Technology
Checked before it happens, not after
Failures are refused in path — nothing moved, nothing to unwind.
See contractsOne request
- Allowed to ask Passed
- Matches what would run Passed
- Waiting period run Passed
- Destination permitted Refused
- Signature still good Not reached
The checks
What gets asked first
Asked by the account, not by the app you happen to use.
-
Is this person allowed to ask?
Permission is per operation kind — not a blanket on the account.
-
Does that match what will actually run?
Permission is checked twice — for the request made, and for the operation it would carry out.
-
Has the waiting period run?
No early proceed on your own. Whoever may cancel can still stop it while the clock runs.
-
Is the destination allowed?
Each operation has its own list of permitted destinations. An empty list permits nothing — there is no fallback.
-
Is this signature still good?
Chain, deadline, unused nonce, and a signer who holds the permission.
One door — checks in front
The account calls out only after every check has passed. No second path; no privileged caller behind the door.
Read review- An attacker reaches the interface
- They can ask. Approval and destinations stay separate.
- A signed request is replayed later
- Each signature is good once, for one chain, until its deadline.
Put an account behind these checks
Workspace or your product — same enforcement.
Alpha · Testnet · Personal workspace