Protocol permissioning

Operations without the multisig bottleneck

Delegate operational authority through onchain, verifiable scopes — so your teams can act without holding the keys to everything.

The problem

Your multisig is the bottleneck for every operational action, and the signer set was last reviewed two years ago. You can’t delegate without giving up root. Token holders can’t verify control without your Notion doc.

What to look for

What a real protocol operating model needs

  • Granularity of delegation

    Can you give a Growth lead grants-disbursement only, capped, with allowlisted destinations — without giving them the whole multisig?

  • Onchain visibility

    Token holders and governance must verify control without a Notion doc that one ops lead maintains.

  • Reproducibility

    What governance approved must equal what got executed. Hash-level. No "we ran it, here’s a screenshot."

  • Emergency procedures

    Guardian roles. Circuit breakers. Time delays. Veto powers. All of these should be operating primitives, not improvisation.

What Zodiac does

Onchain roles, onchain audit trail

  • Scoped permissions per role

    A role can call a specific function on a specific contract with parameters in an allowlist and a per-period cap. Anything outside reverts at the contract level.

  • Membership is onchain

    Token holders query the role registry the same way they query the protocol’s state. No screenshots, no Notion, no "trust us."

  • Configuration as code

    Operational state can be expressed and version-controlled. Governance approves a configuration; it deploys to testnet, then the same configuration deploys to mainnet. Any change to operations is a reviewable diff — and what you see in that diff is exactly what changes onchain.

  • Emergency controls as modules

    The Zodiac module standard was built for exactly this: compose modules to implement guardian patterns, time delays, council vetoes, and exit mechanisms — as operating primitives, not improvisation.

Worked example

A protocol with Growth, Treasury, and Security Council roles

Three roles, all enforced onchain.

Growth role: can call grants.disburse to KYC-passing recipients, capped at $50k per recipient and $250k per month, with a 24-hour delay.

Security Council role: can call protocol.pause immediately, no quorum needed for emergency; can veto pending grants within the delay window.

Treasury role: can swap and supply on stablecoin trios only, with a fixed per-trade size cap and a rolling daily allowance.

Governance passes a proposal to expand Growth to $400k/month. The change is a parameter update on the Growth permission. The proposal body and the executed action match by hash. Token holders read the diff.

Want to walk through your specific operating model?