Canton settles. Boli tokenizes. Every chain follows

Canton primitives, Boli equivalents.

Boli models assets as Canton workflows from the start, not as tokens with bolt-on compliance. The primitives that make Canton credible to regulators carry through to every asset Boli ships.

Agentic asset operations, not just tokenized ownership.

Real institutional assets need to be continuously operated — reconciled, monitored, verified, reported, retired. Boli runs that operational layer on Tenzro's agent runtime: autonomous workflow execution under AP2 mandate pairs scoped by TDIP delegation, TEE-attested, settled on Canton.

Every agent carries a machine DID and every action traces to an AP2 mandate pair — revocable, auditable, policy-constrained. Delegation scopes, spending policies, and revocation — not API tokens — govern what an autonomous system can do.

Agents are counterparties, not just operators. Boli publishes a signed agent card at /.well-known/agent-card and an MCP endpoint, so an external agent can discover the platform, authenticate with DPoP-bound TDIP identity, and transact within the scopes its mandate grants — the same know-your-agent posture the A2A and AP2 ecosystems have standardized.

Verifiable from the edge.

For environmental credits, metered energy, and operating property, the hard problem is not the token — it is whether the data underneath the token can be trusted. Boli anchors asset state in data attested at the point of capture on Tenzro's distributed network and carries the evidence, unbroken, to the registry record. Five layers, each crossing producing verifiable evidence.

1. 1
   Device — signed at the sensor

   Meters, sensors, and operational systems sign readings with TEE-held keys bound to machine DIDs under TDIP. Attestation follows the IETF RATS architecture (RFC 9334): evidence rooted in hardware, appraised by independent verifiers, before a reading counts as fact.

2. 2
   Verification — multi-prover, off the device

   Tenzro's network runs TEE and ZK verification over raw streams before anything reaches a chain. Where the source is an operator's system rather than a device — a resort's PMS, a grid operator's API, an external registry — web proofs (zkTLS) establish that the data came from the authenticated source, unmodified.

3. 3
   Agents — reconciliation under mandate

   TEE-attested agents reconcile attested readings against custodian, registry, and pricing sources under AP2 mandates: signed, scoped credentials with spend caps and expiry. Every action lands in a hash-chained, attributable log; regulated lifecycle events keep a human approval gate.

4. 4
   Registry — evidence gates the lifecycle

   The Daml contract on Canton is the canonical record, and verified evidence gates its lifecycle events. A carbon credit issues only against continuous dMRV consistent with ICVCM Core Carbon Principles. An energy certificate issues against metered, hourly-matched generation — granular certificates, not annual averages. A distribution waterfall runs only against reconciled operating data.

5. 5
   Projection — claims travel with the asset

   Where the asset reaches EVM or Solana, attestations travel as identity-registry claims in the ERC-3643 model, and circulating supply across every chain stays within the one attested reserve cap — enforced at the mint through the Secure-Mint invariant, not reconciled after the fact.

The device and verification layers are Tenzro network capabilities; the agent, registry, and projection layers are Boli's. At testnet the chain runs against pilot data sources, and the interfaces at each layer are specified in the BSPs.

Why Canton, specifically.

1. 1
   Privacy by default — at the protocol level

   Canton enforces sub-transaction privacy: counterparties see only the slice of state they are entitled to see. For sovereign assets, regulated funds, and CBDC programs this is the difference between something a regulator can sign off on and something they can't.

2. 2
   Atomic settlement, instant finality

   The Canton Network Token Standard (CIP-0056) AllocationV1 settles cash legs against asset legs in a single Daml transaction. There is no probabilistic finality, no reorg risk, no escrow shim. The leg either settles or it doesn't. Token Standard V2 (CIP-0112, approved June 2026) adds privacy-preserving batch settlement and account abstraction — backward-compatible, so V1 assets carry forward.

3. 3
   A network of regulated participants

   Canton is operated by a federation of institutions — Super Validators run by named, accountable parties — under the Global Synchronizer Foundation. The settlement record is not produced by anonymous miners or staked capital; it is produced by parties already inside the regulated perimeter.

4. 4
   Composable with the broader public-chain ecosystem, where you want it

   Boli projects assets onto EVM through the ERC-7802 crosschain mint/burn interface (draft) and onto Solana through NTT-class burn-and-mint, when distribution requires it. Circulating supply across every chain stays within one attested reserve — a protocol-level invariant enforced at the mint against proof-of-reserve attestation — so the asset composes with stablecoins, custody, DeFi, and wallets without a lock-and-wrap copy and without compromising the privacy and finality of the Canton settlement leg.

What Canton gives an institution.

Boli's position on Canton.

Boli is deployed on Tenzro's Canton validator node, so it can transact on the network from day one. Boli does not operate its own validator, is not a registry operator, and is not a Super Validator. The settlement record is produced by the federation. Boli participates as a settlement app the way an asset manager or a transfer agent would.

What we ship is the tokenization and interop layer: the three Daml asset patterns (Tradeable, Registry-mirror, Credential); the compliance-pack catalog and engine, aligned with ERC-3643 and ERC-7943 where assets touch EVM; burn-and-mint projection under one attested reserve cap, enforced at the mint through Tenzro's Secure-Mint reserve invariant; TDIP identity with MPC threshold wallets across Canton, EVM, and Solana; and the agent runtime that validates agent-payment mandates (AP2) and metered API calls (x402, now a Linux Foundation open standard).

Customers carry every regulated function — issuance, custody, venue operation, registry authority. Boli is the layer those functions build on, not a counterparty in them, and never an issuer itself.

Next.

• Platform — the three Daml patterns, multi-VM execution, compliance-as-code.
• Whitepaper — full architecture, settlement model, identity layer, agent runtime.
• Integrations — venues, custodians, registries, settlement assets, agent rails.