> ## Documentation Index
> Fetch the complete documentation index at: https://docs.autolayer.fi/llms.txt
> Use this file to discover all available pages before exploring further.

# Security model

> Assets, trust boundaries, controls, and launch gates.

## Protected assets

* Relayer and paymaster signing authority
* Encrypted automation delegate keys
* Wallet authorizations and payment signatures
* Seller identities and Bazaar metadata integrity
* xWrapper upstream credentials
* Automation policies, run limits, and financial state

## Core invariants

1. The facilitator never becomes the source of buyer funds.
2. A modified asset, amount, recipient, invocation, or expiration fails verification.
3. Resource delivery does not occur after failed verification.
4. Mainnet and testnet are explicit, isolated choices.
5. The scheduler cannot bypass contract or wallet authorization.
6. Secrets and signed authorization material are never logged.
7. Catalog and proxy inputs are hostile until validated.
8. Gateway DNS resolution is checked for private/reserved addresses and pinned for the outbound connection.
9. Operator credentials, vault plaintext, and injected authorization headers never enter audit rows.
10. Wallet authentication challenges are single-use, expire after five minutes, and are bound to an exact transaction hash.
11. Console sessions and personal API keys are stored only as SHA-256 hashes; API-key plaintext is revealed once.
12. User resources are scoped by the authenticated user ID. Deployment operator keys remain a separate administrative path.

<Warning>
  A third-party review and live conformance evidence are release gates for a
  production mainnet tag. They are not replaced by unit tests or static
  analysis.
</Warning>