Networks and members

Three rings

Fig. 01 — Three rings

1. 01OpenThe formats. Implementable without permission.
2. 02The networkDirectory, discoverability, compliance channel, disputes.
3. 03The operatorCustomer data, KYC documents, wallets, private keys.

Ring 1 is the protocol. Identity, addressing, standing intent, requests, authorisation objects, receipts, the interop URI, signatures, error codes. Implementing any of it requires access to nobody's data. You can do it alone, and nobody can stop you.

Ring 2 is a club, and has to be. There is exactly one capability in PATH where the shared resource is not a format but other people's customers: the directory. Entering it means publishing a resolvable pointer to your customer base. No regulated institution does that without reciprocity, a contract, an audit right, and the ability to exclude whoever abuses it.

Ring 3 never leaves the operator. Customer records, KYC documents, wallets, keys. Not in the protocol, not in a network, not in any circumstance.

The precedent

This is the card architecture, and nobody has ever found it incoherent:

Visa is closed, demanding, with a thick rulebook and a right of exclusion. ISO 8583 is open. Both have been true simultaneously for forty years.

What being closed buys

Closing the directory replaces expensive cryptography with cheap governance.

What it costs

The table above is an argument. Here is the bill, because a page that only lists gains does not survive its first adversarial reading.

Adoption is capped by admission. Ring 1 grows virally — implement and go. Ring 2 grows at the speed of due diligence. A directory needs density to be useful; an admission process manufactures scarcity. That tension took the card networks twenty years.

It reintroduces the gravity the open model was meant to escape. The complaint about closed systems is not that they are closed; it is that inside them you cannot leave, and outside them you cannot receive. A club with an exclusive directory produces the same shape: members become mutually reachable, non-members become invisible. The honest limit is that today a non-member is addressable in the relationship profile and not in directory, and that difference is real.

Deciding who may join is a supervised power. Controlling access to a payment infrastructure is not an ordinary commercial prerogative. Card networks had their access rules, fees and governance examined under competition law, up to and including a forced separation between the entity writing the rules and the entity operating the system. A PATH network inherits that exposure.

Prevention becomes deterrence. "The defence is contractual" is a change in kind, not only in cost. A cryptographic guarantee prevents. An audit observes, afterwards, with a delay and limited powers. Against the slow, quiet scraping that actually matters, that difference is not theoretical.

And the central point observes. In the usual configuration, the network sees every search. See Privacy.

None of this invalidates the choice. The open alternative left the directory problem with no answer at all. But a member deciding whether to join deserves the bill alongside the pitch.

What a network decides — and what it may not

Networks differ, and the protocol expects them to. What it requires is that the differences be declared in the discovery document, so an institution can read the terms before joining rather than after.

The last row of the right-hand column is the load-bearing one. A network may not answer on behalf of its members about what they accept. A directory that did would hold its members' capability data — ring 3 material sitting in ring 2 — and no second member would sign that.

Two directory topologies

A network declares which it operates.

central — the network holds the index and answers. Simple to join: a member integrates in an afternoon, stores nothing, synchronises nothing, and reads fresh data. The network sees the searches.

broadcast — the member asks its peers in parallel, filtered by declared coverage. Attractive in principle and worth being blunt about: it multiplies observation rather than removing it. Asking fifty members who holds a key tells forty-nine of them that someone is looking for that person, when one needed to know. Central concentrates the observation in a party bound by the rulebook; broadcast spreads it across competitors who are not.

Broadcast is workable with declared coverage — each member publishes which countries, prefixes and identifier types it can hold, so a Senegalese number only reaches members serving Senegal. That cuts both the traffic and the exposure by an order of magnitude, and it leaks nothing: "I serve Senegal" is on the member's own marketing page.

Discoverability belongs to the entry

A network does not flip its directory between public and private wholesale. Each entry carries its own level, and the sensible default depends on what kind of identifier it is:

A merchant wants to be publicly findable; it is their commercial interest. A private individual never is by default. This is what makes a useful public merchant directory possible without exposing anybody.

One caveat that survives the level: even where the key is public — a company register number is public by construction — the answer is not. "This company banks with that member" is commercial information, and a public entry opens the key, not the budget.

Between networks

There will be more than one network, and the protocol expects them to interoperate. Two levels, and distinguishing them makes the problem tractable:

The hard case becomes the rare one, and a member never needs to know another network exists: it talks to its own, which routes. The complexity is absorbed by a handful of operators instead of by every participant.

The published register of those clubs is Networks. PATH lists them. Each club decides who is admitted.

---

Next: Privacy — what is protected, what is not, and which promises are properties.