An apparatus, comprising: a device including at least one memory adapted to store run-time data for the device, and at least one processor that is adapted to execute processor-executable code that, in response to execution, enables the device to perform actions, including: identifying a first enclave to be used for executing a cryptlet binary of a first cryptlet, wherein the first enclave is a secure execution environment, and wherein the first enclave stores an enclave private key; causing a cryptlet key pair for the first cryptlet to be provided to the first enclave, wherein the cryptlet key pair includes a cryptlet private key and a cryptlet public key; providing the cryptlet binary to the first enclave; generating a cryptlet binding that is associated with the first cryptlet, wherein the cryptlet binding includes at least one binding, and wherein the at least one binding includes a mapping between the first cryptlet and a smart contract; generating a binding identification that is associated with the cryptlet binding; providing the cryptlet binding to the first enclave; receiving an output from the first cryptlet, such that the output is at least one of encrypted or signed by the cryptlet private key, and such that the output is signed by the enclave private key; causing a cryptlet identity to be generated for the first cryptlet, such that the cryptlet identity includes: a hash of the cryptlet binary, the cryptlet public key, and the binding identification; the actions characterized by generating a hash digest of the cryptlet identity; and causing the hash digest of the cryptlet identity to be communicated to a blockchain ledger in a blockchain network, where the hash digest is recorded on the blockchain ledger representing a version of logic controlling the smart contract. identifying a first enclave to be used for executing a cryptlet binary of a first cryptlet, wherein the first enclave is a secure execution environment, and wherein the first enclave stores an enclave private key; causing a cryptlet key pair for the first cryptlet to be provided to the first enclave, wherein the cryptlet key pair includes a cryptlet private key and a cryptlet public key; providing the cryptlet binary to the first enclave; generating a cryptlet binding that is associated with the first cryptlet, wherein the cryptlet binding includes at least one binding, and wherein the at least one binding includes a mapping between the first cryptlet and a smart contract; generating a binding identification that is associated with the cryptlet binding; providing the cryptlet binding to the first enclave; receiving an output from the first cryptlet, such that the output is at least one of encrypted or signed by the cryptlet private key, and such that the output is signed by the enclave private key; causing a cryptlet identity to be generated for the first cryptlet, such that the cryptlet identity includes: a hash of the cryptlet binary, the cryptlet public key, and the binding identification; the actions characterized by generating a hash digest of the cryptlet identity; and causing the hash digest of the cryptlet identity to be communicated to a blockchain ledger in a blockchain network, where the hash digest is recorded on the blockchain ledger representing a version of logic controlling the smart contract.