Technology
Rules live on the account
Ownership, roles, and execution rules sit with the account itself — so policy is not a patchwork around whoever can sign, and who widens the rules is not who runs them.
The rules an account can hold- Ownership SecureOwnable Who owns the account, who may recover it, and the wait before either changes.
- Roles and permissions RuntimeRBAC Roles you create, and what each may do — per operation, changed while it runs.
- Execution rules GuardController The waiting period, and the destinations each operation is permitted to reach.
The account
What each part does
What each part is responsible for, and why you would want it separate.
-
Ownership
Separate from day-to-day work, so losing a key is a recovery process rather than a lost account — and taking ownership is slow enough to be noticed.
-
Roles and permissions
Owner and recovery belong to the account itself — handed on, never deleted, so it is never left with nobody in charge. Every other role is yours to create and change while it runs.
-
Execution rules
The waiting period and the permitted destinations. This is the part you can put in front of a setup you already run, without adopting the rest.
Placement
Not around the account — on it
Where this architecture sits relative to apps and signatures.
-
On the account, not in the app
The interface can raise a request. It cannot quietly rewrite who may act or where funds may go.
-
Beside the signatures you already trust
One key or many — signatures prove agreement. The account still holds the policy those signatures must pass.
-
Deploy new or bring one you have
Start from a governed account, or put the same model in front of a setup you already run.
Ownership
When ownership must change
A named recovery address can ask to take ownership if keys are lost. The request waits, the current owner or recovery must approve it, and only the recovery of the moment can call it off — an emergency path for the account, not a day-to-day role and not a way around the rules for assets.
Same account, every path
Policy travels with the account. Every path — our interface, yours, or a script — meets the same checks.
You keep your keys. Particle CS never holds them.
See the open-source foundation- The app your team uses is compromised
- It can raise a request — not approve one, or send value off-list.
- Someone loosens who may act, then moves funds
- Changing roles is itself an operation — wait and second party, same record.
Bring an account under rules
Import one you have, or deploy governed — including over a multisig you trust.
Alpha · Testnet · Personal workspace