Under it he wrote names—his, hers, perhaps others—and a protocol for when the retained might be called upon. He specified thresholds and witnesses, countersigns and contingencies. He did not make the ledger public. He made it auditable.
