Programmers have a name for the part of a program that decides what happens next. They call it control flow — the branches, the gates, the conditions that decide which lines of code are reachable and which are skipped. A program is not just its instructions; it is the structure that decides which instructions ever get to run.

Here is a claim worth sitting with: money is control flow for a society. It is the mechanism that decides which actions are reachable — who can buy a home, hire a lawyer, fund a cause, leave a job, start a business, cross a border — and which actions are quietly unreachable for the people who cannot transact. We are used to thinking of money as a thing: coins, a balance, a number that goes up and down. But a balance is only the visible surface. The deeper truth is that the system around the balance decides, at every moment, which paths through your life are open and which are closed.

Once you see money this way, a question stops being abstract and becomes urgent: who writes the control flow? Who decides which branches are reachable, and for whom? This essay is about that question — and about why the honest answer, traced carefully, is the reason we are building economic primitives that no outside party can switch off.

Three chokepoints

If money is the control flow of an economy, then power over money is power over participation. And that power is not diffuse. It concentrates at three specific points — three places where, if you stand there, you can decide who gets to act.

One: who creates the money. In the modern system, money is mostly created when banks extend credit. To create money is to decide, at the source, who can participate in the economy at all. If your access to credit is the gate to economic activity, then whoever controls credit controls the gate. Those granted credit can build; those denied it are not breaking any law — they are simply left outside the part of the economy that requires money to enter.

Two: who runs the rails. Even money you already hold has to move to do anything. And it moves over rails owned by a small number of intermediaries — the card networks, the interbank messaging systems, the correspondent banks. If all transactions flow through a handful of processors, then those processors hold a quiet veto over economic life. They can decline a payment, freeze an account, or remove a participant — and they can do it without a judge, without a charge, without a hearing. The rail does not need to convict you. It only needs to stop carrying you.

Three: who sets the rules. This is the newest and sharpest one, and it arrives with digitization. Physical cash is dumb in the best possible sense: once it is in your hand, no one can program it. It does not know what you are buying, where you are standing, or what day it is. Digital money is smart — and smart money can carry rules. It can be made to refuse certain categories of purchase, to work only in certain places, to expire on a certain date, to require a certain identity. Whoever sets those rules writes conditions directly into your ability to spend.

Each of these is a chokepoint: a single place where a branch in everyone else's control flow can be flipped. And here is the structural fact that matters most — the more digital and centralized money becomes, the more powerful these chokepoints get. Digitization does not create the chokepoints. It sharpens them, automates them, and removes the friction that used to make them slow and visible.

This is not a conspiracy. It is a gradient.

We want to be careful and honest here, because this is exactly the kind of claim that curdles into paranoia if you let it. The drift toward control is not a plot. No one needs to be twirling a moustache. The dynamic is structural, and structural is in some ways worse, because structural needs no villain and stops for no good intention.

The gradient runs like this: centralization increases efficiency. Efficiency creates advantage. Advantage compounds into power. And power, once it exists, tends to act to preserve itself. Every step of that chain can be taken by reasonable people pursuing reasonable goals — convenience, fraud reduction, compliance, speed — and the sum of all those reasonable steps is a system in which a very small number of points can decide who participates. The road to a control chokepoint is paved, mostly, with features.

That is why "they would never do that" is not a reassurance. The relevant question is never whether a particular operator is benevolent today. It is whether the architecture makes exclusion possible without due process. If the capability is built into the rails, then its use is a policy decision — and policy changes, operators change, and pressures change. The capability is the risk. The intention is just weather.

What it looks like when the branch flips

The structural argument would be easy to wave away if the branches never actually flipped. They flip.

The pattern has a name when it happens to a person: debanking. You have not been charged with anything. There is no court order. One day the account is simply closed, the payment simply declined, the donation simply blocked — for "reputational risk," or under quiet informal pressure, or because a category you belong to has been deemed inconvenient. It has happened to disfavored-but-legal industries pressured out of the banking system without a single law being broken. It has happened to organizations whose donations were blocked by payment companies acting in concert, with no charge ever filed. It has happened to ordinary people whose accounts were frozen during a political dispute for giving small, legitimate sums. And it happens, persistently and quietly, to people in legal professions that banks would simply rather not be associated with.

In none of these cases did the system need to prove anything. That is the whole point. The chokepoint does not require a verdict. It requires only the ability to stop carrying you — and in a fully digital economy, being un-carried by the rails approaches being erased from the economy. Without an account you cannot easily receive wages, pay rent, or buy most things. The exclusion is not a punishment handed down. It is a branch silently marked unreachable.

The frontier: money that enforces its own rules

The third chokepoint — who sets the rules — is where the next decade gets decided, and it deserves a clear-eyed look rather than either hype or panic.

The technology in question is programmable money issued directly by a monetary authority — money that can carry conditions in its own code. Most of the world's economies are now exploring some form of it. The capabilities are not science-fiction; they are the natural features of the thing. Programmable money can be restricted by category, so it buys some things and refuses others. It can be restricted by place, so it works here and not there. It can be made to expire, so it must be spent by a date rather than saved. And because every transaction is legible to the issuer, it can be watched in full, and combined with identity into a complete account of a person's economic life.

We are stating capabilities, not predicting their use, and that distinction is the honest one. But notice what becomes possible when the rules travel inside the money: the account freeze that once required emergency legislation becomes a setting. The exclusion that once needed a pretext becomes a default. The due process that was already thin gets thinner, because there is no longer even an intermediary to petition — the refusal is in the currency itself.

This is the logical endpoint of the gradient. Cash was control flow you held in your hand, and no one could rewrite it. Programmable money is control flow held by the issuer, and it can be rewritten remotely. The shift is not subtle once you name it: from money that obeys whoever holds it, to money that obeys whoever issued it.

The case for primitives that cannot be switched off

So here is where the analysis lands, and where the building begins. If money is control flow, and if the control flow concentrates at chokepoints, and if those chokepoints can exclude without due process — then preserving the ability to participate requires economic primitives that have no chokepoint to capture.

Not a better operator. Not a kinder bank. Not a promise. An architecture in which the three powers — to create, to carry, to rule — cannot be seized, because they were never centralized in the first place.

That is the design stance underneath the mutual credit we are building, and it is a stance about structure, not sentiment. What we build is deliberately not money — it is a record of obligation between people, an IOU. Mutual-credit balances are created between two people at the moment of a transaction — there is no central issuer holding the power to grant or deny the gate, because the credit is minted by the relationship itself. The records live on the participants' own devices and sync directly between them — there is no rail in the middle to decline a payment, because there is no middle. And there is no global programmable layer that an outside authority could use to write rules into your ability to spend, because there is no global ledger at all; value is defined inside a relationship or a community, not on an order book someone else controls.

None of this is magic, and we will not pretend it is costless or finished — a later piece in this series is honest about the genuine tradeoffs of giving up a global ledger, and about the narrow cases where global agreement really is the right tool. The point here is narrower and harder: the capability to exclude is the risk. The only durable answer to a capability is to not build the capability into the architecture. You cannot capture a chokepoint that does not exist.

Standing on others' shoulders

We are very far from the first to see this, and it would be dishonest to imply otherwise. The people who built the alternatives saw the chokepoints long before we did, and they deserve the credit.

• The mutual-credit and time-bank traditions worked out, in practice, how money can be created at the moment of exchange and need no central issuer — the oldest answer to the first chokepoint, recovered and re-run for decades by people who never used the words "control flow."
• Circles is the closest large-scale demonstration that a currency can take its value from a web of trust rather than a central backing, and its years of real-world record — including failure and redesign — taught more than any whiteboard could.
• GNU Taler is the sharpest existence proof that you can build serious, privacy-respecting digital payments that are legible to the regulated world at the right boundary without a speculative token or a global ledger — a model we admire and echo: private for the payer, transparent where it must be.
• Sacred Economics and the commons-governance tradition supply the why beneath the what: money as a token of relationship rather than a claim on scarcity, and shared things stewarded rather than enclosed.

What we add to that long conversation is mostly a matter of context: we are local-first and offline-capable with no global consensus, and we bind the whole system to a small set of axioms that make "no silent exclusion, no silent mutation of value" a hard architectural rule rather than a hope. That is a contribution to the work these projects started, not a critique of it.

The honest limit

Let us close where we are obligated to. This is a structural argument and a design philosophy, not a prophecy. We have described capabilities and tendencies; we have not claimed to know how any particular authority will choose to use them. The chokepoints are real and the documented exclusions are real, but the future is not yet written, and reasonable people will weigh the convenience of digital money against its control potential differently than we do.

What we are confident of is narrower and, we think, sturdy: money decides who gets to participate, that decision concentrates at a few points as money digitizes, and a point that can exclude eventually will be asked to. The most honest response to that is not to trust the people at the chokepoint. It is to build the parts of economic life that matter most so they have no chokepoint to trust — to make participation a property of the architecture, not a permission granted from above.

That is what it means to take the control-flow metaphor seriously. The question was never just what is money. The question was always who gets to decide who can run.

Written by AI agents from real project logs; owned and edited by Mujo.