Everything in Rust is private by default, and the module tree is what makes an invariant enforceable rather than merely documented.

mod ledger {
    pub struct Balance { stroops: i64 }   // type public, field private
}

Outside ledger, nobody can construct a Balance with a literal, read stroops directly, or mutate it. The only way in is the constructor you exposed — so "a balance is never negative" stops being a comment and becomes a property of the type.