The placeholder for this page promised private blockchains for supply chains. That is a product pitch, not an architecture. NIST Internal Report 8202, published in October 2018, gives a narrower definition that still holds as a starting point. Blockchains are tamper-evident and tamper-resistant digital ledgers implemented in a distributed way, usually without a central repository and usually without a central authority such as a bank, company, or government. A community records transactions in a shared ledger so that, under normal operation, a published transaction is not changed. The report’s purpose is to explain how the technology works. NIST IR 8202
What the property actually buys
The useful property is shared history that participants can check, with tamper evidence when the network is operating as designed. That is attractive when organizations that do not fully trust one another need a common record and are willing to operate the consensus, the keys, and the governance that go with it. It is unattractive when a single organization already trusts its own database, because a database already provides a record, access control, and backups, without asking every participant to run a ledger protocol.
A permissioned deployment, in which a known set of organizations runs the network, changes the “no central authority” picture. The authority becomes the consortium’s rules. Those rules, key custody, and the ability to correct a bad entry are the design. “Immutable” is not a virtue if the business sometimes records a fact in error and must reverse it. Reversal then has to be a new transaction, with a process everyone accepts.
What it does not do
A ledger does not validate the real-world event someone typed into it. A supply-chain record is only as honest as the party who wrote it. A blockchain does not provide confidential computing. Data on a broadly replicated ledger may be the opposite of private unless the application adds access control and, where needed, protection of data in use. NIST IR 8320 is the reference for trusted execution environments, and it is a different control. NIST IR 8320
A ledger is also not an AI platform, an agent protocol, or a substitute for Kubernetes. Model calls, tool authorization, and container scheduling solve different problems. See the seven frontiers and zero trust for the controls that do apply to those systems.
A decision test
- Is there more than one organization that must share a record and will not accept one of them as the system of record?
- Is tamper evidence worth the operational cost of keys, consensus, and governance?
- Can errors be corrected by an agreed later transaction?
- Would a database with ordinary access control meet the same need?
If the fourth answer is yes, the ledger is the more complicated system. Choose it when the answers to the first three justify that complexity.
