Governance Model
Why governance?
In a CBDC pilot, no single person should be able to mint a billion tokens or drain a wallet. Every significant action requires consensus — multiple authorized signers must approve before it executes. This is enforced at the blockchain level, not just in the application.
Cosmos SDK x/group module
The platform uses the Cosmos SDK x/group module for on-chain governance. Here's how the concepts map:
| Cosmos concept | Platform concept | What it means |
|---|---|---|
| Group | Account (multisig group) | A set of members with voting weights |
| Group Policy | Decision policy | Rules for how proposals are decided (e.g., "2 of 3 threshold") |
| Proposal | Proposal | A request to do something (mint, burn, transfer, group change, conversion) that needs votes |
| Vote | Vote | A member's YES, NO, ABSTAIN, or NO_WITH_VETO on a proposal |
How a proposal flows
Key behaviors:
- EXEC_TRY — every vote attempts execution. The moment enough votes are in, the proposal executes automatically. There's no separate "execute" step.
- Auto-vote — the proposer's YES vote is submitted atomically with the proposal. If they alone meet the threshold (1-of-1 policy), the operation executes immediately.
- Voting period — proposals have a time limit (configured per wallet, typically 24 hours). If the threshold isn't met before it expires, the proposal is rejected.
Decision policies
Each wallet has its own decision policy. The platform supports:
| Policy type | How it works | Example |
|---|---|---|
| Threshold | A fixed number of YES votes needed | "2 of 3 members must approve" |
| Percentage | A percentage of total weight needed | "66% of voting power must approve" |
The policy also defines a voting period (how long proposals stay open) and optionally a min execution period (delay before execution even if threshold is met). In practice the platform provisions threshold policies via setup:chain (SETUP_VOTING_PERIOD_SECONDS, default 24h; SETUP_EXECUTION_DELAY_SECONDS, default 0).
What lives on-chain vs. off-chain
| On-chain (source of truth) | Off-chain (database) |
|---|---|
| Groups and members | User accounts and credentials |
| Decision policies | User-to-multisig mapping |
| Proposals and votes | Whitelist addresses |
| Token balances and supply | Token display config (name, exponent) |
| Transaction history | Invitation records |
The platform queries on-chain data in real-time. The database only stores things the blockchain doesn't know about (who this email belongs to, what label to show for this address, etc.).