The mechanization of business-to-business contract enforcement requires a clear architecture and a clear and unambiguous underpinning model of the way permissions and obligations are managed within organizations. Policies will need to be expressed in terms of the basic model, and the expressive power available will depend, in part, on the ability to compose sets of policies derived from different sources. The models used must reflect the structure of the organizations concerned and how the behaviour of organizations is constrained by broader shared rules. This paper considers a contract monitoring system intended to provide automated checking of business to business contracts, sets out a suitable model and explains how it can be used to guide the representation and control of contracts in a prototype monitoring system.