Dharma.
The rules your business runs on, written so anyone can read them. Every action is checked against them before it happens, whoever asks: you, your team or your accomplice.
Rules you can read.
A Dharma rule is a short sentence about your business. What an order is. Who may approve a payment. What must be true before something ships. Anyone on the team can read it, and so can the AI.
Every action is checked against the rules before it happens. If it breaks one, it doesn’t happen. There is nothing to clean up later.
People, the accomplice and outside apps go through the same check. There is no back door for any of them.
Underneath, a rule is a few lines of a small language made for business rules: the state a record keeps, the actions that change it, and what must hold for each one.
# Nothing ships to the Moon, or over 200 units,# without a second person confirming (Leela).action Ship() authorize dhl validate state.paid or state.credit_terms state.crates_checked == state.crates state.status == Requested or state.status == Confirmed state.status == Confirmed or state.units <= 200 state.status == Confirmed or state.destination != "Moon" apply state.status = Shipped
The whole contract (65 lines)
aggregate Delivery state public customer: Text(len=200) public destination: Text(len=100) public units: Int = 0 public crates: Int = 0 public crates_checked: Int = 0 public paid: Bool = false public credit_terms: Bool = false public requested_by: Identity public confirmed_by: Identity public status: Enum(New, Requested, Confirmed, Shipped) = New action Request(customer: Text(len=200), destination: Text(len=100), units: Int, crates: Int, credit_terms: Bool) authorize dhl validate state.status == New units > 0 crates > 0 apply state.customer = customer state.destination = destination state.units = units state.crates = crates state.credit_terms = credit_terms state.requested_by = context.signer state.status = Requested action CheckCrate() authorize dhl validate state.status == Requested state.crates_checked < state.crates apply state.crates_checked = state.crates_checked + 1 action Confirm() authorize dhl validate state.status == Requested context.signer != state.requested_by apply state.confirmed_by = context.signer state.status = Confirmed action Pay() authorize dhl validate state.status != New state.paid == false apply state.paid = true # Nothing ships to the Moon, or over 200 units,# without a second person confirming (Leela).action Ship() authorize dhl validate state.paid or state.credit_terms state.crates_checked == state.crates state.status == Requested or state.status == Confirmed state.status == Confirmed or state.units <= 200 state.status == Confirmed or state.destination != "Moon" apply state.status = Shipped
Real DHL, exactly as it runs: this contract compiles. Every action is checked against it before it happens, for people and AI alike.
Every record has a lifecycle.
A status is one of a few named steps, not free text. Each action says which step it starts from and which step it leads to, so a record can’t skip ahead, go back by accident or end up somewhere nobody planned.
The contract lists the steps once. Screens, filters and reports all use the same list.
An action that starts from the wrong step is refused, with the reason.
- New
Requestanyone on the crew- Requested
Confirmnot the one who asked- Confirmed
Shippaid or on credit, every crate checked- Shipped
A small delivery may go straight from Requested to Shipped. Over 200 units, or anything bound for the Moon, has to pass Confirmed first.
A refusal explains itself.
When a rule stops something, you see which rule and why, in plain words. Each contract comes with a screen file that gives every rule its sentence. The accomplice reads the same sentence, so it can say what’s missing and ask the right person.
present action Create label "Save view" tone primary explain state.revision == 0 "A view with this id already exists." explain delegation_ends_ms == 0 or delegation_ends_ms > context.clock.milliseconds "The author's delegation has ended." explain name.len > 0 "A view needs a name."
Real, from Mandala’s standard library. Each explain names one rule of the action and the sentence shown when that rule stops someone.
Nothing goes to the Moon until a second person confirms it. I’ve asked Leela.
state.status == Confirmed or state.destination != "Moon"
Who may act for whom.
A business doesn’t act on its own. People act for it, and the accomplice acts for people. Dharma says who may do what on whose behalf: everything, one kind of record, or a single action, until an end date.
Delegation is signed, too. When Hermes lets Mira pay small invoices, that permission is itself an entry, with limits, an end date and, at his insistence, a stamp. Mira acts by Hermes’s delegation, never as Hermes.
Acting for the business, you sign as yourself, by delegation. The record shows who acted, for whom, and under which grant.
Past its end date, or once withdrawn, a delegation stops covering anything.
Hermes may handle supplier invoices for Planet Express, signing as himself. The grant is a record too, signed by the owner who gave it.
action Accept(owner: Identity, writer: Identity, note: Text(len=300), delegation: SubjectRef<Delegation>, delegation_scope: Text(len=200), delegation_ends_ms: Int) observe delegation where active == true observe delegation where party == arg.owner observe delegation where delegate == arg.writer validate context.signer == writer delegation_scope == "*" or delegation_scope == "std.exchange.document" or delegation_scope == "std.exchange.document.Accept" delegation_ends_ms == 0 or delegation_ends_ms > context.clock.milliseconds
Real: accepting a document someone sent you checks the delegation of whoever accepts it, its scope and its end, before anything is written.
Changes are proposed, then signed.
Your business changes, and so does its law. Describe the change. The accomplice drafts the new rule, tries it on a scratch copy, and shows what it would accept and refuse. Someone with the right to approve it signs it, and it’s installed.
The accomplice never changes a rule by itself. Installing a contract waits for an approval.
A new version of a contract names the version it replaces and how existing records move to it. Nothing is rewritten behind your back: the move is itself an action, checked and recorded.
action Upgrade(owner: Identity, writer: Identity, delegation: SubjectRef<Delegation>, delegation_scope: Text(len=200), delegation_ends_ms: Int) authorize dhl certify upgrade from 2c21973f80a6f431cc4a2afb29bdae1cfcf2ba6a1d752c6c569fd8c13c7f4665 migrate
Real: version 1.1.0 names the exact version it upgrades from by its fingerprint, and migrate moves each record across under the delegation of whoever acts for its owner.
The AI is what you talk to. Dharma is why you can trust it with your business.
Only by proposing a change. A person with the right to approve it has to sign it first.
You see which rule, and why. Mira says what it needs, such as a second approver, and asks for it.
No. Describe what you want in your own words. The accomplice drafts the rule, and you read the plain version before you approve it.
Into Karma: every action and its consequence, signed and kept. Read about Karma