How it works
The preview is the signing limit
Detent reads a corporate action, replays it off chain, and compiles what the operator accepted into the one transaction the treasury key is allowed to sign.
The problem with a general purpose key
A treasury key that can sign anything the token contract exposes is not narrowed by reading an explorer first.
Whoever runs a tokenized security spends the quarter on operations that cannot be taken back: coupon distributions, court ordered transfers, freezing a screened address, redemptions. The register is live, the amounts are real, and the key that signs has rights over the whole contract. Today the step before signing is reading an explorer or trusting a script, and a wrong parameter, a lapsed allowlist entry or a thin treasury only shows up after the transaction lands.
Three steps
No number below is invented for this page: the two approvals are the two registered officers in lib/data.ts, and nothing else is counted.
Read the plan
Every holder the coupon reaches, every one the compliance module is holding, and what the treasury has left once the draw clears.
Lock the key
Two officers approve, and the plan's own calldata is compiled into a wallet policy that allows that transaction and nothing else.
Watch it refuse
Edit one amount by hand and send it. The key names the condition that failed, and the untouched plan still signs.
Architecture
Every box below is a file in this repository or a network it talks to. Read top to bottom: this is the order one plan actually moves through.
Step 1
Register read
lib/hedera.ts calls balanceOfByPartition and canTransferByPartition against the ATS equity token over the Hashio relay, and asks whether a credit from the treasury to each holder would clear.
Hedera testnet, ATS token
Step 2
Off chain replay
lib/plan.ts rebuilds the payout row by row from that register: which holder is blocked and why, how much cover the treasury has, and the exact calldata and plan hash the action would use.
lib/plan.ts
Step 3
Policy compiled
Once the operator accepts the plan, lib/privy.ts compiles its calldata into a wallet policy and installs it on the treasury server wallet, owned by a key quorum of two.
lib/privy.ts, 2 of 2 key quorum
Step 4
Send
The wallet may sign only for that chain, that contract, that function and that partition. A submitted payload that does not match the approved calldata is refused before it reaches the wallet.
Privy server wallet
Step 5
Anchor and settle
PlanAnchor records the plan hash before the send and closes it as settled or abandoned once the outcome is known, so the audit record survives past the session.
contracts/src/PlanAnchor.sol
Step 6
Policy revoked
Whether the send lands, fails or times out, the policy is detached from the treasury wallet and deleted. Nothing stays attached to the key once its one transaction is decided.
lib/privy.ts, releasePolicy
Built on two sponsor platforms
Stated plainly, with the file that does the work next to each claim.
Hedera, Asset Tokenization Studio
The security is modelled as an ATS equity token on Hedera testnet. lib/hedera.ts reads balanceOfByPartition (ERC-1410) for every holder and asks canTransferByPartition whether a credit from the treasury would clear, over the Hashio JSON-RPC relay. contracts/src/PlanAnchor.sol anchors each approved plan hash before the policy opens and settles it after, so HashScan carries the record once the contract is deployed.
Privy, server wallets and policies
lib/privy.ts compiles an approved plan into a wallet policy pinning chain id, contract, function and partition, installs it on the treasury server wallet under a key quorum of two, and revokes it once the transaction is decided. The exact calldata, which Privy's conditions cannot compare for an array of holders and amounts, is enforced by this server before the request ever reaches the wallet.
How this differs from a simulator
A simulation next to a signature is not the same thing as a policy that only allows the transaction you read.
| Tool | What it does | Where it stops |
|---|---|---|
| Tenderly and Safe | Simulates the outcome before you sign. | The simulation and the signature are separate events. |
| Fireblocks | An administrator authors policy up front. | The rules persist across every transaction. |
| OpenZeppelin Defender | Routes proposals through a multisig or a relayer. | No ERC-1400 semantics for who may be credited. |
| Detent | Compiles the plan you read into the signing limit. | One corporate action, then the policy is revoked. |
Try it
No keys, no wallet connector, no sign-up.