Start with the decision
A mortgage provider offers a discount when a prospect has more than €400,000 of eligible property available as collateral. The quotation needs that eligibility answer. At this stage, it need not contain the property's address, exact value, location, or whether it is a house or apartment.
This is an illustrative quotation rule. A later underwriting or legal step can have different information requirements and its own authorization.
The design question for every data element is: does this party need the underlying fact, or can an authorized action answer the business question? Apply that question to documents, fields, intermediate results and evidence.
Distribute the work alongside the knowledge
Solid's pod model separates applications from the data people control. Tim Berners-Lee's Giant Global Graph (GGG) describes a web connecting things across sources and applications. Connecting knowledge does not require making all its contents public.
Legra extends that idea into executable work. A mortgage quotation Use Case can compose smaller Use Cases bound to different workspaces. Their Stories define the actions, inputs and outputs. The collateral assessment runs inside the prospect's workspace, close to the private records it needs. The lender's quotation logic runs in the lender's workspace.
The result is distributed knowledge and distributed executable use cases. An application coordinates authorized answers across boundaries instead of collecting every source record into its own database.
Define the smallest useful interface
The Story might read:
As a mortgage provider preparing this quotation, I need to know whether the prospect has more than €400,000 in eligible property available as collateral, so I can determine whether the discount applies.
Bind the invocation to a prospect, quotation, agreed threshold, currency, assessment time and versioned eligibility rules. Those rules define valuation, existing encumbrances and what qualifies as available collateral.
Return the eligibility outcome and the minimum evidence needed to rely on it. Exact amounts, property identifiers, addresses and document contents stay outside the output contract. An unavailable or unverified assessment must produce an explicit outcome rather than silently becoming a positive answer.
Fix the permitted question as well as its output. Allowing arbitrary repeated thresholds could let a requester reconstruct a private value through many yes/no answers. Agreement scope, invocation admission and journaling must account for that inference risk.
Execute inside the customer's boundary
- The lender invokes the agreed collateral Story for the quotation.
- The customer's workspace checks the caller's authority and permitted scope.
- The customer's own Host decrypts and queries the private records.
- That Host returns the authorized answer and scoped evidence.
- The lender records the result with the identified quotation.
For this arrangement, only the customer's Host receives authority to decrypt that workspace. The lender receives no general graph-query or document-read grant. Other sub-use cases can execute against other workspaces on other Hosts.
Encrypted blocks may still be replicated among independent custodians. Keeping plaintext processing on a personal laptop or phone does not require keeping the only durable copy there. Recovery needs surviving encrypted content and recoverable keys; query availability also needs an authorized Host.
Reach the workspace over the peer network
Native peers can make Story calls over Legra's QUIC protocol, carrying asynchronous operations and streamed results without installing a public HTTP service for each workspace. Browsers and HTTP clients can use a gateway into the same execution machinery.
Workspace-aware routing locates a reachable serving Host. NAT traversal and encrypted relay paths help connect to personal hardware behind routers; a direct path avoids the relay hop when available. Multiple authorized serving Hosts can provide more placement options, with reachability and replica state checked separately.
These mechanisms improve connectivity options. They do not turn a sleeping customer laptop into an available executor or authorize custodians to decrypt its data. If execution times out, inspect the recorded outcome before retrying a Story that changes state.
Add independent assessment without disclosing everything
The lender can require an assessment by an accepted third-party assessor. That assessor has a separate role and narrowly scoped authority: the lender's permission to ask a question does not grant the assessor access automatically.
An assessor may need to inspect a property or selected source records under that agreement. Its signed attestation can support the customer's eligibility answer. The lender can verify the accepted issuer, assessment scope and freshness without receiving the assessor's full working file or the customer's property inventory.
Keep the evidence package minimal too. A signature over a report containing an address does not make sharing that report private. Release an attestation whose disclosed claims fit the quotation's question.
Make the answer verifiable
Task-tree identities correlate the delegated work. Workspace journals record execution outcomes alongside the transactions they concern. PROV-O describes source, activity and agent relationships; commit identities bind the relevant data and implementation versions.
Merkle hashes, commit hash chains and signatures let a verifier check the integrity and authenticated lineage of disclosed evidence. A changed answer or substituted attestation should fail verification against its authenticated references. The evidence can identify which rule version, assessor and recorded execution produced the answer while keeping protected inputs private.
That is mathematical evidence about authenticated records. Confidence that the valuation is accurate and the calculation was faithfully executed also requires trust in the assessor and authorized execution environment, or independent verification appropriate to that claim. A journal signature alone cannot prove every hidden computation correct.
Bind disclosure to the quotation
The agreement can authorize invoking this Story and retaining its result only in the named quotation, excluding unrelated profiling or reuse. Within the governed workflow, scope the action and destination record accordingly, and retain the agreement reference with the result.
Once an answer has been disclosed, the recipient can technically copy it. Restrictions on use outside the governed system remain recipient obligations backed by agreements and accountability. Hashes cannot erase a recipient's memory or prevent an unauthorized external copy.
Even a boolean answer discloses something. The benefit is that each party receives the information its agreed role needs, with evidence for that use, while the underlying corpus remains governed at its source.
See executable Use Cases, purpose-bound access, workspace encryption, provenance and Solid pods through LWS for the mechanisms behind this arrangement.
Try it in Legra
To prepare the access boundary for a demonstration, follow the workspace and membership guide.