{"templateId":"markdown","versions":[{"version":"v1.37","label":"v1.37 STS","link":"/products/custody/overview/governance-model","default":true,"active":true,"folderId":"c15a2701"},{"version":"v1.36","label":"v1.36 STS","link":"/products/custody/v1.36/overview/governance-model","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.34","label":"v1.34 LTS","link":"/products/custody/v1.34/overview/governance-model","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.26","label":"v1.26 LTS","link":"/products/custody/v1.26/overview/governance-model","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.19","label":"v1.19 LTS","link":"/products/custody/v1.19/overview/governance-model","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.15","label":"v1.15 LTS","link":"/products/custody/v1.15/overview/governance-model","default":false,"active":false,"folderId":"c15a2701"}],"sharedDataIds":{"sidebar":"sidebar-products/custody/@v1.15/sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":["admonition"]},"type":"markdown"},"seo":{"title":"Governance model","description":"User guides, API reference, and support resources.","siteUrl":"https://docs.ripple.com","lang":"en-US","llmstxt":{"hide":false,"sections":[{"title":"Table of contents","includeFiles":["**/*"],"excludeFiles":[]}],"excludeFiles":[]}},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"governance-model","__idx":0},"children":["Governance model"]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info","name":"Executive summary"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Ripple Custody"," governance controls who can change the environment, which approvals are required, and where those controls apply."]}]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Domains"]}," define the organizational boundaries for users, accounts, policies, endpoints, requests, and events."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Policies"]}," define approval rules for governed actions, including who must approve, how many approvals are needed, and where the rule applies."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Intents"]}," are governed proposals to change system state. They execute only when the selected policy workflow is satisfied."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Genesis"]}," creates the first governed state: the root domain, launch domains, first users, roles, and initial policies."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Approvals"]}," make governance enforceable and auditable by recording who proposed, approved, rejected, or executed a change."]}]}]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"success","name":"Why this matters"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Governance is the operating control layer for custody. It is how you separate clients or business units, enforce multi-party approval, route high-risk activity to compliance or senior reviewers, and govern changes to the governance model itself."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["For architects and operators"]},": Domain, user, and policy design should be treated as launch architecture. A weak model can create unexpected access paths or approval gaps. An over-complicated model can make legitimate operations hard to approve, audit, or recover."]}]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"warning","name":"Prerequisites"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Before reading this page, you should understand:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/overview/security-model"},"children":["Security model"]}," - The zero-trust model and trusted state concepts."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/governance/users"},"children":["Users and roles"]}," - How users receive operational authority."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/overview/security/data-integrity-and-audit-trail"},"children":["Data integrity and governance"]}," - How trusted entities and state changes are signed and audited."]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Governance connects organizational authority to cryptographic enforcement. A user proposes a signed intent in a target domain, or an API service caller submits a system-signed proposal that is signed by the platform before policy evaluation. The system selects the policy that applies to that intent and domain. The policy workflow determines who must approve. After the workflow is satisfied, the change can execute and becomes part of the auditable system state."]},{"$$mdtype":"Tag","name":"Diagram","attributes":{"data-language":"mermaid","diagramType":"mermaid","diagramSource":"flowchart LR\n Genesis[\"Genesis
first governed state\"]\n Domains[\"Domains
operating boundaries\"]\n Users[\"Users and roles
authority\"]\n Policies[\"Policies
approval rules\"]\n Intents[\"Intents
proposed changes\"]\n Approvals[\"Approvals
maker-checker workflow\"]\n State[\"Executed change
auditable state\"]\n\n Genesis --> Domains\n Genesis --> Users\n Genesis --> Policies\n Users --> Intents\n Domains --> Intents\n Policies --> Approvals\n Intents --> Approvals\n Approvals --> State\n","diagramHtml":"

Genesis
first governed state

Domains
operating boundaries

Users and roles
authority

Policies
approval rules

Intents
proposed changes

Approvals
maker-checker workflow

Executed change
auditable state

","diagramHtmlDark":"

Genesis
first governed state

Domains
operating boundaries

Users and roles
authority

Policies
approval rules

Intents
proposed changes

Approvals
maker-checker workflow

Executed change
auditable state

"},"children":["flowchart LR\n Genesis[\"Genesis
first governed state\"]\n Domains[\"Domains
operating boundaries\"]\n Users[\"Users and roles
authority\"]\n Policies[\"Policies
approval rules\"]\n Intents[\"Intents
proposed changes\"]\n Approvals[\"Approvals
maker-checker workflow\"]\n State[\"Executed change
auditable state\"]\n\n Genesis --> Domains\n Genesis --> Users\n Genesis --> Policies\n Users --> Intents\n Domains --> Intents\n Policies --> Approvals\n Intents --> Approvals\n Approvals --> State\n"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"domains-define-where-governance-applies","__idx":1},"children":["Domains define where governance applies"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["A domain is an organizational boundary. It groups domain-owned records such as users, accounts, vaults, policies, endpoints, requests, and events under one governance structure."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Every environment has a root domain. Subdomains form a tree below it. Users can target their own domain and, where governance permits, descendant domains. Users cannot submit intents to parent or sibling domains directly."]},{"$$mdtype":"Tag","name":"Diagram","attributes":{"data-language":"mermaid","diagramType":"mermaid","diagramSource":"flowchart TB\n Root[\"Root domain
platform governance\"]\n Operations[\"Operations domain
shared controls\"]\n Compliance[\"Compliance domain
oversight\"]\n ClientA[\"Client A domain
isolated operations\"]\n ClientB[\"Client B domain
isolated operations\"]\n\n Root --> Operations\n Root --> Compliance\n Operations --> ClientA\n Operations --> ClientB\n","diagramHtml":"

Root domain
platform governance

Operations domain
shared controls

Compliance domain
oversight

Client A domain
isolated operations

Client B domain
isolated operations

","diagramHtmlDark":"

Root domain
platform governance

Operations domain
shared controls

Compliance domain
oversight

Client A domain
isolated operations

Client B domain
isolated operations

"},"children":["flowchart TB\n Root[\"Root domain
platform governance\"]\n Operations[\"Operations domain
shared controls\"]\n Compliance[\"Compliance domain
oversight\"]\n ClientA[\"Client A domain
isolated operations\"]\n ClientB[\"Client B domain
isolated operations\"]\n\n Root --> Operations\n Root --> Compliance\n Operations --> ClientA\n Operations --> ClientB\n"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Domain design controls:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Design area"},"children":["Design area"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"What it controls"},"children":["What it controls"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Hierarchy"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["How client, regional, treasury, compliance, or business-unit boundaries are represented."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Read access"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Which roles can view domains, users, accounts, transactions, policies, endpoints, requests, and events."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Policy inheritance"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Whether policies in parent domains can affect intents in child domains."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Lock state"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Whether activity is enabled. A locked domain prevents users from submitting intents in that domain or its subdomains."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Domain injection"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Whether a new parent domain can be inserted above existing child domains after launch."]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Parent and child policies interact through policy scope and the domain governing strategy:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Strategy"},"children":["Strategy"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Behavior"},"children":["Behavior"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["ConsiderDescendants"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Parent and child policies can both be considered. The highest-ranked eligible policy wins."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["CoerceDescendants"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Matching parent-domain policies override matching child-domain policies. Use this only when the override is intentional."]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"policies-define-how-changes-are-approved","__idx":2},"children":["Policies define how changes are approved"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["A policy defines the approval rule for a governed action. It answers five questions:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Question"},"children":["Question"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Policy field"},"children":["Policy field"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Example"},"children":["Example"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["What action?"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["intentTypes"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_CreateTransactionOrder"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_CreatePolicy"]},", or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_CreateDomain"]},"."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Which origin?"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["intentOrigin"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["User-signed proposals or API-only system-signed proposals."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["When?"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["condition"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Amount threshold, endpoint trust score, author role, target role, or another payload condition."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Who approves?"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["workflow"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Two operators, then one compliance reviewer."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Where?"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["scope"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Self"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Descendants"]},", or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["SelfAndDescendants"]},"."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Which policy wins?"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["rank"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Higher rank wins among matching policies."]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["When an intent is submitted, the notary evaluates the applicable policies and applies the selected workflow."]},{"$$mdtype":"Tag","name":"Diagram","attributes":{"data-language":"mermaid","diagramType":"mermaid","diagramSource":"flowchart LR\n Intent[\"Intent\"] --> Scope[\"Scope and
governing strategy\"]\n Scope --> Type[\"Intent type
matches\"]\n Type --> Condition[\"Condition
evaluates true\"]\n Condition --> Rank[\"Highest rank
selected\"]\n Rank --> Workflow[\"Workflow
enforced\"]\n Workflow --> Result[\"Approve, reject,
expire, or execute\"]\n","diagramHtml":"

Intent

Scope and
governing strategy

Intent type
matches

Condition
evaluates true

Highest rank
selected

Workflow
enforced

Approve, reject,
expire, or execute

","diagramHtmlDark":"

Intent

Scope and
governing strategy

Intent type
matches

Condition
evaluates true

Highest rank
selected

Workflow
enforced

Approve, reject,
expire, or execute

"},"children":["flowchart LR\n Intent[\"Intent\"] --> Scope[\"Scope and
governing strategy\"]\n Scope --> Type[\"Intent type
matches\"]\n Type --> Condition[\"Condition
evaluates true\"]\n Condition --> Rank[\"Highest rank
selected\"]\n Rank --> Workflow[\"Workflow
enforced\"]\n Workflow --> Result[\"Approve, reject,
expire, or execute\"]\n"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If no policy matches, the intent cannot execute. If a matching policy omits ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["workflow"]}," or sets it to ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["null"]},", the intent is auto-approved. If ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["workflow"]}," is an empty array, matching intents are rejected. Use those behaviors deliberately."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Policy workflows can require:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Workflow object"},"children":["Workflow object"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Use when"},"children":["Use when"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["RoleQuorum"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["A number of users with one role must approve."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["And"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Multiple approval groups must approve in the same step."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Or"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Any one of several approval groups can satisfy the step."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Sequential array"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Approval must happen in ordered stages."]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Policy-management policies should be stricter than routine operational policies because they control how governance can change in the future."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"intents-turn-proposals-into-governed-changes","__idx":3},"children":["Intents turn proposals into governed changes"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["An intent is a governed proposal to change the system. Domain changes, policy changes, user changes, endpoint changes, transactions, and compliance operations all use the intent model."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["User-signed intents contain the user author, target domain, expiry time, operation-specific payload, and custom metadata. After submission, the intent is immutable. The maker's signature counts as the first approval, and the maker must have a role that satisfies the first workflow step. The maker cannot provide another approval for the same workflow."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["System-signed intents are API-only proposals from service callers. They omit the user ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["author"]}," and client-side ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["signature"]}," fields, are signed by the platform internally, and match only policies with ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["intentOrigin: \"SystemSigned\""]},"."]},{"$$mdtype":"Tag","name":"Diagram","attributes":{"data-language":"mermaid","diagramType":"mermaid","diagramSource":"stateDiagram-v2\n [*] --> Proposed: Submit intent\n Proposed --> PendingApproval: Policy workflow applies\n PendingApproval --> Approved: Required approvals received\n PendingApproval --> Rejected: Approver rejects\n PendingApproval --> Expired: Expiry time passes\n Approved --> Executed: System applies change\n Executed --> [*]\n Rejected --> [*]\n Expired --> [*]\n","diagramHtml":"

Submit intent

Policy workflow applies

Required approvals received

Approver rejects

Expiry time passes

System applies change

Proposed

PendingApproval

Approved

Rejected

Expired

Executed

","diagramHtmlDark":"

Submit intent

Policy workflow applies

Required approvals received

Approver rejects

Expiry time passes

System applies change

Proposed

PendingApproval

Approved

Rejected

Expired

Executed

"},"children":["stateDiagram-v2\n [*] --> Proposed: Submit intent\n Proposed --> PendingApproval: Policy workflow applies\n PendingApproval --> Approved: Required approvals received\n PendingApproval --> Rejected: Approver rejects\n PendingApproval --> Expired: Expiry time passes\n Approved --> Executed: System applies change\n Executed --> [*]\n Rejected --> [*]\n Expired --> [*]\n"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The basic maker-checker flow is:"]},{"$$mdtype":"Tag","name":"Diagram","attributes":{"data-language":"mermaid","diagramType":"mermaid","diagramSource":"sequenceDiagram\n participant Maker\n participant Platform\n participant Notary as Notary / policy evaluation\n participant Checkers\n participant State as System state\n\n Maker->>Platform: Submit intent\n Platform->>Notary: Select policy for target domain\n Notary-->>Platform: Return workflow\n Checkers->>Platform: Approve or reject\n Platform->>State: Execute approved change\n State-->>Platform: Record auditable outcome\n","diagramHtml":"System stateCheckersNotary / policy evaluationPlatformMakerSystem stateCheckersNotary / policy evaluationPlatformMakerSubmit intentSelect policy for target domainReturn workflowApprove or rejectExecute approved changeRecord auditable outcome","diagramHtmlDark":"System stateCheckersNotary / policy evaluationPlatformMakerSystem stateCheckersNotary / policy evaluationPlatformMakerSubmit intentSelect policy for target domainReturn workflowApprove or rejectExecute approved changeRecord auditable outcome"},"children":["sequenceDiagram\n participant Maker\n participant Platform\n participant Notary as Notary / policy evaluation\n participant Checkers\n participant State as System state\n\n Maker->>Platform: Submit intent\n Platform->>Notary: Select policy for target domain\n Notary-->>Platform: Return workflow\n Checkers->>Platform: Approve or reject\n Platform->>State: Execute approved change\n State-->>Platform: Record auditable outcome\n"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Use dry runs before submitting high-risk or complex intents, especially policy changes, domain changes, user and role changes, and payloads where condition or workflow behavior is uncertain."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"genesis-creates-the-first-governed-state","__idx":4},"children":["Genesis creates the first governed state"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Genesis is the first governed state of the environment. It defines what must exist before normal governed changes can happen:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Genesis element"},"children":["Genesis element"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Why it matters"},"children":["Why it matters"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Root domain and launch domains"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Establishes the domain tree and launch operating boundaries."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["First users and roles"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Provides enough human or machine users to satisfy launch approval workflows."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Initial policies"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Controls root administration, user management, policy management, operations, compliance, fallback, and recovery."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Breakglass or recovery controls"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Gives operators a governed path for exceptional scenarios such as urgent freezes, lost access, or misconfiguration recovery."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Deferred changes"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Identifies non-critical domains, users, or policy refinements that can be created later through normal governance."]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Do not treat genesis as a payload-filling task. Treat it as the launch design for your operating model."]},{"$$mdtype":"Tag","name":"Diagram","attributes":{"data-language":"mermaid","diagramType":"mermaid","diagramSource":"flowchart LR\n Domains[\"1. Design domains
tree, strategy, read access\"]\n Users[\"2. Plan first users
roles and quorum coverage\"]\n Policies[\"3. Design policies
coverage, rank, workflows\"]\n Checklist[\"4. Readiness checklist
launch review\"]\n GenesisState[\"Genesis state
ready for setup\"]\n\n Domains --> Users --> Policies --> Checklist --> GenesisState\n","diagramHtml":"

1. Design domains
tree, strategy, read access

2. Plan first users
roles and quorum coverage

3. Design policies
coverage, rank, workflows

4. Readiness checklist
launch review

Genesis state
ready for setup

","diagramHtmlDark":"

1. Design domains
tree, strategy, read access

2. Plan first users
roles and quorum coverage

3. Design policies
coverage, rank, workflows

4. Readiness checklist
launch review

Genesis state
ready for setup

"},"children":["flowchart LR\n Domains[\"1. Design domains
tree, strategy, read access\"]\n Users[\"2. Plan first users
roles and quorum coverage\"]\n Policies[\"3. Design policies
coverage, rank, workflows\"]\n Checklist[\"4. Readiness checklist
launch review\"]\n GenesisState[\"Genesis state
ready for setup\"]\n\n Domains --> Users --> Policies --> Checklist --> GenesisState\n"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Policies depend on domains and users. If the launch domain tree or first-user model changes, review the policy model again before setup."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Infrastructure configuration belongs outside the governance model. Governance state belongs in genesis."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"how-the-pieces-work-together","__idx":5},"children":["How the pieces work together"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Step"},"children":["Step"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Governance behavior"},"children":["Governance behavior"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["1. Launch"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Genesis establishes the root domain, launch subdomains, first users, roles, and initial policies."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["2. Propose"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["A user signs an intent that targets a domain and contains the requested operation."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["3. Select policy"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The system evaluates scope, governing strategy, intent type, condition, and rank to select the applicable policy."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["4. Approve"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The selected workflow determines which roles and quorum must approve. Any authorized rejection stops the workflow."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["5. Execute"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["After required approvals, the system applies the change and records the governance outcome."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["6. Evolve"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Future domain, user, endpoint, policy, and operational changes continue through the same intent workflow."]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"common-design-questions","__idx":6},"children":["Common design questions"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Question"},"children":["Question"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Start with"},"children":["Start with"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["What needs to be isolated?"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Domain hierarchy, read access, and governing strategy."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Who can propose and approve changes?"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Users, roles, and quorum coverage."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Which actions need approval?"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Policy intent types, conditions, workflows, scope, and rank."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["How do high-risk or unusual cases get handled?"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Breakglass, fallback, compliance, and recovery policies."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["What must exist before the environment starts?"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Genesis domain, user, role, and policy design."]}]}]}]}]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"next-steps","__idx":7},"children":["Next steps"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Topic"},"children":["Topic"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Description"},"children":["Description"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/governance"},"children":["Governance overview"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Entry point for the governance section."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/governance/domains"},"children":["Domains"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Domain hierarchy, isolation, governing strategies, lifecycle, and injection."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/governance/policies"},"children":["Policies"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Policy matching, workflows, scope, rank, and breakglass patterns."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/governance/intents"},"children":["Intents and approvals"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Intent lifecycle, maker-checker approvals, targeting, expiry, and dry runs."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/governance/genesis"},"children":["Design your genesis governance model"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Launch planning for domains, first users, roles, and initial policies."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/governance/intents/manage-intents-and-approvals"},"children":["Manage governance"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Day-to-day intent submission, review, approval, rejection, and state checks."]}]}]}]}]}]},"headings":[{"value":"Governance model","id":"governance-model","depth":1},{"value":"Domains define where governance applies","id":"domains-define-where-governance-applies","depth":2},{"value":"Policies define how changes are approved","id":"policies-define-how-changes-are-approved","depth":2},{"value":"Intents turn proposals into governed changes","id":"intents-turn-proposals-into-governed-changes","depth":2},{"value":"Genesis creates the first governed state","id":"genesis-creates-the-first-governed-state","depth":2},{"value":"How the pieces work together","id":"how-the-pieces-work-together","depth":2},{"value":"Common design questions","id":"common-design-questions","depth":2},{"value":"Next steps","id":"next-steps","depth":2}],"frontmatter":{"seo":{"title":"Governance model"}},"lastModified":"2026-07-10T17:34:23.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/products/custody/overview/governance-model","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}