Security
Roles and admin keys
Who can do what, and what no one can do.
| Role | Holder | Can | Cannot |
|---|---|---|---|
| Owner | Safe behind a 48h timelock | List reserves and collateral, wire contracts, set rate limits | Move user collateral, mint beyond RFV, change immutable bands |
| Guardian | Safe (fast) | Pause the bridge, pause borrowing, disable an adapter | Unpause, move funds |
| Risk | Safe executing risk-agent proposals | Lower weights, step a threshold down ≤ 5 points a day, write off bad debt | Exceed hard caps |
| Desk | Bond desk agent key | Set bond discount and capacity within bands | Anything else |
| Allocator | Safe | Move reserves into or out of listed ERC-4626 vaults | Send reserves anywhere else |
| Publisher | Safe | Publish dividend roots up to what was funded | — |