Trust model and admin powers
Who can change the network, protocol, token rules, and identity records.
Separate authorities
Network validators order transactions. Business Validators perform asset-related services. Issuers control their token suites. Platform administrators manage shared infrastructure and identity services. A party that holds one role does not gain the others.
The tables show what the code lets each controller do. The code can allow an action that the law or the asset's terms do not permit.
Network and Business Validator protocol
| Controller | Power and effect | Approval mechanism |
|---|---|---|
PoAManager owner (protocol timelock) | Changes permissioned network-validator participation. The PoAManager owns the Validator Manager | Timelocked transactions; separate from BV admission |
| Fee and reward precompile admin (protocol timelock) | Changes the gas fee configuration and fee-reward settings through the FeeManager and RewardManager precompiles | Timelocked action |
| Native minter precompile | Only the emission controller can mint native ASSET. No admin remains | Fixed; this cannot be reversed |
| Protocol timelock: upgrades and parameters | Upgrades UUPS protocol contracts and administers the governance parameter store | A proposer schedules an operation; an authorized executor executes it after the minimum delay |
| Governance parameter administrator | Changes economic parameters and address roles, including price and settlement reporters | When held by the timelock, changes pass through its scheduling and execution process |
| Authorized price setter | Updates ASSET/USD collateral valuation | Direct signed updates subject to step, cooldown, and freeze checks |
| Protocol timelock: oracle override | Forces a price update or freezes the oracle | Timelocked action; a forced update can bypass ordinary step/cooldown guards |
| Settlement reporter | Records payment attestations used by scoring and enforcement | Permissioned attestation; it records evidence and does not transfer payment |
| Tokenization Validator and Insurance Validator | Prepare and activate funded distributions in ClaimDistributor. Activation resolves the payment or the claim without the reporter | Role-holder transactions |
The timelock delays privileged changes. A timelock alone does not prove that governance is decentralized. The proposer and executor roles decide who can start and complete changes. UUPS is an upgradeable-proxy pattern: the contract keeps a fixed address, and an authorized party can replace the code behind it. See protocol parameters for economic settings.
Tokenization and identity
| Controller | Power and effect | Approval mechanism |
|---|---|---|
| Issuer token owner | Appoints token agents and transfers ownership | Owner transaction; a Safe requires its configured approvals |
| Token agent | Mints, burns, freezes, pauses, force-transfers, and performs supported recovery | Agent transaction; holder consent is not required for these privileged actions |
| Issuer identity-registry agent | Registers or removes wallet-to-identity associations for its suite | Agent transaction; removal affects eligibility, not the recorded balance |
| Issuer compliance owner | Configures supported suite compliance rules | Owner transaction through the compliance interfaces |
| Platform registry owner | Controls required topics and trusted claim issuers | Owner transaction; requirements can affect existing holders immediately |
| Platform identity-management key | Manages platform-provisioned investor ONCHAINIDs and adds claims | MANAGEMENT-key authority; an asset wallet is not automatically its identity's management key |
| Claim issuer and key administrator | Issues and revokes attestations and rotates signing authority | Retiring a signing key can invalidate claims still using it. Today, only a platform operator can revoke a claim that an issuer issued |
| T-REX implementation authority owner | Changes implementations used by suites following that authority | Owner-controlled version management; no built-in BV protocol timelock |
| Shared JurisdictionModule owner | Upgrades the shared jurisdiction implementation | Owner-authorized UUPS upgrade; no built-in BV protocol timelock |
| Market owner and quote signer | Rotates the quote signer; co-signs fill plans and fees | Owner transaction for rotation; quote signatures for settlement |
Token suites lists which suite contracts the issuer owns and which the platform keeps. Registry powers are separate from a token-agent role.
EscrowedOffering, SecondaryMarket, AssetMetadataRegistry, and IssuerRegistry are not proxy contracts, so their code cannot be upgraded. They still have privileged operational controls. Code that cannot change still depends on its operators, registries, and quote signers.
What to check
- Investors: read issuer powers and recovery alongside the instrument's terms.
- Issuers: account for shared upgrades and identity dependencies even when your wallet owns the token.
- Business Validators: model changes in collateral prices, governance parameters, and reporter inputs.
- Integrators: verify the roles and implementations for the deployment you use. Configuration discovery does not certify security.
Production
Real has not published production controller assignments, multisignature arrangements, or network selection.