Scope, limits, and exclusions

A valid certificate is not enough. The proposed action has to fit it.

Scope Matcher#

Checks that the proposed action falls inside the chains, assets, and action types the certificate covers. An action outside it is denied with OUT_OF_SCOPE.

Remaining Limit Tracker#

Compares a transaction with the cover still available, so spend above the limit is denied with COVER_LIMIT.

Exclusion Check#

Tests the action against the certificate's exclusions before it runs, not after a loss. A match is denied with EXCLUDED.