Quotas and rate limits
Metering answers “120 of 1,000 calls this month”. A ledger earns its cost when the customer owns the units, because owned units are bought, refunded and disputed.
Why Ledger
What a ledger must get right
A ledger is not hard because the data model is complex. It is hard because ten separate failure modes each look solved in isolation until they interact. Here they are in business terms, and what Ledger does about each one.
The ten problems
What goes wrong, and what Ledger does instead
01
Rounding
A ledger that stores money as approximate numbers loses fractions of a penny whenever it calculates. You find out during an audit, after millions of transactions, and by then you cannot fix it without replaying history.
What Ledger does
Every amount is a whole number of minor units. Fractions of a penny cannot be lost because there are no fractions.
02
Books that do not balance
If the check that debits equal credits lives only in the application, any code path that skips it writes books you cannot trust. So does anyone working directly on the database.
What Ledger does
The database refuses an unbalanced transaction at the moment of commit, whatever wrote it.
03
Overdrafts under load
Ten requests read a £100 balance at the same instant and all approve a spend, and the account ends £900 overdrawn. Ordinary application code gets this wrong. The usual fix for it collapses under traffic.
What Ledger does
Balances are locked in a fixed order before the check runs. If a write would still breach the floor, a database constraint refuses it.
04
Retries that pay twice
A client times out and retries. When the record of the first attempt and the money movement are two separate steps, a crash between them either pays twice or reports a payment that never happened.
What Ledger does
The movement and its receipt are written together. A retry either replays the receipt or does the work, and there is no third outcome.
05
Ghost entries from failed requests
A declined transaction that left half an entry behind creates money that does not exist.
What Ledger does
Checks run inside the same step as the write. A refusal leaves nothing behind.
06
One customer seeing another
A shared ledger serving many businesses is one missing filter away from showing one company’s money to another.
What Ledger does
The database enforces isolation itself, without help from the application, and it fails closed.
07
A history that can be edited
Access controls can be revoked, bypassed or misconfigured. If the database allows an entry to be deleted, some day one will be.
What Ledger does
No edit or delete path exists on the journal. A correction is a new, visible entry.
08
The account everyone touches
A shared control account is part of every transaction. Locking it collapses throughput, and leaving it unlocked brings the overdrafts back.
What Ledger does
High-traffic control accounts are totalled in the background by a rule that cannot skip an entry.
09
Changing the schema in production
A financial system cannot pause for maintenance, and a careless change to a live table stalls every transaction in flight.
What Ledger does
Every change ships as a versioned migration. A migration may not weaken a rule, and the full probe suite re-verifies the service before the change is accepted.
10
Proving the books are right
Even a correct ledger needs an independent check that the running totals equal the sum of the entries, and that the whole system nets to zero. Without one, corruption is found months late.
What Ledger does
A background reconciler keeps proving both. The moment they diverge it raises an alarm and stops postings.
Every answer above corresponds to a guarantee with a named check.
Where it does not fit
Three things a ledger is the wrong tool for
Naming them is part of describing the product accurately.
Counts that are not conserved
Page views and sign-ups have no source account. Double-entry adds bookkeeping to them without adding a guarantee.
Workflow state
A hold reserves value for a period of time. It is not a state machine for an order. Keep the order’s progress where your workflow lives.
Build or buy
Questions decision-makers ask
Could we not just build this ourselves?
Teams do build their own. Most get the first eight of these ten problems right and the last two wrong, usually years later. A ledger is a small amount of code protecting a large amount of money. The expense is in getting the rules enforced by the database and proven continuously, and it is the same expense the second time round.
Why is “enforced by the database” the important phrase?
Application code has many paths and many authors, and any one of them can skip a check. A rule the database enforces holds on every path, including the one a person takes with direct access. It also cannot be forgotten in the next release.
What happens to a mistake?
A mistake stays on the books. You post a new transaction that reverses it, and both remain. An entry is never edited or deleted. That is what an auditor asks to see.
Is a ledger the right tool for API credits or loyalty points?
Yes, when the customer owns the units and can buy, refund, transfer or dispute them. If you only need to know how much was consumed against a limit, a metering service is simpler and cheaper.
Free today. Access is provisioned personally by RODMENA.
Tell us what you keep books of and we will set up a tenant, mint your first key and walk you through the tour.