Shadow ledger
Informational
A shadow ledger is a second record of financial activity that a system maintains alongside the authoritative books, usually to answer a question the authoritative books cannot answer quickly enough. Because the two records are updated separately, they drift, and the drift is typically discovered during reconciliation.
How it works
The pattern appears whenever a control layer needs live state. A policy system enforcing a spending limit must know how much has been spent. If the accounting record cannot answer in the transaction path, the policy system keeps its own counter. That counter is now a ledger — one with no double-entry discipline, no period close, and no audit trail — and it diverges from the books through retries, failures, timeouts, and corrections.
Example
Northwind's policy layer counts $3,200 spent against the mandate. The books show $3,200.48, because forty-eight cents of retried calls settled twice and were later reversed. Neither number is wrong for its own purpose. But the control is enforcing against a figure that is not the financial record.
Common questions
Is a cache a shadow ledger?
A cache that can be rebuilt from the authoritative record is not. A counter that is independently incremented and cannot be reconstructed is.
How do you avoid one?
By making the authoritative record answerable in the transaction path, so the control layer has no reason to keep its own.