Structure and mechanics: two axes for tokenised RWA

Two products, both labelled "tokenised real-world asset."The first has an immaculate on-chain surface. Every admin permission is enumerated on a public page. NAV is posted on-chain daily. The redemption queue is visible to anyone. Oracle attestations are timestamped, the contracts are verified, the audits are current. Nothing about how it operates is hidden.

The second has almost none of this. NAV is reported off-chain, in a monthly PDF. The admin powers are not documented anywhere a holder can find them. Redemption is a customer-service ticket, answered when it is answered.On the visible evidence, the first looks the stronger of the two, and most public assessments would rank it that way.

The legal structure, however, sits in the offering documents, not on the chain. The first product is subordinated debt: a claim against an operating company that holds the asset as one balance-sheet item among many. The second is a beneficial interest in a compartment that statute ring-fences from its sponsor. While both issuers are solvent the difference is invisible and does not matter. It matters when an issuer fails. If the first fails, the holder is a general creditor of the operating company, ranking behind its other obligations. If the second fails, the compartment is not part of the sponsor's estate, and the holder's claim survives.

Which product is safer to hold depends on which failure you are pricing, and that is the difficulty: the question runs together two measurements that are separate. One is how the token behaves while the issuer operates normally - the observable surface both products show. The other is what the token is, legally, when the issuer stops. In The RWA tokenization spectrum we laid out a five-level structural spectrum, L0 to L4, for exactly that question: L0 is the operating-company debt claim, L2 the ring-fenced vehicle, L3 and L4 higher still. This article takes that spectrum as given and places the mechanics axis beside it. On the two together, the first product is L0 with strong mechanics, the second L2 with weak ones. Assessing one axis and reporting it as the other is the most common analytical error in the market today.

What the mechanics axis measures

The mechanics axis is about operations, not law. It measures how the token's on-chain machinery behaves from day to day while the issuer is solvent and running normally, and it catches one class of failure: misbehaviour, error, or fragility in that machinery. An admin key moves funds it should not. An oracle goes stale and triggers improper liquidations. A redemption gate is changed without notice. An upgrade introduces a defect or a back door. A holder is removed from a whitelist. These are real failures with real losses, and none of them requires the issuer to be in distress. They happen on a live, going-concern product.

The dimensions are familiar, because they are the ones the analyst community already inspects:

• Admin permissions: which keys can do what, multisig thresholds, timelocks, the scope of any emergency pause.
• Upgrade paths: which functions are upgradeable, who governs an upgrade, what notice a holder gets.
• Redemption design: whether the on-chain path faithfully represents the asset's true settlement, without adding gaps on top of it. A real T+10 asset redeeming through a deterministic, on-chain ten-day flow is correct; the anti-pattern is burning the token and then depending on an off-chain, manual settlement that leaves the holder carrying an unenforceable gap with nothing in hand. Speed beyond the underlying's own settlement, through early buyout or prefunding, is a paid liquidity service, not a mark of better representation. Cadence, queue transparency, and gate parameters sit inside this.
• Oracle hygiene: freshness, deviation thresholds, fallback behaviour, source diversity.
• Reporting: how often NAV is posted, on-chain or off, and whether there is an audit trail.
• Whitelist mechanics: how addresses are added or removed, who governs the list, what notice exists.

To place a product on this axis rather than only describe it, it helps to tier the axis the way the structural spectrum is tiered. Call the levels M0 to M4.

• M0, opaque. Reporting is off-chain, admin powers are undocumented, redemption is a support ticket answered at the issuer's discretion. Nothing about the machinery can be verified from the chain.
• M1, disclosed. The powers exist and are documented, but they are concentrated: a single key or a low-threshold multisig, manual processes, no timelock. A holder can see what can be done to them but cannot slow it down.
• M2, constrained. Meaningful multisig thresholds, timelocks on upgrades, an on-chain redemption queue, an oracle with basic freshness and deviation handling. Discretion still exists but is bounded and observable.
• M3, hardened. Robust timelocks, published deviation and fallback rules, transparent gate parameters, a minimal upgrade surface. The remaining trusted actions are few and well-fenced.
• M4, minimised. Immutable or narrowly upgradeable contracts, fully on-chain reporting, no discretionary controller powers. There is little left to trust because there is little left that anyone can change.

A mature position on this axis is necessary. It is not sufficient. Everything M0 to M4 measures is conditional on the issuer being alive and operating. The axis is silent on what the holder is left with when the issuer is not. That question belongs to the other axis.

What the structural axis measures

The structural axis is about law, not operations. It measures what the holder is left with when the issuer stops operating: when the operating company becomes insolvent, when an enforcement action removes it, when the program is terminated, when a regulator freezes redemption. These are the failures the mechanics axis cannot see, because they begin where going-concern behaviour ends.The dimensions are legal, not operational:

• Whether the holder has a direct claim on the underlying, or a claim on a chain of intermediaries that hold it.
• Whether any vehicle between the holder and the underlying is bankruptcy-remote in a robust sense, or only on paper.
• Whether the legal opinions, if any, cover the layer the holder actually holds, or a layer further down.
• What recovery mechanism exists if the issuer fails, and how long realising it takes.
• Which jurisdiction recognises the token, and as what.

These facts are not in transaction logs or audit reports. They are in the subscription agreement, the conditions of issue, and the legal opinions: documents filed once and rarely re-read. This is the axis we laid out in The RWA tokenization spectrum as a five-level spectrum: L0, operating-company debt; L1, a wrapper SPV beneficial interest; L2, a statutorily ring-fenced vehicle; L3, the token as the registered security under a DLT statute; L4, the native legal claim. The spectrum is the structural axis tiered, exactly as M0 to M4 tier the mechanics axis.The two axes catch failures in different regimes. Mechanics dominates the base case, where the issuer is alive and the only risks are operational. Structure dominates the tail, where the issuer is gone and the only thing left is the legal claim. A product can be strong on one and weak on the other, because the two are built by different people, out of different materials, against different failures. They are not substitutes. A high score on one does not compensate for a low score on the other; it only hides it.

The grid

Put the two tiered axes on one grid: the structural spectrum L0 to L4 down the side, the mechanics ladder M0 to M4 across the top. Twenty-five cells, but four regions carry the argument, divided by two fault lines. On the structural axis the line falls at L2, where ring-fencing stops being a matter of paper and becomes a matter of statute. On the operational axis it falls at M2, where discretion stops being unbounded and becomes bounded and observable.

The boundaries are gradients, not walls; the two fault lines are where the character of the product changes fastest.

Visibly weak: low structure, weak mechanics

Top-left. Thin claim, opaque machinery. Easy to identify and rare, because a product this exposed on both axes does not survive scrutiny for long. It is the least interesting region precisely because the two weaknesses are visible together.

Veneer: low structure, strong mechanics

Top-right of the low-structure band, and the region this article exists to name. The machinery is excellent: state readable on-chain, transparent admin, timelocks, audited contracts, a clean redemption queue. The on-chain story is complete and coherent, and the further right the product sits on the mechanics axis, the more convincing it becomes. But the legal claim underneath is L0 or L1, subordinated debt or a wrapper that pierces under stress. The product decentralises the wrong layer: the machinery is trust-minimised while the claim stays fully trust-dependent. While the issuer is solvent the product performs cleanly, and that performance is genuine. In the tail, under sponsor distress, enforcement, or insolvency, the transparency protects no one, because the claim it sits on was thin to begin with.

This is the most consequential misclassification because it is the most convincing. Capital sees the visible axis, reads strength, and prices the product as though the claim were strong too. The mispricing does not resolve until an adverse scenario arrives, which by construction has not happened yet.

Hidden strength: high structure, weak mechanics

Bottom-left. A properly ring-fenced vehicle, a securitisation compartment or a segregated portfolio, with clean opinions and a genuine independent board, but rough on-chain: NAV off-chain, admin keys undocumented, redemption handled bilaterally. The structural floor is high; the day-to-day is noisy. The asset survives the sponsor's death but does not handle going-concern misbehaviour cleanly. Common in early products from regulated issuers who built the legal structure first and have not yet built the surface.

Aligned: high structure, strong mechanics

Bottom-right. Strong on both, the target, and currently rare, because building both takes time and capital and most issuers build the visible axis first. A product here survives both the base case and the tail.

Redemption: where the machinery meets the claim

Redemption is the clearest place to watch the two axes interact, because a holder's exit runs through both. The mechanics axis sets how honestly the on-chain flow tracks the asset's true settlement; the frontier of that is reciprocity, where the off-chain custodian acts only on verified on-chain state and reflects its action back to it, so the two balances cannot drift. Sync becomes a property of the flow rather than something a quarterly attestation asks you to trust. At L4 this is free, because the chain is the register and there is no second balance to reconcile; below L4 it has to be engineered.

But reciprocity bottoms out on the claim, and this is the whole argument in one mechanism. Code can verify off-chain state; it cannot bind an off-chain actor. A custodian meant to act only on verified on-chain state can release the asset to a colluder while the token still exists, and the chain sees nothing. You can shrink that residual - independent oracles, triparty control, open-account APIs raise how many parties must collude and how likely they are to be caught - but you cannot remove it below L4 - and even there it is only gone where the value the register carries is itself on-chain. Nor do you need to: the residual you are left with is the same foundation a registered share rests on, and the standard is no more avoidable layers than the instrument's honest structure requires, not proof that the world exists. The best redemption machinery cannot outrun the claim beneath it.

A verdict needs to know what the token claims to be

One qualification keeps the grid honest. A cell is not good or bad on its own; it is good or bad relative to what the instrument is meant to represent. Low structure with strong mechanics is a veneer only when thin structure is presented as a durable claim that holders rely on. The same coordinate, for an instrument that is honestly a pass-through conduit, holding value only for moments and asking no one to carry a claim, is simply a well-built rail. The grid locates a product; the verdict comes from comparing that location against the representation the product makes. The dominant error is not sitting at a low level. It is a mismatch between the level and the claim.

Why the axes get conflated

If the two axes are so clearly different, why does the market keep reading one as the other. Three reasons.The first is visibility asymmetry. Mechanics are visible by construction: they live on the chain, in verified contracts and queryable state; whether you read them through a dashboard, an explorer, or a script is presentation, not substance. Structure lives in legal documents written for lawyers and filed once. An analyst defaults to what can be seen, and the market follows the analyst. The axis that is easy to inspect becomes the axis that gets inspected.

The second is vocabulary. The words the on-chain community is fluent in - audited, decentralised, transparent, trust-minimised, immutable - all describe mechanics. The words that describe structure - compartmented, bankruptcy-remote, subordinated, registered - are legal terms the same community does not natively speak. A field assesses what it has language for. When the available vocabulary is operational, the operational axis gets a rich, confident assessment and the structural axis gets a sentence, or nothing.

The third is collapse under compression. The two axes answer different questions, but in casual use they fuse into a single one: is this safe. Practitioners who think carefully keep them apart; the broader market does not, and the broader market sets the price. Once "is the machinery good" and "is the claim strong" have collapsed into "is it safe", a strong answer to the first stands in for a strong answer to the second.

The result is an equilibrium, not a conspiracy. The veneer is rarely deliberate deception. It is what happens when the dimension capital can see is the dimension capital prices. An issuer who builds excellent mechanics on a thin claim is not necessarily hiding anything; the structure is disclosed, in the documents, for anyone who reads them. The market simply rewards the visible axis and underweights the invisible one, and that reward pulls new issuance toward more of the same: optimise the surface, because the surface is what gets priced.

What an aligned reading requires

Holding a tokenised RWA well means reading both axes and keeping them apart. An L2 token with weak mechanics has a strong floor and a noisy day-to-day; an L0 token with strong mechanics has a clean day-to-day and a thin floor. Neither reading substitutes for the other, and the holder should know which of the two they hold before pricing it.

The two-axis frame is itself one slice of a larger picture. A tokenised RWA rarely sits alone. It ends up inside a vault, and the vault inside a lending protocol, a collateralised stablecoin, a structured product. Each consuming layer adds its own operational dimensions - its redemption queue, its oracle, its liquidator economics, its governance and upgrade paths - on top of the structural level of the underlying. A holistic reading of any of these has to compose all of it: the structural level of the RWA, the operational mechanics of the wrapper, the redemption profile of the vault, and the stress behaviour of the protocol that consumes it, across both the base case and the tail.

This article is narrow on purpose. It separates two things the market routinely fuses, so that each can be read on its own terms. Get the structural level and the operational mechanics apart, and judge each against what the instrument claims to be. The chain tells you how the token behaves. The documents tell you what it is. The risk and the price are set by both axes together, and by how they are joined.