
• Trust minimising. Machinery that reduces how much any party has to take on faith. It is not free and part 2 says what it costs.

Every serious data function already does provenance. Lineage is captured, transformations are documented, a figure can be traced back through the pipeline to its inputs. That work is real and it is valuable, and it produces something with a hard limit: an account of the derivation, offered by the party whose figure it is.

The strong version is different in kind rather than in quality. When the inputs are readable by anyone and the derivation is published, a doubter does not read your account of how the figure was produced. They produce it. If they get your number, the question is settled without your involvement; if they do not, you have a discrepancy with two candidate causes, both of which are findable.

Notice what that removes. It removes the escalation, it removes the audit engagement, it removes the meeting in which two teams compare two numbers neither can inspect, and it removes the situation where the party with the better relationship wins the argument. Those are not small operational costs, and a warehouse cannot remove them at any budget, because the bottleneck is not data quality. It is that the other party has to be granted access and then has to believe the grant was complete.

This is the advantage that sounds most abstract and is most often the actual reason a project exists. When several parties need one version of a sequence of events, somebody normally maintains it, and that somebody has to be agreed. Negotiating who keeps the record can take longer than building anything, because the keeper gets to resolve every ambiguity, sees everybody's data, and cannot be removed without unwinding the arrangement.

The usual alternative is worse rather than better: every party keeps its own copy, the copies disagree at the edges, and a reconciliation function exists permanently to argue about the differences. Most people reading this have staffed one. The cost is continuous and it is mostly paid in senior time.

A shared append-only history removes the role rather than assigning it well. There is no keeper to appoint, no keeper to audit, and no keeper to renegotiate when one party is acquired by another. That is a structural answer to a political problem, which is rare enough to be worth a lot when the problem is genuinely political.

The third and fourth run together and are usually confused with each other. Integrity is about whether a record you are reading now is the record that was written. An audit trail is about whether the sequence of what happened can be reconstructed later. A conventional system can do both to a high standard, and in both cases the assurance ultimately rests on the party operating the system.

The honest way to put the difference is this: a well run audit log is excellent evidence against accident and mediocre evidence against the log's own operator. That is not a criticism of anyone's controls. It is a structural fact about who holds the write access, and every auditor knows it, which is why audit is built on sampling and corroboration rather than on reading the log.

Here the operator cannot revise it either, and neither can you, which is exactly the property sessions 1 to 4 spent so long complaining about. That is the trade in its clearest form. The thing that makes correction impossible is the same thing that makes quiet revision impossible, and you do not get to buy one without the other.

It is worth being precise about the near misses, because a good engineer will offer each of them and each is a reasonable answer under the right condition. For provenance, a conventional system can publish its transformations and grant read access to its inputs, which gets a long way. It stops at completeness: the outside party can recompute from what they were given and cannot establish that what they were given was everything.

For a shared history, a conventional system can appoint a neutral keeper, and a well chosen one works for years. It stops when the neutrality is challenged, which tends to happen at exactly the moment the record matters most, and there is no way to settle the challenge from inside the arrangement.

For integrity and the audit trail, a conventional system can sign records, write to storage that resists modification, and ship the log to a third party. Each of these raises the cost of quiet revision substantially. All of them are configured, operated and can be reconfigured by the same party whose behaviour is in question. That is the stopping point in all four cases and it is always the same one: somewhere in the chain, an outsider is relying on an insider's good faith. Part 2 is about whether that reliance is actually a problem in your situation, because very often it is not.

Switch the published figure to the inflated version and read the last row. You did not escalate, you did not request access, you did not ask anyone to confirm anything, and you did not have to be trusted by Larkfield in order to do it. You ran the derivation and compared. That is the whole of the first advantage and it fits in one interaction.

Notice also what it did not do. Catching the discrepancy does not tell you who was at fault, whether it was a definitional difference or a mistake, or what the right figure is. It tells you that two numbers do not agree and that both of them can be produced by anybody. What follows is still a conversation, and it is a conversation between two parties who can both see the evidence, which is a substantially different conversation from the one that happens when only one of them can.

The honest caveat is the one from part 1 and it applies here too. This works because the inputs and the method are both available. If Larkfield published the figure and kept the method to itself, as session 3's second camp would have it do, you would be back to taking the number. The advantage is not a property of the ledger alone; it is a property of the ledger plus a published derivation, and the second half is a choice somebody makes every time.

This is the part that gets left out of the enthusiastic version and it needs saying plainly. Where the state lives inside one organisation, and there is a keeper everybody accepts, a relational database with a well designed audit log gives you provenance, a single history, integrity checking and a trail. It gives them faster, cheaper, with tooling everybody already knows and staff you can already hire.

It also gives you something the ledger cannot: the ability to fix a row. Everything in session 4 is a cost you would simply not be paying. No annotation-only correction path, no read path accumulating rules forever, no restatement with nothing to restate, no structurally unavailable erasure.

So the comparison is not close in that setting, and a data leader who chooses the ledger there has usually done so for a reason that is not about the four advantages. Being able to say that out loud, with the four advantages in hand rather than as a general scepticism, is what makes the objection land with people who have already fallen in love with the idea.

The live argument is about the contested cell: shared state between parties who mostly do trust each other, which is where a large share of real proposals actually sit. One camp says the machinery is not worth paying for there, and their case is concrete. Trust that exists is cheap to use and expensive to replace with mathematics. You would be buying the four advantages and paying for them in the three costs of sessions 1 to 4, permanently, to solve a problem the parties are currently solving by picking up the phone. They point at the long record of consortium projects that were technically finished and never used, where the quieter option kept winning because it was quicker for everyone involved.

The other camp says trust is a snapshot and the arrangement outlives it. Parties who trust each other today are one acquisition, one change of management or one bad quarter away from not doing so, and the machinery is much harder to retrofit than to start with, because the history you would want to have been keeping is the history you did not keep. They also make a sharper point about the phrase "accepted keeper": in most arrangements the keeper is the largest party, and the smaller ones accept it because the alternative is not being in the arrangement. Calling that trust flatters it. On this view, adopting the machinery while relations are good is buying an option on their deterioration, at a price you can only pay in advance.

Both camps are staffed by people who have run these programmes and both can name projects that vindicate them. The disagreement is not resolvable from the outside, because it turns on a forecast about a specific set of relationships over a specific horizon, which is exactly the thing nobody has data on. What can be said is which way each side fails. The first fails by being caught without a shared record on the day the relationship changes, which is recoverable and slow and humiliating. The second fails by carrying sessions 1 to 4 as a permanent cost for a risk that never materialises, which is survivable and quiet and never shows up as a failure at all. Leaders systematically under-count the second because nothing ever goes wrong, and that asymmetry is worth naming before you choose.