The Correctness Protocol
A protocol that defines what must be true about an entitlement — and proves it. Deterministic lifecycle. Invariant enforcement. Ledger-driven truth.
What MintPass Is
Existing entitlement tools are configuration-based — feature flags, subscription managers, access control layers. You set rules and trust the provider. MintPass is correctness-based. A formal state machine with Guardian invariant enforcement that can be independently verified from first principles.
The protocol separates lifecycle (what states exist), enforcement (what the Guardian blocks), and truth (the immutable ledger). Every mutation is recorded. Every access decision is auditable. Implementations don't just claim correctness — they prove it.
A gift card is issued, partially redeemed, disputed, resolved by an external authority, and settled — every state transition deterministic, every invariant enforced, every event auditable.
The Problem
"Is this user entitled to this?" Today, that question is answered by configuration you trust — not proof you verify.
Entitlement state scattered across billing, auth, and product. No single source of truth. Inconsistencies compound silently.
Feature flags and subscription managers tell you what's configured. Not what's provably correct. When they disagree with reality, you debug.
Entitlement rules tangled with provider-specific models. Every migration is a rewrite of what should have been portable.
Billing in Stripe. Access in your DB. Redemptions somewhere else. No consistent contract connecting them.
When someone disputes their access, there's no immutable record. Reconstructing history means querying three systems and hoping.
Custom access logic. Entitlement tables bolted onto billing. Engineers burning sprints on state bugs that should not exist.
Why Now
Products span multiple platforms. Billing runs through multiple processors. Entitlement logic scoped to one system is now asked to work across three.
Compliance and audit requirements are increasing. Entitlement state needs to be traceable. Access decisions need to be defensible. The internal stack is no longer adequate.
Protocol Primitives
A small set of composable primitives that model any entitlement architecture.
How It Works
Three guarantees that separate correctness-based entitlements from configuration-based tools.
Every entitlement moves through defined states — issued, active, consumed, expired, revoked. Transitions are controlled. Invalid transitions are rejected before they execute.
The Guardian enforces protocol invariants at the mutation boundary. An entitlement can be structurally active but operationally frozen — the protocol distinguishes these without collapsing them.
Every mutation writes to an immutable ledger. Entitlement history is always reconstructable. Access decisions are always auditable. No state drift.
MintPass defines the contract, not the runtime. Replace Stripe with Adyen without rewriting entitlement logic. Portability is a protocol guarantee, not a feature flag.
Built For
Teams embedding entitlement logic via API/SDK. The domain changes. The protocol does not.
Feature access and usage quotas as structured entitlements with lifecycle enforcement — not boolean columns in your product database.
Issued value with capacity tracking, redemption rules, and expiry — every partial redemption auditable in the ledger.
Points, credits, and reward units as protocol objects with controlled redemption and auditable balance history.
Access rights with enforced capacity and redemption validation. Verify once at the gate, trust everywhere inside.
Time-bounded access with lifecycle enforcement and portable state — independent of billing provider.
Compose entitlements into containers. Bundle access, quotas, and redemption units under a single portable authority.
Conformance
The first artefact is a conformance scenario. See a lifecycle, see what must be true at each stage, run it against your system. Every container exposes its entitlement state through a single API call.
The ledger shows every mutation with its authority, timestamp, and resulting state. Reconstructing what happened at any point is a query, not forensics.
Get Started
Prove your entitlement logic is correct. Run conformance scenarios, verify invariants, audit the ledger.