Governance & roles
Decentralization is a spectrum. The contracts expose roles for operational liveness and emergency response; those roles are not the same as user custody.
Operational roles
- Keeper or automation roles can trigger scheduled protocol transitions.
- Oracle or assertion roles can submit an outcome only through the configured proof path.
- Pauser roles may stop new activity during an incident, subject to each contract's withdrawal and refund behavior.
- Administrative roles can change some configuration only where the deployed contract permits it.
What governance should not imply
An operator role is not a right to rewrite a finalized outcome or take a user's wallet funds. Before a production launch, every upgrade path, delay, Safe owner, and emergency authority must be published with the deployment.
Decentralization roadmap
- Publish verified contracts and role assignments for every production deployment.
- Move upgrades and parameter changes behind a timelock or governance process.
- Make settlement and refund calls permissionless where the contract model allows it.
- Use independent oracle and automation operators, with no single service required for user exit.