SIH26125Bharat Electronics Limited · Ministry of Defence

The asset refuses to move without a valid credential.

Identity, access control and custody of controlled equipment, held as one record on a private permissioned chain — where the transfer itself reverts if the receiver’s credential is missing, expired or revoked.

Gate 3 · North Blockreading chain state

Refused

Signal Analyser SN-8823

Token #1 · requires Secret

presented byA. DeshpandeRadar Systems · contractor

checkRole() → InvalidReason.Revoked

Withdrawn 2 Sep 2026, 11:04. The card still prints; the credential behind it does not.

Asset not released. Custody unchanged.

Released

Signal Analyser SN-8823

Token #1 · requires Secret

presented byPriya MenonDivisional Manager, Radar Systems

checkRole() → InvalidReason.Valid

Secret clearance issued 7 Mar 2026, valid for another 29 days.

Asset released. Custody logged on chain.

Refused

Oscilloscope OS-2140

Token #4 · requires Secret

presented byS. RaoInstrumentation, Bay 4

checkRole() → InvalidReason.Expired

Nothing was revoked. The grant reached 14 Aug 2026 and lapsed on its own.

Asset not released. Custody unchanged.

Refused

Signal Analyser SN-8823

Token #1 · requires Secret

presented byRahul NairTechnician, Radar Systems

checkRole() → InvalidReason.NeverGranted

No Secret clearance was ever issued to this holder.

Asset not released. Custody unchanged.

One record, three registries.

IdentityIdentityRegistryA DID and a public key per person. Names and photographs never reach the chain.
Access controlRoleRegistryGrants with an expiry and a revocation flag. checkRole() returns one of four answers.
Asset custodyAssetTokenEach item is a token bound to its holder's DID, carrying its own custody history.

Every issue, revocation and transfer lands as a chain event, and the audit trail is replayed from those events — so there is no second version to reconcile.

Identity platforms stop at the credential. Token standards stop at the transfer.

This joins them. Every movement of an asset calls into the role registry and reverts if the receiver’s credential is missing, expired or revoked.

Because the check sits in the contract rather than in an interface, it holds for this console, for a script, and for any client anyone writes later. That is the difference between a permission and a rule.

contracts/AssetToken.sollines 68–87

68function _update(address to, uint256 tokenId, address auth)        internal override returns (address from) {69    from = super._update(to, tokenId, auth);70 71    bool isMint = from == address(0);72    bool isBurn = to == address(0);73 74    if (!isMint && !isBurn) {75        RoleRegistry.Role requiredRole = assets[tokenId].requiredRole;76        (bool valid, RoleRegistry.InvalidReason reason, uint64 expiry) =            roleRegistry.checkRole(to, requiredRole);77        if (!valid) {78            if (reason == RoleRegistry.InvalidReason.Revoked) {79                revert TransferBlockedRoleRevoked(to, requiredRole);80            } else if (reason == RoleRegistry.InvalidReason.Expired) {81                revert TransferBlockedRoleExpired(to, requiredRole, expiry);82            } else {83                revert TransferBlockedRoleNeverGranted(to, requiredRole);84            }85        }86    }87}

Three refusals, three named errors — so a client can say why a transfer failed without guessing. This is the hook every ERC-721 transfer is forced through, which is why no interface can route around it.

Five minutes, in five moves

1Issue
An identity nobody has to vouch for
A DID is created for a person and a role credential issued against it. The chain carries the identifier, a public key and a status flag — never a name, a photo or an employee number.
2Register
The asset becomes the record
A controlled item is minted as a token bound to its holder's DID, carrying its own custody history instead of appearing as a row in somebody's spreadsheet.
3Refuse
The transfer that cannot happen
Moving the asset to someone without a valid credential reverts inside the contract. Not a disabled button, not a validation message — the transaction fails, and it fails the same way from a script.
4Revoke
Offboarding in one transaction
Withdrawing a credential is a single on-chain write. Every verifier sees it on its next check, including the ones that were offline when it happened.
5Replay
A record that cannot disagree with itself
The audit trail is not a log about the transactions. It is the transactions, reconstructed from chain events with no database consulted — so there is no second version to reconcile.

Four surfaces, one record underneath.

An issuing authority, a gate post, an auditor and a printed card. Each sees exactly what its job needs, and none of them can disagree about what is true — because none of them keeps its own copy.

console — dashboard

Dashboard

Read from contract state, not a cache.

People

3 credentialled

Assets

bound to a DID

Revoked

still in the trail

Events

replayable

AssetHeld byRequires

#1Priya MenonSecret

#2K. IyerAuditor

The console. Every figure read from contract state at request time, so the dashboard and the chain cannot drift apart.

BHARAT ELECTRONICS LIMITED

Asset & Access Credential

Priya Menon

Divisional Manager, Radar Systems

MANAGER

Scan to verify — the QR is the source of truth, not this print

The card. Photo for a human to match, QR for a scanner to verify. Nothing on it can be trusted except the QR.

gate — check

Gate check

Scan with cameradid:ethr:0x7a69:0x7099…

Priya Menon

Secret · valid

Credential valid until 6 Oct 2026. Holds asset #1.

Rahul Nair

RoleNeverGranted

No Secret clearance. Not permitted to carry asset #1 out.

The gate. One question — is this credential valid right now — and the refusal is as legible as the pass.

audit — replay

All contracts ▾All events ▾Search the record

39 events recorded · page 1 of 2

00:56AssetTokenAsset #1 minted to Priya Menon
00:55RoleRegistrySecret clearance issued to Priya Menon
00:54AssetTokenTransfer refused — no Secret clearance
00:52RoleRegistryAuditor credential issued to K. Iyer
00:51IdentityRegistryIdentity registered for Rahul Nair

The replay. Filterable, paged, and reconstructed from chain events rather than queried from a log.

3 of 4 — select an entry to bring it forward

The record itself. Four entries from one asset, including the transfer that was refused. Every surface above is reading this, and none of them keeps a copy.

Two jobs that share nothing

Property	The issuing authority	The gate
Provisioned as	A person, whose console role is read from the chain.	A post rather than a person — staffed by whoever is on shift.
Can	Onboard identities, issue and revoke credentials, register assets, replay the whole history.	Ask one question: is this credential valid right now.
Cannot	Move an asset to someone without a valid credential. The contract refuses the console like anything else.	Write. It reads, and holds no credential of its own.
Loses access when	Their own credential is revoked — one write closes the console with it.	The post is stood down. Nothing personal was ever issued to it.
Reads from	Contract state — at request time in the console, at scan time at the gate. Neither of them keeps a copy, which is the only reason they can never disagree.

Signing in decides which screens open. It never decides what the chain permits: a compromised session still cannot move an asset to someone without a valid credential, because that check is not in the session.

Ownership, permission and history become one cryptographic object that no administrator can rewrite.

Three sign-ins — issuing authority, gate security, internal audit — reading one chain. Take any of them and try to move an asset you are not credentialled for.

The asset refuses to move without a valid credential.

Identity platforms stop at the credential. Token standards stop at the transfer.

Five minutes, in five moves

An identity nobody has to vouch for

The asset becomes the record

The transfer that cannot happen

Offboarding in one transaction

A record that cannot disagree with itself

Two jobs that share nothing