Reference

Authority matrix

Who may call what on the rules contract, and the test that holds each limit. The contract vouches for who called, and the enclave decides whether the caller is entitled.

Who may call what

Call	Who	What it does, and its test
`fix_rate`	the agent	Fixes the period's base rate and its end date contract `test_only_the_agent_fixes_the_rate`
`request_interest`	the agent	Types the total it expects. The enclave refuses unless it equals what the register says contract `test_the_borrower_cannot_request_interest`
`settle`	the agent	Settles a payment: every lender is credited in one step contract `test_a_lender_cannot_settle_a_payment`
`settle_trade`	the agent	Settles a trade, cash against loan authority `test_only_the_right_party_can_run_each_command`
`set_dq`	the borrower	Sets the list of buyers who may not buy into the loan, sealed contract `test_the_agent_cannot_set_the_dq_list`
`ft_transfer_call`, to pay a request	the borrower	Pays an open interest request in the deal's test USDC contract `test_only_the_borrower_pays_a_request`
`ft_transfer_call`, as cash	any account	Holds the caller's own cash in the books, as a buyer does before it buys in contract `test_a_transfer_from_another_token_is_rejected`
`register_view_key`	any account	Registers the key the caller's envelopes are sealed to contract `test_a_view_key_is_published_once_the_enclave_accepts_it`
`offer_trade`	the seller	Offers part of its position: the buyer, size, price and trade date, sealed authority `test_only_the_right_party_can_run_each_command`
`accept_trade`	the buyer	Accepts an offer that names it as the buyer authority `test_only_the_right_party_can_run_each_command`
`withdraw`	any party	Takes its own cash out of the deal as test USDC authority `test_a_party_can_only_move_its_own_cash`
`init_deal`, `unlock`	the owner	Loads the closed deal once; releases a lock left by a callback that never ran contract `test_only_the_owner_sets_the_deal_up`

The agent’s and the borrower’s calls are checked by the contract itself. For the calls any account can send, the contract only vouches for who called, and the enclave decides whether the caller is entitled. When the agent is a DAO, each of the agent’s calls is a proposal that two of three operators must approve; see The agent, two of three.

What nobody can do

Limit	Test
The agent cannot request more than the register says	principal `test_agent_cannot_request_more_than_the_register_says`
A settlement cannot pay more than was requested	principal `test_settlement_cannot_pay_more_than_requested`
Nothing settles without an open request	principal `test_no_settlement_without_an_open_request`
Lenders cannot be credited more than the borrower paid in	contract `test_lenders_cannot_be_credited_more_than_the_borrower_paid_in`
A payout cannot exceed the test USDC the contract holds	contract `test_a_payout_cannot_exceed_the_usdc_held`
A payout goes only to the party that asked	contract `test_a_payout_goes_only_to_the_party_that_asked`
Only a withdrawal pays out	contract `test_only_a_withdrawal_pays_out`
A withdrawal is capped by the party's cash	principal `test_withdrawal_is_capped_by_the_party_s_cash`
Every lender is paid, or none is	interest `test_every_lender_is_paid_or_none_is`
The borrower cannot favour a lender	interest `test_borrower_cannot_favour_a_lender`
One action runs at a time	contract `test_one_action_at_a_time`
Nothing runs once the deal is frozen	contract `test_nothing_runs_once_frozen`
The deal is set up once	authority `test_the_deal_is_set_up_once_and_the_root_tracks_every_change`
A sealed offer copied from the chain is no use to anyone else	protocol `test_a_sealed_offer_copied_from_the_chain_is_no_use_to_anyone_else`
A late run cannot undo an answer the contract received	protocol `test_a_late_run_cannot_undo_an_answer_the_contract_received`

The contract’s owner

The owner loads the deal once, and can release the lock if a callback is lost. It cannot read the books, move money, act as the agent or set the fingerprint: only the enclave’s answer to the contract’s own request does that.

The tests

enclave   interest     5   one-step payment to the cent, pro rata, no favourites, all or none
          trading      5   cash against loan, interest split on the trade date, DQ screening, trade privacy
          principal    4   the Revlon guard: no request, settlement or withdrawal above what is due
          authority    3   only the right party runs each command
          protocol    11   one envelope per party, one-fact proofs, late answers, no guess confirmed, no box reused
contract              26   roles, one action at a time, credited ≤ paid in, payouts ≤ held, freeze
───────────────────────────────────────────────────────────────────────────────────────────────────
54 tests passing

The enclave’s tests are in near/enclave/tests and the contract’s in near/contract/src/tests.rs. The deal’s rules are ported from the Canton build’s Daml tests with the same names and numbers. Run them with cargo test in each folder; see Check it yourself.