Trust model and admin powers
Who can change the network, protocol, token rules, and identity records.
Separate authorities
Network validators order transactions. Business Validators perform asset-related services. Issuers control their token suites, while platform administrators manage shared infrastructure and identity services. Holding one role does not confer the others.
The tables describe implementation powers. Dated testnet observations identify controls independently read on-chain. Technical power is separate from legal authority to exercise it.
Network and Business Validator protocol
| Controller | Power and effect | Approval mechanism |
|---|---|---|
| Network-management owner | Changes permissioned network-validator participation through management contracts | Owner-authorized transactions; separate from BV admission |
| Protocol timelock | Upgrades UUPS protocol contracts and administers the governance parameter store | A proposer schedules an operation; an authorized executor executes it after the minimum delay |
| Governance parameter administrator | Changes economic parameters and address roles, including price and settlement reporters | When held by the timelock, changes pass through its scheduling and execution process |
| Authorized price setter | Updates ASSET/USD collateral valuation | Direct signed updates subject to step, cooldown, and freeze checks |
| Protocol timelock | Forces a price update or freezes the oracle | Timelocked action; a forced update can bypass ordinary step/cooldown guards |
| Settlement reporter | Records asset and insurance payments used by scoring and enforcement | Permissioned attestation; the adapter records evidence rather than transferring payment |
The timelock delays privileged changes; its presence alone does not establish decentralized governance. Proposer and executor roles determine who can initiate and complete changes. See protocol parameters for economic settings.
Tokenization and identity
| Controller | Power and effect | Approval mechanism |
|---|---|---|
| Issuer token owner | Appoints token agents and transfers ownership | Owner transaction; a Safe requires its configured approvals |
| Token agent | Mints, burns, freezes, pauses, force-transfers, and performs supported recovery | Agent transaction; holder consent is not required for these privileged actions |
| Issuer identity-registry agent | Registers or removes wallet-to-identity associations for its suite | Agent transaction; removal affects eligibility, not the recorded balance |
| Issuer compliance owner | Configures supported suite compliance rules | Owner transaction through the compliance interfaces |
| Platform registry owner | Controls required topics and trusted claim issuers | Owner transaction; requirements can affect existing holders immediately |
| Platform identity-management key | Manages platform-provisioned investor ONCHAINIDs and adds claims | MANAGEMENT-key authority; an asset wallet is not automatically its identity's management key |
| Claim issuer and key administrator | Issues/revokes attestations and rotates signing authority | Retiring a signing key can invalidate claims still using it |
| T-REX implementation authority owner | Changes implementations used by suites following that authority | Owner-controlled version management; no built-in BV protocol timelock |
| Shared JurisdictionModule owner | Upgrades the shared jurisdiction implementation | Owner-authorized UUPS upgrade; no built-in BV protocol timelock |
| Market owner and quote signer | Rotates the quote signer; co-signs fill plans and fees | Owner transaction for rotation; quote signatures for settlement |
Standard suite deployment hands token, identity-registry, and modular-compliance ownership to the issuer. The platform retains the trusted-issuer and claim-topic registries. Those registry powers are separate from a token-agent role.
EscrowedOffering, SecondaryMarket, AssetMetadataRegistry, and IssuerRegistry are non-proxy contracts in the reviewed implementation. They still have privileged operational controls. Immutable code does not remove operator, registry, or quote-signing dependencies.
What to check
- Investors: read issuer powers and recovery alongside the instrument's terms.
- Issuers: account for shared upgrades and identity dependencies even when your wallet owns the token.
- Business Validators: model changes in collateral prices, governance parameters, and reporter inputs.
- Integrators: verify roles and implementations for the selected deployment; configuration discovery does not certify security.
Evidence and production status
At testnet block 4503, read on 17 September 2026, GovernanceParams and the PoA manager were controlled by the protocol timelock. Its minimum delay was one hour. The same single address held proposer, executor, and canceller roles. The T-REX authority and shared JurisdictionModule had the same platform-owner address. These observations do not establish independent multisignature control.
Implementation review: protocol 8a880c2 and tokenization b6c0906, checked on 17 September 2026. The contract reference records live testnet observations.
Production controller assignments, multisignature arrangements, and network selection remain unconfirmed in this edition. Historical plans are not presented as current commitments. See Security and audits for review coverage.