Accounts and permissions

A key-derived address begins with an implicit one-key policy. The owner can enable an explicit native policy at the same address without moving its balances or positions.

Multisig and passkeys

The development account service at 0x1009 supports 1–16 distinct signer identities, combining secp256k1 and enrolled WebAuthn ES256 passkeys. Administrative actions bind the account, chain, policy version, authority nonce, action and expiry.

When the owner's key no longer satisfies the active threshold by itself, direct transactions from that key lose authority. A relayer submits threshold-approved actions through the account service and pays the outer transaction fee, or obtains a separately authorized sponsor.

Passkey verification includes the challenge, relying-party context, origin and assertion checks. Biometrics stay on the device; a valid P-256 signature alone is not a complete WebAuthn authorization.

Bounded delegation

Payment grants fix recipients and spending limits. Operation grants authorize an exact code-pinned call a bounded number of times. Token grants bind the relevant asset/transfer authority. Each profile defines expiry, replay protection and current-policy checks.

Wallet origin restrictions are application logic layered over these primitives. Node-side grants do not establish a website identity registry by themselves.

Guardian recovery

Guardians propose a replacement signer set after an owner-configured delay. The owner can cancel during that delay. Guardians receive no spending authority. Recovery does not release voluntary locks or erase debts and funded obligations.

Grants versus funded commitments

A grant or mandate permits future spending and does not pre-fund it. Policy changes invalidate its current authority. A funded voucher, escrow or bequest has already reserved actual cash and survives account rotation under its own settlement terms.