The controls
| Control | What it is | Status |
|---|---|---|
| Party thresholds | Depositors and beneficiaries each approve to the threshold the agreement sets | Live |
| Independent verifier | The party that confirms a milestone can’t be a party to the escrow | Live |
| Release quorum | Independent approvers co-sign before a release executes; the quorum can rise with the amount (for example two approvers from 10,000 and three from 100,000) | Live |
| Multi-key signing | Larger releases need more of the escrow agent’s officers, each signing with their own key | Live |
| Mandate limits | Automation acts only within a signed, scoped, expiring mandate, up to an amount per release in each currency; above it the release waits for the parties | Live |
| Limits by kind of proof | The agreement sets the largest release each kind of evidence may unlock on its own; above it the parties approve | Live |
| Challenge window | A pause between verification and release in which a party can still dispute | Live |
| Dispute pause | A dispute pauses any pending release, whatever the proof | Live |
| Oracle quorum | Several independent data feeds must agree before a machine signal counts | Live |
| Document examination | A letter-of-credit bank co-holding the money checks presented documents comply before it countersigns; discrepancies hold the release until the depositor waives them or new documents comply | Live (milestone releases) |
| Cancellation by all | Every depositor and beneficiary approves, then any one of them carries it out | Live |
| Release step-up | Each approver authenticates at high assurance, bound to the release transaction (see Assurance levels) | Rolling out |
How a release flows, by kind of proof
| Oracle signal | Attested proof | Audited proof | |
|---|---|---|---|
| Evidence | A machine record: a carrier scan, a sensor reading, a system event | A signed statement by a named party: a bill of lading, a delivery receipt, a surveyor’s report | A licensed auditor’s or inspector’s countersigned attestation |
| Verified by | The oracle, automatically, within the agreement’s policy | The independent verifier | The verifier, relying on the auditor’s countersignature |
| Direction to release | Given in advance in the agreement | The verification, plus non-objection within the challenge window, or explicit approval above an amount | Explicit: the parties with a financial interest, and any co-holder that examines the documents |
| Speed | Seconds, to the end of any window | Hours to days | Days |
| Main risk | A wrong or compromised feed pays out automatically | A forged or mistaken document | Time and cost |
| Mitigation | Several feeds, amount caps, a window to dispute, a pause on any dispute | A window to dispute, an independent verifier | Fits high-value and regulated trade |
Each milestone carries its kind of proof, and its release policy follows from it: release automatically, release after the window, or release on explicit direction. The quorum and multi-key signing apply by amount, so small automated milestones stay fast while large ones need more people.
The escrow agent checks and directs each release; the asset custodian, which holds the money, executes it. They can be separate institutions or one. See Settlement & custody.