You set target allocations across Canton-native assets. Rebal watches drift and rebalances the moment your band breaks — settling bilaterally, so no counterparty and no observer ever sees more than their own leg.
Move the band. Nudge a target. The engine re-nets the smallest set of legs that puts you back on mandate — and does nothing at all while you are inside it.
On a transparent chain, a rebalance is an announcement: size, direction, timing, all readable before you finish. Canton settles bilaterally with sub-transaction privacy, so each party holds exactly one slice and nothing more.
No views to hold, no calls to make. You author the rules once; the engine is the only thing that trades.
Multi-leg rebalances settle as one delivery-versus-payment. A half-finished portfolio is not a state this engine can produce.
Assets never leave your participant node. The Daml mandate can only act inside your bands, and you revoke it in a single transaction.
There is no public queue of pending intent. Validators order encrypted payloads they are not permitted to read.
Every rebalance leaves a provable trail you can hand to an auditor or regulator — and to nobody else by default.