UTXOSUITE — home
ENTERPRISE / TRANSACTION SECURITY

Control what can be signed before signing authority is used.

The enterprise direction for SafeSign is a policy and evidence layer between applications or agents and the wallet, signer or custody system that retains final signing authority. Private keys remain outside UTXO Suite.

Discuss a design-partner pilot ↗Read the developer contract →
DESIGN-PARTNER STAGENON-CUSTODIALPOLICY / EVIDENCENO PRODUCTION SLA CLAIM
ENTERPRISE / POLICY AND EVIDENCEA data-centre corridor between two rows of racks.
CONTROL PLANE

Security policy should be enforceable, explainable and separable from custody.

The high-value layer is not another signing wallet. It is the ability to apply organizational constraints to a transaction review, preserve evidence and escalate when authorization requires more than one person or rule.

01PLANNED

Policy Engine

Evaluate organization-specific constraints after SafeSign analysis: allowed destinations, token permissions, value limits, methods, chains and contextual requirements.

02PLANNED

Approval Orchestration

Escalate REVIEW outcomes to a second approver or role-based workflow while keeping the final signature inside the institution's signer or custody system.

03CORE DIRECTION

Decision Evidence

Persist the minimum structured evidence needed for auditability without turning transaction-security telemetry into a surveillance product.

04NON-CUSTODIAL

Signer Boundary

SafeSign can recommend or require escalation; it should not possess the institution's signing keys or silently execute the transaction it evaluates.

DEPLOYMENT MODES

One decision contract, multiple operational boundaries.

Deployment options should converge on the same structured evidence and recommendation format. This prevents enterprise requirements from fragmenting SafeSign into separate products.

01 / FOUNDATION

Embedded / Local

Run deterministic analysis close to the wallet or application where privacy and predictable behavior matter most.

FOUNDATION
02 / PRE-PRODUCTION

Service API

A hosted decision service is a commercial target, but authentication, quotas, latency objectives, availability guarantees and billing must be measured and implemented before being sold as production infrastructure.

PRE-PRODUCTION
03 / DESIGN TARGET

Private Deployment

For institutions with strict data boundaries, package the same decision contract for controlled infrastructure without creating a separate security engine.

DESIGN TARGET
PROCUREMENT EVIDENCE

Enterprise trust has to be earned with artifacts.

The page deliberately distinguishes what can be prepared now from guarantees that require measurement, external review and an actual support organization.

PREPARE NOW

Evidence package

  • Documented non-custodial boundary and explicit authorization model.
  • Target decision contract and evidence schema direction.
  • Repository-level source artifacts for SafeSign, Security Core and Guard integration surfaces.
BEFORE PRODUCTION

Required gates

  • Independent security review/audit appropriate to the final production scope.
  • Measured latency, availability, failure-mode and load characteristics for any hosted service.
  • Support process, incident response, versioning, data handling terms and contractual SLA before enterprise production commitments.
DESIGN-PARTNER PATH

Start narrow, measure, then contract.

The enterprise direction for SafeSign is a policy and evidence layer between applications or agents and the wallet, signer or custody system that retains final signing authority. Private keys remain outside UTXO Suite.

01

Scope

Choose one wallet method, chain family or transaction class with a clear failure boundary.

02

Integrate

Connect the unchanged payload and relevant context to the target SafeSign decision interface.

03

Measure

Record false positives, missed signals, latency and fallback behavior before expanding scope.

04

Contract

Only after evidence is stable should support, policy, deployment and commercial commitments be formalized.

Discuss a design-partner pilot →Developer Platform →SafeSign →
ENTERPRISE / CONTROL PLANE

Turn transaction review into an organizational control.

Enterprise value comes from consistent policy, evidence retention and escalation before signing. Existing wallet, signer, HSM or custody systems retain private keys and final cryptographic authority.

POLICY PRIMITIVES

Controls should be specific enough to enforce and explain.

Policy should operate on decoded facts: value, destination, authority, novelty, chain, request class and organizational role.

01

VALUE THRESHOLD

Escalate or require additional approval when value exceeds organizational limits.

02

DESTINATION TRUST

Differentiate allowlisted counterparties, new destinations, changed records and high-risk contract relationships.

03

AUTHORITY SCOPE

Escalate unlimited approvals, broad Permit2 rights, delegation or signatures valid beyond the immediate operation.

04

CHAIN RESTRICTION

Prevent signing on disallowed networks or require separate policy profiles for chains with different execution assumptions.

05

DUAL CONTROL

Require independent reviewers for high-value, novel or policy-exception transactions before signing.

06

TIME / SESSION BOUNDARY

Restrict privileged transaction classes to approved windows, devices, sessions or recently authenticated operators.

Evidence model

High-value signing should be a process, not a button.

Keep construction, security review, human authorization and signing authority as separate stages.

01CAPTURE

Receive the exact request and origin before confirmation.

02CLASSIFY

Identify the request family before applying generic risk logic.

03DECODE

Normalize methods, parameters, authority and destinations.

04ENRICH

Attach contract, policy, freshness and simulation context where available.

05COMPARE

Compare reconstructed authority with the user's stated intent.

06DECIDE

Return ALLOW, WARN, REVIEW or BLOCK with explicit reasons and unknowns.

07AUTHORIZE

Return control to the wallet or signer. Analysis never silently signs or broadcasts.

Decision contract

Decision contract

Enterprise value comes from consistent policy, evidence retention and escalation before signing. Existing wallet, signer, HSM or custody systems retain private keys and final cryptographic authority.

REQUEST / INPUT
{
  "organization": "treasury-eu",
  "actor": "operator:17",
  "intent": { "action": "transfer", "valueUsd": 250000 },
  "destination": "0xNEW...",
  "signingSystem": "existing-custody-provider"
}
DECISION / OUTPUT
{
  "decision": "REVIEW",
  "policyMatches": ["value>100k", "new_destination"],
  "requiredApprovals": 2,
  "evidenceHash": "sha256:...",
  "payloadHash": "sha256:...",
  "reviewers": ["security", "treasury"],
  "signingAuthority": "external"
}
Decision semantics

Decision semantics

Unknown evidence must remain visibly unknown. Missing analysis must never silently become ALLOW.

DECISION
TRIGGER
MEANING
NEXT
ALLOW
supported evidence consistent
No material contradiction found inside the supported evidence. Explicit authorization is still required.
EXPLICIT SIGN
WARN
material risk present
The request is understood, but the user should see the material risk before authorization.
USER REVIEW
REVIEW
incomplete or conflicting evidence
Evidence is incomplete, contradictory or outside policy. Escalate instead of pretending certainty.
SECOND REVIEW
BLOCK
policy or supported threat signal
A configured policy or supported threat signal says the request should not proceed without an explicit override path.
NO FORWARD
POLICY / FAILURE MODES

Advisory first; enforcement only when intentionally configured.

These modes describe intended operational boundaries. They are not a claim that every enterprise deployment mode is production-ready today.

ADVISORY REVIEW

Return evidence and recommendation while the existing signing workflow remains authoritative.

status: current architectural target

POLICY GATE

Prevent forwarding when deterministic rules fail, while preserving an explicit override and escalation path.

status: planned / design target

PRIVATE DEPLOYMENT

Run policy and evidence infrastructure inside a customer-controlled boundary when product maturity and support justify it.

status: future enterprise path

EVIDENCE EXPORT

Export decision records for internal control, incident analysis and procurement without exporting private keys.

status: design target
INVARIANT

UTXO Suite should provide policy and evidence around a signing decision while the customer's wallet, signer, HSM or custody provider retains private keys and final cryptographic authority.

EIP-712 ↗ERC-2612 ↗BIP-174 ↗OWASP SCSVS ↗