Authority and upgrade design

“Renounced” is an incomplete control description if a proxy admin, separate mint role or pause authority remains. A permission map needs the affected function and every relevant path.

Create a capability inventory: mint, burn, pause, blacklist or transfer restrictions, metadata update, fee change and implementation upgrade. Some capabilities may not exist; absence requires implementation evidence rather than a missing interface button. Name the role or authority that can invoke each path, its delegation/recovery route and the conditions for changing it.

A revocation is scoped to a particular capability. Removing token ownership does not inherently remove a proxy upgrade admin or another privileged role. Standard proxy slots help locate certain implementation/admin fields, but custom designs require their own evidence. Multisignature and delay arrangements can change execution conditions; they do not establish independent signers or eliminate all compromise risk.

For each proposed retained control, disclose the practical consequence and why it exists. For each transfer or revocation, list the residual paths and verification needed. Do not turn an irreversible-looking declaration into a safety score. This lesson changes no roles and executes no transaction.

Capability: privileged action reachable through a specific path.

Role revocation: removal of one authorization relation.

Upgrade path: mechanism that can change implementation behavior.

Residual control: capability remaining after a stated change.

ILLUSTRATIVE Cedar map: mint role M; pause role P; proxy admin U; metadata editor D. A proposed change revokes M but retains P, U, D. U is described as 2-of-3 with a 24-hour delay; signer independence and deployed enforcement are not evidenced.

Contract-permissions map with M, P, U, D nodes before/after proposed M revocation. Keep U/P/D solid retained paths; annotate2-of-3/24h as unverified design assumptions.

Caption: Fictional role-specific revocation; retained upgrade and pause paths stay visible.

SPECIFICATION_ONLY — the rendered visual has not been produced or independently reviewed.

The fictional map makes clear that the proposed mint-role revocation leaves three stated capabilities. The 2-of-3 and delay are design claims only.

There is no deployed role state, verified multisig, actual revocation, permanent supply guarantee or independent signer proof. U could change behavior if the proposed implementation permits it.

Calling revocation of M “all control removed”; assuming a multisig label proves independent people; treating a delay as an audit; ignoring metadata or fee paths.

Produce before/after capability rows and rewrite “Cedar is fully renounced and cannot change.” State two checks needed before any live revocation claim.

• Inventory every material privileged path.
• Describe role-specific revocation and residual control.
• Qualify signer and delay assumptions.
• Keep design claims separate from deployed state.

Control disclosure is capability-specific; one removed role does not establish an immutable or authority-free asset.

• Revocation has a scope.
• Upgrade and delegation paths can preserve control.
• A multisig label does not prove signer independence.

P12-L04

Use the named ZECOIN tool only as an evidence-reading context. This lesson creates no tool output, account session or entitlement. Offline exercise; do not sign, deploy, approve or fund anything.

• PROXY: ERC-1967 proxy storage slots — Standardized implementation/admin slots; renouncing one role does not establish all upgrade paths disabled. Boundary: Mechanism documentation only; original illustrative values are stipulated, not observations. Historical records have separately frozen provenance and explicit collection gaps.
• ERC20: ERC-20 standard — Token interface and allowance semantics; the standard does not establish issuer identity or safe permissions. Boundary: Mechanism documentation only; original illustrative values are stipulated, not observations. Historical records have separately frozen provenance and explicit collection gaps.

ILLUSTRATIVE — entirely fictional offline inputs; no current observation.

null — no real observation

1

null

needs_review