Govern key generation, wallet creation, transaction signing and approval and storage of keys and seed phrases so that there is no single point of failure; ensure keys held online or in one place are insufficient to move assets unless controls make physical access insufficient; keep backups of keys and seed phrases apart from primaries; log every change of access to keys, assess whether keys must be regenerated when a key holder leaves, revoke access immediately and ensure revoked signatories cannot reach backups; audit access removal quarterly; document staff onboarding and offboarding and role permissions in the key management system; assess integrations with external parties; inform clients how to protect their own keys; and grant system access only on demonstrable business need with access logs.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.