Appearance
Auth planes
Seams keeps login, wallet authority, signing budget, and delegated execution separate. A route or operation should belong to one primary auth plane.
| Plane | Purpose |
|---|---|
| App session | Proves the user is logged into the app or identity provider. |
| Wallet Session | Admits reusable wallet-user operations. |
| Threshold session | Identifies curve-specific protocol state and signing material. |
| Wallet Session quota | Carries TTL and remaining-use budget for reusable signing. |
| Capability grant | Authorizes one exact operation and capability use. |
| Delegation grant | Policy and audit object for delegated execution. |
| API credential | Machine credential for scoped project or server routes. |
Host application login and Console administrator login have separate scopes. Neither login grants wallet signing authority. A threshold session identifier also needs exact operation authorization and validated material before signing.
App sessions alone cannot authorize transaction signing, key export, device linking, agent lane issuance, or delegated execution.
Why it matters
Each plane answers a different question:
- Who is logged in?
- Which wallet operation is allowed?
- Which exact signing lane may participate?
- Which budget or mandate is being spent?
- Can the request still execute after revocation and replay checks?
Keeping those questions separate prevents a broad login token from becoming wallet signing authority.