Reconstructing Physical Access Controls in Software: A Digest-Bound Architecture for Multi-Entity Blank-Stock Disbursement

Enterprise accounts-payable systems increasingly issue negotiable paper instruments on blank security stock rather than on pre-printed, entity-specific stock. This operational model reduces inventory and tray-management overhead, but it also removes a physical access-control boundary: possession of entity-specific paper no longer constrains which legal entity, bank account, routing data, or instrument number can be rendered. This paper characterizes the resulting threat surface and presents a multi-entity disbursement platform (MDP) that reconstructs analogous controls in software. The implemented core combines deterministic payload canonicalization and Merkleroot binding, WebAuthn-based authorization in which the batch root is supplied as the server challenge, an idempotent reserve– render–confirm sequence-allocation state machine backed by PostgreSQL transactional advisory locks, and database-enforced tenant isolation using Row-Level Security (RLS). The broader architecture also specifies a post-render issuance guard, tamperevident audit anchoring, and Positive Pay export controls; these components are explicitly distinguished as implemented, partial, or design-stage. A prototype implemented in Node.js and PostgreSQL was evaluated on an 8-core AMD workstation. Cryptographic synthesis scaled linearly with batch size (R 2 = 0.999), adding approximately 8.40 µs per item and remaining below 17 ms at 2,000 items. WebAuthn assertion verification averaged 0.93 ms. In a nofailure concurrency benchmark comprising 10,000 total sequence allocations and up to 128 overlapping request lanes, the allocator produced no duplicate or omitted allocations. These results establish low computational overhead and concurrency robustness for the measured mechanisms; they do not constitute a formal proof of end-to-end security. Finally, public commercial-banking materials illustrate an external-control asymmetry in Positive Pay workflows: exception decisions are often exposed through online treasury interfaces whose authorization semantics are not cryptographically bound to the original internal issuance digest. We therefore argue for transaction-bound authorization at the bank-side exception boundary as a future interoperability objective. Index Terms—Disbursement security, blank-stock printing, WebAuthn, FIDO2, Positive Pay, multi-tenant isolation, Merkle tree, tamper-evident logging, PostgreSQL Row-Level Security.