Most parties to an escrow are companies, and companies act through people. If Joe at Example Corp approves a release, an auditor needs to see that Example Corp was bound and that Joe, specifically, did it, under an authority Example Corp gave him. Three ways to set that up are supported, strongest first.
| Pattern | How it works | Highest level |
|---|---|---|
| A. A party per person, assigned by the company | Joe has his own party, with a key he holds in a wallet or one Example Corp holds for him under the controls below. Example Corp’s administrators assign Joe’s party to the role, on the ledger. Joe’s party takes the action; the ledger shows Joe, the company, and the assignment he relied on | L4 (required for releases) |
| B. A personal wallet in the company’s signing group | Joe’s wallet is a member of Example Corp’s group of signers, and the group’s threshold decides when the company is bound | L4 |
| C. One company key, person recorded | Example Corp’s single key signs, and the action carries Joe’s identity reference and the authentication he used. Weaker, because whoever controls the company key could name any person | L3 only |
Controls on a key the company holds for a person
For patterns A and C, all of these are required:
- Only Joe can unlock his key. His own sign-in is exchanged for short-lived credentials that can use that key and nothing else. The platform’s own service identity can’t sign with it.
- A step-up at the action’s level, bound to the transaction being signed.
- The authentication is carried on the ledger. The action names the authentication event it rests on.
- Logs are reconciled. The key provider’s own key-use log and the platform’s evidence records are kept in write-once storage and checked against each other.
Separation follows the person
Because every party is linked to the person behind it, the separation rules apply to people, not just accounts: a person can’t approve a release they receive through any party, and can’t hold two roles in one escrow through two parties. Assigning a person to a role is itself an L5 action needing two of the company’s administrators.
Status: Rolling out. Institution-held keys and company signing groups are live; per-person assignment on the ledger, person-level separation and key unlocking by the person’s own identity are being built.