# Trust model and admin powers (/docs/resources/trust-model) ## Separate authorities [#separate-authorities] Network validators order transactions. Business Validators perform asset-related services. Issuers control their token suites, while platform administrators manage shared infrastructure and identity services. Holding one role does not confer the others. The tables describe implementation powers. Dated [testnet observations](/docs/resources/testnet-contracts) identify controls independently read on-chain. Technical power is separate from legal authority to exercise it. ## Network and Business Validator protocol [#network-and-business-validator-protocol] | Controller | Power and effect | Approval mechanism | | ---------------------------------- | --------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------- | | Network-management owner | Changes permissioned network-validator participation through management contracts | Owner-authorized transactions; separate from BV admission | | Protocol timelock | Upgrades UUPS protocol contracts and administers the governance parameter store | A proposer schedules an operation; an authorized executor executes it after the minimum delay | | Governance parameter administrator | Changes economic parameters and address roles, including price and settlement reporters | When held by the timelock, changes pass through its scheduling and execution process | | Authorized price setter | Updates ASSET/USD collateral valuation | Direct signed updates subject to step, cooldown, and freeze checks | | Protocol timelock | Forces a price update or freezes the oracle | Timelocked action; a forced update can bypass ordinary step/cooldown guards | | Settlement reporter | Records asset and insurance payments used by scoring and enforcement | Permissioned attestation; the adapter records evidence rather than transferring payment | The [timelock](/docs/resources/glossary#timelock) delays privileged changes; its presence alone does not establish decentralized governance. Proposer and executor roles determine who can initiate and complete changes. See [protocol parameters](/docs/business-validators/parameters) for economic settings. ## Tokenization and identity [#tokenization-and-identity] | Controller | Power and effect | Approval mechanism | | ------------------------------------ | ------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------- | | Issuer token owner | Appoints token agents and transfers ownership | Owner transaction; a Safe requires its configured approvals | | Token agent | Mints, burns, freezes, pauses, force-transfers, and performs supported recovery | Agent transaction; holder consent is not required for these privileged actions | | Issuer identity-registry agent | Registers or removes wallet-to-identity associations for its suite | Agent transaction; removal affects eligibility, not the recorded balance | | Issuer compliance owner | Configures supported suite compliance rules | Owner transaction through the compliance interfaces | | Platform registry owner | Controls required topics and trusted claim issuers | Owner transaction; requirements can affect existing holders immediately | | Platform identity-management key | Manages platform-provisioned investor ONCHAINIDs and adds claims | MANAGEMENT-key authority; an asset wallet is not automatically its identity's management key | | Claim issuer and key administrator | Issues/revokes attestations and rotates signing authority | Retiring a signing key can invalidate claims still using it | | T-REX implementation authority owner | Changes implementations used by suites following that authority | Owner-controlled version management; no built-in BV protocol timelock | | Shared JurisdictionModule owner | Upgrades the shared jurisdiction implementation | Owner-authorized UUPS upgrade; no built-in BV protocol timelock | | Market owner and quote signer | Rotates the quote signer; co-signs fill plans and fees | Owner transaction for rotation; quote signatures for settlement | Standard suite deployment hands token, identity-registry, and modular-compliance ownership to the issuer. The platform retains the trusted-issuer and claim-topic registries. Those registry powers are separate from a token-agent role. EscrowedOffering, SecondaryMarket, AssetMetadataRegistry, and IssuerRegistry are non-proxy contracts in the reviewed implementation. They still have privileged operational controls. Immutable code does not remove operator, registry, or quote-signing dependencies. ## What to check [#what-to-check] * **Investors:** read [issuer powers and recovery](/docs/tokenization/investor-workflow#issuer-powers-and-holder-risks) alongside the instrument's terms. * **Issuers:** account for shared upgrades and identity dependencies even when your wallet owns the token. * **Business Validators:** model changes in collateral prices, governance parameters, and reporter inputs. * **Integrators:** verify roles and implementations for the selected deployment; configuration discovery does not certify security. ## Evidence and production status [#evidence-and-production-status] At testnet block **4503**, read on **17 September 2026**, GovernanceParams and the PoA manager were controlled by the protocol timelock. Its minimum delay was **one hour**. The same single address held proposer, executor, and canceller roles. The T-REX authority and shared JurisdictionModule had the same platform-owner address. These observations do not establish independent multisignature control. Implementation review: protocol `8a880c2` and tokenization `b6c0906`, checked on 17 September 2026. The [contract reference](/docs/resources/testnet-contracts) records live testnet observations. Production controller assignments, multisignature arrangements, and network selection remain unconfirmed in this edition. Historical plans are not presented as current commitments. See [Security and audits](/docs/resources/security-and-audits) for review coverage.