A single layer of enforcement is a single point of failure, so SANAD enforces each invariant four times. Transitions that would sell before the gates are not callable in the type system, the service layer evaluates the gates, the database checks the sale timestamp, and an adversarial test passes only when the forbidden attempt fails.

The same pattern covers the obligation total that can never increase, one document per contract leg, no duplicate financing of an invoice, late charges that are never income, and the absence of any rate construct in the Murabaha engine.