Permissions That Follow Identity. Every serious vault mandate includes a counterparty rule: authorized brokers only, and no anonymous large trades. Here’s the critical part: the bot moving the money has never read it. This policy fixes that specific gap. The same wallet gets a high limit with verified exchanges and approved protocols, a small introductory limit with anything unlabelled, a human in the loop when identity is uncertain, and a hard stop on prohibited risk tags. Arkham supplies the identity; Newton enforces the rule