A central bank, a commercial institution, and an end-user wallet share one ledger but never share one another's authority. Separation is native to the data model, not a permission bolted on after the fact.
The two-tier CBDC hierarchy is expressed directly in the system's structure rather than approximated by application logic.
The central bank is the root tenant that issues and retires currency; institutions are subordinate tenants that distribute it; wallets are leaf tenants that hold it. Authority flows down the tree and can never flow sideways between siblings.
Each tenant is bound to its own ML-DSA-65 key material at onboarding. A tenant's identity is the public key, so impersonation requires forging a post-quantum signature rather than defeating an access-control check.
There is no operator account that transparently acts as any tenant. Even the central bank cannot sign on an institution's behalf; it can only exercise the powers its root role explicitly grants over the hierarchy.
Because the boundary is encoded in identity and issuance, removing an application filter does not collapse tenants together. There is no configuration in which one institution's records become writable by another.
Each tenant controls the keys that authorize its own actions, so the platform operator is never in a position to move another party's value.
The central bank holds issuance keys, each institution holds its distribution keys, and each wallet holds its spending key. The engine validates signatures; it does not hold the secrets that produce them.
Signing contexts are namespaced per tenant so a signature valid in one tenant's domain is not replayable in another. A message authorized for one institution cannot be lifted and accepted under a different one.
A tenant can rotate or revoke its own keys without coordinating with peers. Compromise of one wallet or institution is contained to that tenant and does not force a system-wide re-key.
The operator never escrows tenant secrets, so an operator breach cannot be converted into spending authority. The blast radius of any single compromise stops at the keys that compromise actually exposes.
Tenants commit to a shared hash-chained ledger while reading and writing only the state that belongs to them.
All entries link into a single hash chain so global integrity is provable, but each entry carries the tenant scope that owns it. Institutions see their own balances and flows, not those of competitors on the same ledger.
Every state transition is validated against the acting tenant's scope before it is chained. A write that attempts to touch state outside the signer's authority is rejected at settlement, not merely hidden at display time.
Because entries are tagged by tenant, a supervisor can reconstruct a single institution's complete history from the chain without exposing the records of others. Auditing one party does not require unsealing the whole system.
Any attempt to alter one tenant's history breaks the hash linkage for the whole chain and is detectable on verification. Isolation and integrity are enforced by the same cryptographic structure.
Value moves between the central bank, institutions, and wallets through explicit, authorized transfers rather than shared mutable state.
A transfer that crosses a tenant boundary requires signatures from both the sending and the receiving side of that boundary. No single tenant can pull value out of another's scope unilaterally.
When a tokenized asset changes hands against CBDC, the asset leg and the cash leg commit together or not at all. Cross-tenant settlement never leaves one party delivered and the other unpaid.
Currency entering an institution's scope is an issuance signed by the central bank; currency leaving is a redemption. The supply held by each tier is always the arithmetic result of signed, chained events.
Transfers debit one scope and credit another in the same committed entry, so total value is conserved as it moves. Separation does not fragment accounting; it makes each movement individually accountable.
Authority is scoped to the tenant hierarchy so a role can only ever act within the boundaries that role was defined against.
Issuance and retirement are powers of the root tenant; distribution and account servicing are powers of institutions; holding and spending are powers of wallets. A tier cannot assume a power reserved for another tier.
An institution can delegate operational duties to its own operators without granting them reach into other institutions. Delegated authority is always a subset of the delegating tenant's own scope.
The central bank's oversight of an institution is an explicit, logged capability over that institution's scope, distinct from the ability to transact as it. Supervision and impersonation are separate powers.
A newly onboarded tenant starts with only the powers of its tier and no visibility beyond its own scope. Access is granted by deliberate act, never inherited from being on the same platform.