> ## Documentation Index
> Fetch the complete documentation index at: https://tetrafi.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Wallets & Signing

> Sign without holding keys in your backend - owner-authorized, bounded, revocable.

An external wallet signature is the baseline. Everything below removes the need to hold keys in your backend, without TetraFi ever holding the owner's factor.

## Ownership Scopes

A **personal** wallet belongs to a person; a **workspace** wallet belongs to the institution, shared by its authorised operators. Owners can hold several wallets and provider connections. Per-chain defaults are preferences, never authority: ownership is re-verified before every dispatch.

## Four Ways to Sign

| Way                                   | How it works                                                                                                                                                                              | Status      |
| ------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------- |
| **External wallet**                   | Sign the EIP-712 order, or broadcast the prepared transaction yourself.                                                                                                                   | Live        |
| **Owner-authorized embedded signing** | Preflight prepares the exact authorization, with typed data to inspect; the owner's tooling approves, the provider signs, TetraFi submits. No root key or provider token reaches TetraFi. | Rolling out |
| **Session-signer grants**             | A bounded, owner-approved permission with an expiry. Revocation refuses new dispatch; an operation in flight stays recoverable.                                                           | Rolling out |
| **Organisation wallets**              | The co-signer model: every proposed member accepts with their own factor, the quorum is customer-defined (1-of-1 included), and a policy change needs the current quorum.                 | Rolling out |

## The Rule That Holds Everywhere

An API key, an admin session, a provider connection, or a gas sponsor never creates wallet authority. Delegated authority is enforced by the wallet provider itself, with TetraFi's compliance and treasury controls on top; a clause the provider cannot enforce fails closed, with the reason. Every wallet or grant request carries a request ID you generate, so a lost response reconciles under it and nothing is created twice.

## Gas

API-submitted escrow orders and delegated-source legs already land with no gas from the user's wallet. Gas sponsorship, the payer selected per order and reported by preflight, is coming soon.

Where delegated signing enters the loop is on [Execution Modes](/core-concepts/execution-modes); the same wallets move funds under policy on [Treasury & Custody](/core-concepts/treasury).