Status
| Control | Status |
|---|---|
| Authority enforced by the ledger contracts, per state | Live |
| Depositor, beneficiary, mediator and verifier separation | Live |
| Release quorum, rising with amount; multi-key officer signing | Live |
| Signed, scoped, expiring mandates for automation | Live |
| Institutions signing with their own hardware-held keys; key ceremonies | Live |
| Wallet sign-in and wallet-signed transactions | Live |
| Signed approval of each draft version, carried on the ledger | Live |
| Personal signature required for every money movement and binding decision | Rolling out: counted today, refused once switched on |
| No release approval by the beneficiary; person-level separation | Rolling out |
| Assurance levels L0-L5, step-up and value escalation | Rolling out: specified; step-up proven with our identity provider |
| Per-person assignment and keys unlocked by the person’s own identity | Rolling out |
| Per-action evidence records in write-once storage; key-use reconciliation | Rolling out |
How enforcement is switched on
The personal-signature rule runs in a counting mode first: every action that would be refused is recorded, but allowed. Enforcement is switched on environment by environment, once every approver in that environment has a wallet or an approved key and the signed path has been tested end to end. Each switch is a controlled change.
Residual risk, by design
- A compromised web page can ask a browser wallet to sign while its user is present. Mitigation: the wallet shows what is being signed, and high-risk roles use external or hardware wallets.
- The check of draft-approval signatures is the platform’s. The ledger can’t verify that signature type itself, so the platform checks it; the signatures themselves are on the ledger, and anyone who holds the contract can re-verify them independently.
- Automation under a mandate acts without a person, by design. Its scope is exactly the mandate the escrow agent signed, and it should be reviewed with every mandate change.
- Federated step-up depends on the institution’s identity provider. Forcing a fresh, strong authentication through an institution’s own sign-in is being proven per provider; where it can’t be, the platform’s own enrolled factor or passkey is used instead.