Every action that records an agreement, an approval, a release, an attestation or an assignment requires a credential of a stated strength. A higher level satisfies every lower one. When a request arrives with a weaker or older authentication than its action needs, the platform refuses it and asks for a fresh one of the right strength (a “step-up”); it never quietly accepts less.
Status: Rolling out. The levels are specified and the step-up mechanics are proven against our identity provider. Today the platform applies the earlier rule (a personal wallet signature for every money movement and binding decision) and counts the actions that arrive without one; the level map replaces it as it is switched on.
The ladder
| Level | Name | What it takes | What it proves |
|---|---|---|---|
| L0 | Mandate | Platform automation acting within a mandate the principal signed on the ledger | The principal authorized this kind of action in advance |
| L1 | Signed in | Any valid session: an enterprise sign-in or a wallet sign-in | Someone holding the account was present at some point |
| L2 | Personal | The person’s own key signs the transaction, or their own sign-in for a party their own institution hosts | This person acted |
| L3 | Fresh and strong | L2, plus two factors within the last 15 minutes (a wallet signature with biometric or PIN, or a two-factor re-authentication) | This person acted just now, with two factors |
| L4 | High assurance | A hardware-held key plus a phishing-resistant authentication (a FIDO2 security key or passkey) within the last 10 minutes, bound to the transaction itself | This person approved exactly this transaction, in person |
| L5 | Ceremony | Administrator credentials that can’t transact, phishing-resistant, and approval by more than one administrator where keys or authority change | A controlled change, by named administrators |
Two rules keep the ladder honest:
- A sign-in alone never binds someone else’s party. An enterprise login reaches L2 only for a party hosted by that person’s own institution, because whoever operates a party’s node could otherwise act as it. Everyone else reaches L2 and above with their own key.
- Administrators don’t transact. An administrator who also approves payments does so with a separate personal identity, at the level the payment needs.
Where each level applies
| What you are doing | Examples | Level |
|---|---|---|
| Reading and preparing | Viewing an escrow, editing a draft, commenting, inviting a counterparty | L1 |
| Raising and requesting | Raising a dispute, requesting a cancellation, uploading documents, examining presented documents | L2 |
| Agreeing | Proposing or accepting an escrow, approving a draft or agreement version, amendments | L3 |
| Committing money | Funding, each allocation step, reclaiming after a deadline | L3 |
| Approving | Approving a milestone release, waiving discrepancies, ratifying a settlement, cancellation, electing the payout rail, a mediator’s orders | L3 |
| Releasing money | Disbursement approval by release approvers and officers, with the escrow’s quorum | L4 |
| Attesting | Oracle and verifier signatures; an auditor’s countersigned reserve attestation | Attestation (the auditor’s countersignature at L4) |
| Assigning authority | Naming an officer, release approver, mediator or agent; granting a mandate; changing quorum tiers or thresholds | L5, two administrators |
| Administering | Institution key ceremonies, restoring a key from backup, identity-provider configuration | L5, two administrators for keys and recovery |
| Automation | Ratifying, activating and releasing under a mandate; oracle-verified releases; renewing holds | L0 |
No action that already required a personal wallet signature drops below L3.
Amounts raise the level
Whatever an action’s base level, one that moves or commits money needs at least L3 from $5,000 and L4 from $10,000. These are the platform defaults; each deployment can set them lower (test environments do, so the strongest step-ups can be exercised with small sums), and raising them in production is itself a controlled change. The freshness windows (15 minutes for L3, 10 for L4) are maxima: a deployment may shorten them and the platform refuses to start with longer ones.
Modifiers
- Quorum: a number of distinct people, each at the stated level. The party receiving the money never counts, and two parties belonging to one person count once.
- Attestation: a signature about a fact. It is evidence, never consent.
- Delegation: an agent acting for a principal must meet the level itself, under a mandate or assignment recorded on the ledger.
How a step-up is delivered
The strongest credential a person already has is used first.
| Who | First choice | Then |
|---|---|---|
| A person at an institution | Their own institution’s identity provider, asked for a fresh authentication of the stated strength | A factor enrolled with the platform; then a platform passkey bound to the transaction |
| An individual | Their own wallet, signing the transaction after verifying them | A platform passkey; then a factor enrolled with the platform |
For L4 only a phishing-resistant factor qualifies: a hardware security key or hardware-bound passkey, an institution’s sign-in that attests one, or a hardware wallet. A push confirmation to a phone serves as a fallback for L3 only. For a legal agreement that needs a recognized electronic signature, a qualified electronic signature service can deliver L4. Each record names which method was used.