Your keys never meet the model.
The model proposes a transaction. It does not sign one. A policy engine sits between the two, and it is the only thing that can reach a key.
- Simulate first
- Every transaction is replayed against the current state before anything is signed. There is no flag to turn this off.
- Bounds you set
- Maximum value moved, maximum slippage, allowed programs, allowed counterparties. Written once, checked on every call.
- Keys in an enclave
- Signing happens in hardware the model cannot read from. It receives a yes or a no, never the key.
- A refusal is a valid answer
- S1 Verify returns a decision, and declining to sign counts as a correct one.