The document proving an account balance: both balances, the itemised difference, attached evidence, and the preparer and reviewer who signed it.
Volume
Accounts × periods
Retention
Audit period, typically years
Entity attributes11
Authorisation must evaluate rules against the record's own history, not only the user's role. Plain RBAC is structurally insufficient.
Certified periods must be immutable at the storage layer, not by application convention. No in-place update, no soft delete, and reopening must itself be an audited event.
Authorisation must evaluate rules against the record's own history, not only the user's role. Plain RBAC is structurally insufficient.
Exact decimal arithmetic end to end — database column, ORM mapping, API serialisation and client. Floating point anywhere in the chain is disqualifying.
reconciliation_id
Every transactional row must carry a tenant identifier from the outset, even in a single-tenant deployment.
account_id / period_id
Exact decimal arithmetic end to end — database column, ORM mapping, API serialisation and client. Floating point anywhere in the chain is disqualifying.
Certified periods must be immutable at the storage layer, not by application convention. No in-place update, no soft delete, and reopening must itself be an audited event.