Skip to content
Satnam SatoshiIn service of humanityFind your place ↗
Menu
Lesson 02 / 21 · Expert

Design a custody architecture

Separate routine use, authorization and observation.

14 MIN WITH PRACTICEREAD → TRY → REFLECTNO WALLET NEEDED

By the end, you’ll be able to…

  • Map the different functions of a custody system.
  • Avoid confusing watch-only access with operational safety.
Your learning map

Three questions to carry into this lesson.

01Map the different functions of a custody system.
02Avoid confusing watch-only access with operational safety.
Use these goals to guide your reading. Try the paper exercise, then explain the result in your own words.

Divide responsibilities by purpose

An architecture can separate payment preparation, signing, observation and reconciliation. A watch-only system may generate addresses or inspect balances without holding spending keys. An offline signer can authorize a transaction prepared elsewhere. These separations help, but the interfaces between them still need verification of the intended policy and outputs.

Minimize authority where possible

A research agent usually needs public or redacted observations, not credentials that can transact. A bookkeeper may need receipts, not every private wallet detail. A signer needs a clear proposal and independent display, not a command to approve everything a coordinator creates. Access should match the job and be revocable without destroying the only recovery path.

Document what remains dependent

A diagram with cold storage at the center may still depend on one coordinator, one cloud account or one person who understands recovery. Name those dependencies and test alternatives. Do not assume a native Bitcoin multisig and an EVM smart-contract wallet have identical guarantees just because both use multiple approvals. This exercise describes architecture choices; it does not authorize establishing custody or moving community funds.

Your turn / A paper experiment

Practice on paper

Assign prepare, sign, reconcile and read-only research roles in a fictional four-person team. Which roles must an agent not silently acquire?

I’ve tried it — show the worked answer

An agent may assist preparation or research within a brief. It must not acquire signing, custody or spending authority because its draft was accepted. Human approval and reconciliation remain separately assigned responsibilities.

Want to explore with buttons and instant feedback? Try the practice lab ↗

Think it through

Make a choice. Discover why.

Choose an answer and check the explanation. You can retry as often as you like. These are practice questions, not a test of mastery; answers are not saved or sent.

1. Does watch-only mean the data is harmless to disclose?
  • Yes
  • No
Read the explanation

No. It can reveal sensitive financial history.

2. Does an offline signer eliminate the need to inspect outputs?
  • Yes
  • No
Read the explanation

No. It can still authorize a maliciously prepared transaction.

One idea to take with you

Separate capability, ownership and human authorization in the design.

Your learning, at your pace

Read every lesson freely. Optional progress tracking needs JavaScript and browser storage; it does not require an account or wallet.