Signing and Ownership Model
Every ACE management action — deploying a policy engine, registering an identity, issuing a credential — is a blockchain transaction. Blockchain transactions require a signer: someone who authorizes the operation onchain.
ACE supports two signing models: delegated signing and self-signing. Your organization chooses its signing model during onboarding.
Signing models
| Delegated signing | Self-signing | |
|---|---|---|
| Who signs | Chainlink signs transactions on your behalf | ACE creates unsigned operations; you sign them with your own keys |
| Contract ownership | You retain full ownership of all contracts | You retain full ownership of all contracts |
| What you manage | Nothing — Chainlink handles transaction signing, orchestration, and execution | Your own signing keys — ACE handles orchestration and execution |
| Best for | Teams that want a fully managed experience | Teams that require direct control over transaction authorization |
Delegated signing
In the delegated model, ACE uses a delegated trust approach centered around a dedicated onchain account called a CRE Connect Wallet (technically referred to as an SVA — Signature Verifying Account). This account acts as a gateway between Chainlink's infrastructure and your contracts.
How it works
When your organization onboards onto ACE, the system deploys a CRE Connect Wallet for you on every network you require.
Here is the key principle:
- Your wallet owns the CRE Connect Wallet.
- The CRE Connect Wallet owns all your ACE contracts (policy engines, registries, policies, etc.).
- Chainlink is registered as an authorized operator on your CRE Connect Wallet — allowed to execute operations, but nothing more.
This means you indirectly own every contract that ACE deploys for your organization, through the CRE Connect Wallet.
Permissions
The CRE Connect Wallet enforces strict permission boundaries between you and Chainlink:
| Action | You (client) | Chainlink |
|---|---|---|
| Change ownership of the CRE Connect Wallet | Allowed | Not allowed |
| Manage authorized signers (add/remove who can operate) | Allowed | Not allowed |
| Execute operations on your contracts | Allowed | Allowed |
Chainlink can only execute operations (deploy contracts, configure policies, register identities, etc.) — it cannot change who owns the account or who is authorized to sign.
What happens during setup
When your organization is onboarded onto ACE:
- You provide your wallet address to the ACE platform.
- Chainlink creates an internal signing key dedicated to your organization. This key is managed entirely by Chainlink — you never see or interact with it.
- ACE deploys a CRE Connect Wallet onchain, sets your wallet as its owner, and registers Chainlink's signing key as an authorized operator — all in a single deployment step.
- ACE deploys all application contracts (policy engines, registries, etc.) and assigns ownership to your CRE Connect Wallet.
Once setup is complete, the permission boundaries described above take effect: only you can change ownership or manage authorized signers. Chainlink can only execute operations.
Delegated signing: how ACE sets up your CRE Connect Wallet and deploys contracts on your behalf.
What happens during operations
When you trigger an action — whether from the ACE platform UI or the API:
- You perform an action (e.g., "deploy a new policy instance on Ethereum").
- ACE prepares the corresponding blockchain transaction and signs it using Chainlink's internal signing key for your organization.
- ACE sends the signed transaction to your CRE Connect Wallet.
- The CRE Connect Wallet verifies that the signer is in its list of authorized operators.
- If authorized, the CRE Connect Wallet executes the operation on the target contract.
During day-to-day operations, you never interact with a blockchain wallet or sign a transaction. ACE handles the signing and execution, while your CRE Connect Wallet enforces that only authorized operators can act.
Delegated signing: how ACE signs and executes operations through your CRE Connect Wallet.
Your safety net
You are always in control. Because your wallet owns the CRE Connect Wallet, you can at any time:
- Interact with the CRE Connect Wallet directly — bypassing ACE entirely.
- Remove Chainlink as an authorized signer — immediately revoking ACE's ability to execute operations on your contracts.
- Add other signers — granting operation rights to your own keys or third parties.
Revoking Chainlink's access does not affect your contract ownership. Your contracts remain yours, managed through your CRE Connect Wallet. You would simply take over operational responsibility.
Self-signing
With self-signing, you sign operations using your own keys before they are executed through your CRE Connect Wallet. ACE still orchestrates the process — preparing the operation, routing it through the platform, and tracking it — but the final approval and signing authority is yours.
The CRE Connect Wallet remains the execution gateway: your signed operations flow through it the same way Chainlink-signed operations do in the delegated model, so all platform capabilities (UI, APIs, reporting) work the same regardless of which signing model you use.
How it works
The ownership model is the same as delegated signing: your wallet owns the CRE Connect Wallet, and the CRE Connect Wallet owns all your ACE contracts. The difference is in who signs each operation.
When you trigger an action — whether from the ACE Platform UI or the API:
- You perform an action (e.g., "deploy a new policy instance on Ethereum").
- ACE prepares the corresponding blockchain transaction and creates an unsigned draft operation with status
pending_signature. - You poll for pending operations using the CRE Connect SDK and retrieve the draft.
- You sign the operation using your own key (EIP-712 typed data signing).
- You submit the signed operation back through the CRE Connect SDK.
- The CRE Connect Wallet verifies your signature and executes the operation onchain.
Polling and signing with the CRE Connect SDK
The CRE Connect SDK is a Go client library that provides all the tools needed for the self-signing workflow:
- List pending operations — Poll for unsigned draft operations waiting for your signature.
- Hash operations — Compute the EIP-712 digest for an operation locally.
- Sign and submit — Sign the digest with your key and finalize the draft in a single call.
- Cancel operations — Reject a draft operation if needed.
The SDK supports multiple signer backends: local ECDSA keys, AWS KMS, HashiCorp Vault Transit, Privy, and Fireblocks. See the CRE Connect SDK repository for installation, configuration, and detailed usage.
Your safety net
The same safety net applies as with delegated signing. Because your wallet owns the CRE Connect Wallet, you can at any time interact with it directly, add or remove authorized signers, or take over operational responsibility entirely.