01
Identity
Workload-specific credentials, tenant scope, environment separation, short lifetimes where practical, rotation, and strong administrative authentication.
Trust boundaries
Separate request handling from authority use.
Client
Scoped identity and idempotent business intent.
API edge
Authentication, schema limits, and tenant routing.
Policy
Asset, amount, recipient, uniqueness, and approval decisions.
Signer
Independent decoded-transaction allowlist and key policy.
Chain
Contract or program authority and immutable invariants.
Audit
Evidence, anomaly detection, and tested stop controls.
Control families
Protect the full issuance path.
02
Authorization
Object-level checks for assets and operations plus function-level permissions for mint, burn, metadata, configuration, and webhook administration.
03
Input policy
Reject arbitrary contract code, method selectors, program IDs, large batches, unsafe URLs, excess precision, and unknown fields.
04
Key custody
Hardware-backed or managed signing, no export to web processes, independent transaction decoding, per-key limits, and break-glass revocation.
05
Availability
Rate, batch, payload, queue, simulation, and spend limits with capacity reserved for confirmation and reconciliation.
06
Evidence
Tamper-resistant audit logs, operation correlation, configuration history, anomaly alerts, and incident runbooks linked to live controls.
Signer contract
Decode first. Sign only an approved transaction.
The signer should authenticate the caller and verify the network, destination, function or instruction, asset, recipient policy, amount, auxiliary accounts, fee bounds, and request identity.
Signer must receive
- Operation ID and policy decision reference
- Decoded transaction or canonical message
- Expected chain and asset configuration version
- Amount and recipient constraints
- Expiration and replay context
Signer must reject
- Arbitrary bytes without decoding
- Unknown contracts, programs, or methods
- Client-selected authority or key
- Amounts beyond limits
- Requests outside enabled environment or window
Dependency safety
RPC, storage, indexers, and webhooks are untrusted inputs.
RPC providers
Pin chain identity, validate response shapes, use bounded timeouts, retain transaction evidence, and compare providers for high-value reconciliation.
Metadata storage
Isolate content fetching, block private network targets, limit response size, scan media, hash outputs, and monitor unauthorized changes.
Webhook endpoints
Prevent server-side request forgery, sign deliveries, use per-endpoint secrets, deduplicate events, and redact credentials from logs.
Incident readiness
Build stop controls before production traffic.
| Scope | Control | Use case |
|---|---|---|
| Credential | Disable or rotate one principal | Suspected customer or workload credential theft |
| Tenant | Block new operations | Abuse, billing, legal, or account compromise investigation |
| Asset | Pause API policy or on-chain contract | Configuration error, campaign stop, or asset-specific incident |
| Signer key | Deny policy, revoke role, or rotate authority | Key or signer compromise |
| Network adapter | Stop submission while preserving confirmation workers | RPC or chain instability |
| Global | Disable all new issuance | Severe control-plane or supply incident |
Build from explicit contracts
Use the reference architecture as a starting point.
Define assets, authorities, idempotency, confirmation, and reconciliation before connecting a production signer.