The table is derived from the contracts themselves: each action on the ledger names the party that may take it, and the ledger refuses anyone else. Where a role is filled by a company, the person acting for it is recorded too (see Acting for a company).
| Role | May authorize | Signs with | Must never |
|---|---|---|---|
| Depositor | The offer, acceptance, funding, release approval, waiving document discrepancies, settlement ratification, cancellation, reclaiming funds after a missed deadline | Their own wallet, or their institution’s key | Sign for another depositor, or hold a second role in the same escrow |
| Beneficiary | Acceptance, choosing the payout rail, settlement ratification, cancellation | Their own wallet, or their institution’s key | Approve a release they receive, or choose the rail for a payment owed to someone else |
| Mediator | Dispute decisions, settlement finalization, approving a manual disbursement | Their own wallet | Hold a party role in the same escrow, or take a fee above the one agreed at signing |
| Verifier | Confirming a milestone was met, countersigning evidence | Their own key | Be a party to the escrow, or stand in for a party’s approval |
| Release approver | Approving a disbursement, counted toward the release quorum | Their own wallet | Approve a release they receive, or be counted twice |
| Institution officer | Approving a disbursement under the institution’s release quorum | A key the institution holds for them, unlocked only by their own identity | Approve alone where the quorum needs more |
| Escrow agent | Checking and directing each release; automated steps within its signed mandate | The institution’s hardware-held key | Direct a release outside the agreement’s terms, or beyond its mandate’s limits |
| Asset custodian | Executing the transfers, locks and payouts of the holdings it issues | The institution’s hardware-held key, with an offline root key | Commit or release a party’s money without that party’s signature |
| Auditor | Countersigning a reserve attestation | Its own key | Have the attestation count as anyone’s approval |
| Oracle | A signed signal about an event, from a pre-registered key | Its registered key | Release money by itself beyond the limits the agreement sets for oracle proof |
| Platform | Nothing binding: it prepares transactions and relays signed ones | Its own service identity only | Hold a person’s key, or submit a personal action as that person |
How the separation is enforced
| Rule | Enforced by | Status |
|---|---|---|
| Depositor, beneficiary and mediator are different parties | The ledger refuses the escrow, and the platform refuses the request | Live |
| The verifier is not a party to the escrow | The agreement’s checks | Live |
| The mediator’s fee stays within the structure agreed at signing | The ledger | Live |
| A nested escrow’s authority roles are already trusted parties of its parent | The ledger | Live |
| A release approver must be named in the escrow, and the quorum is counted by distinct approvers | The ledger | Live |
| A beneficiary can’t be named as, or act as, a release approver | The ledger, at proposal and at approval | Rolling out |
| Two parties belonging to one person count once, and can’t hold two roles in one escrow | The identity service (the ledger can’t see people) | Rolling out |
The web interface lets a user switch which side’s view they see. That is a perspective, never authority: every action is taken as the role the user’s party actually holds in that escrow, and the ledger checks it.