An escrow is only as trustworthy as the rules on who may release it. This section sets out those rules in plain terms: the principles below, who holds which authority, how strongly each action must be proven, how a company’s staff act for it, the controls on a release, and the record each act leaves. What’s live and what’s rolling out lists, without rounding up, which of these controls are enforced today.
The principles
1. Nobody approves what benefits them
A party that receives money from an escrow is never among the people who approve its release. The depositor, the beneficiary and the mediator are always different parties, and the verifier who confirms that a milestone was met can’t be a party to the escrow at all.
The rule reaches people, not just accounts. One person can hold two parties, for example a personal account named as beneficiary and an officer account at their bank. The ledger only sees parties, so the identity service links every party to the person behind it and refuses the assignment when both belong to the same person. That person counts once in any quorum.
Status: separation between depositor, beneficiary, mediator and verifier is Live. Refusing a beneficiary as a release approver, and the person-level check, are Rolling out.
2. One role per party, per escrow
A party holds exactly one role in a given escrow: it can’t fund a deal as depositor and also decide its disputes as mediator. A nested escrow can add new parties to receive or provide money, but its authority roles (verifier, mediator, release approvers) must already be trusted parties of the parent, so nesting never becomes a way to escalate privilege. Live.
3. Authority lives in the contract, not in the application
Each stage of an escrow is its own contract on the ledger, and each names exactly who may act on it. An unauthorized action is rejected by the network before it reaches any application. The platform’s own checks repeat the same rules as a second line of defense, never as the only one. Live.
4. The platform can’t act as you
The platform prepares transactions and relays signed ones. It holds no person’s signing key. A person signs with their own wallet, and each institution (each escrow agent and asset custodian) signs with its own hardware-held key. Wallet signing and institution keys are Live. Requiring a personal signature for every money movement and binding decision is Rolling out: today the platform counts actions that arrive without one, and the switch to refusing them is made environment by environment once every approver has a wallet.
5. Proof scales with what is at stake
Reading an escrow needs a sign-in. Approving a release needs a hardware-held key and a fresh, phishing-resistant authentication bound to that exact transaction. Larger amounts raise the level automatically. The ladder is set out in Assurance levels. Rolling out.
6. Nobody moves money alone
Every material step needs the parties’ authority. A release can require several independent approvers, more as the amount rises; a cancellation needs every depositor and beneficiary to approve it; a dispute pauses any pending release. Live. See Controls on a release.
7. Evidence is not consent
An oracle’s signal, a verifier’s confirmation or an auditor’s countersignature proves a fact (a delivery, compliant documents, reserves). It never stands in for a party’s approval. Live.
8. Automation only inside a signed mandate
Where a release runs automatically, it runs under a mandate the escrow agent signed on the ledger, limited by action, currency and amount per release. Anything outside that scope waits for the people it would otherwise need. Live.
9. Changing who may approve is itself controlled
Naming an officer or release approver, changing quorum tiers or value thresholds, and changing an institution’s keys are controlled changes made by named administrators whose credentials can’t transact. Institution key changes are Live as formal ceremonies. Two-administrator approval for every assignment is Rolling out.
10. Every binding act leaves a signed, permanent record
Each state change is a transaction signed by the parties whose authority it needs, and each party’s own node keeps its own copy. Signed approvals of draft agreements travel with the contract and can be re-verified by anyone who holds it. A per-action evidence record (who acted, for whom, how they authenticated) is written to write-once storage. Ledger records and signed approvals are Live; the per-action evidence record is Rolling out. See Records & non-repudiation.