A domain defines a segregated set of entities (e.g., users, policies and accounts) with guaranteed isolation from each other. It also maintains the read access permissions of the domain users.

Domains are organized as part of a domain hierarchy, or tree: at the top of the hierarchy stands the root domain, which is defined at system genesis with the first users and policies. From the root domain down, subdomains can be created. The hierarchical structure ensures that any intent processed by the system must satisfy the policies of the domain in which the intent is to be executed, but also of all ancestors domains up to the root.

Domain segregation may be used to isolate the operations of different departments, subsidiaries, or possibly clients, of the custodian and provide them with the ability to define their own respective users, policies, and accounts independently.

The locking of a domain prevents the execution of any intent within the domain or any of its subdomains.