What It Holds
Custody provider connections, registered in the dashboard only because they carry secret material. Under them: vault accounts with per-asset balances and history, your wallets, an address book.How wallets appear
Accounts has two tabs, Company and Personal & shared. Both show the same sections, one per control; the tab only filters by scope.
Company also lists your venue accounts and bank accounts, in their own sections. Personal & shared lists your own wallets. Sharing a personal wallet with other members is not yet available; when it is, its owner will decide who may view it and request from it, and nothing more.
Each row shows its wallet type and provider, such as “Secure enclave · Turnkey”. A row also shows Unverified until its ownership proof, and Control changed when a TetraFi key could sign without your approvers. Neither can send.
Add account, then Add a wallet, asks how the wallet is controlled, then its type, then the provider. Providers that are not yet available are greyed out. A governed wallet is created with its owners: every proposed owner accepts before the provider sets it up.
Moving Funds
One transfer resource. Source: a vault account or one of your company’s wallets. Destination: a one-time address, one of your company’s or linked wallets, a custodian-whitelisted wallet, or an OTC desk’s deposit address. Send an idempotency key. The policy is written, versioned, and can run in shadow before it enforces: a whitelist board, an approval quorum with an inbox, a velocity budget per principal, an approval window, every failure as data with retry or replace. The custodian’s own approval is separate from the workspace’s; both are shown. (Policy and statements rolling out.)Programmatic Access
Two scopes,treasury_read and treasury_write, behind two gates re-derived per request: the scope and the acting identity’s live workspace permission. A refusal names which gate refused.
With a key you can list and read vault accounts and their history, refresh a balance, list and add Destinations (a person approves each one), and start, cancel, replace or retry a transfer. Every write takes an Idempotency-Key: send the same key again and you get the first answer back, never a second transfer. Approving a transfer or a Destination, changing policy and freezing need a person in the app. These Treasury operations join the public API reference with their error codes (rolling out).