Auth planes
Seams keeps login, wallet authority, signing budget, and delegated execution separate. Each route or operation should belong to one primary auth plane: a boundary for one kind of authority.
| Plane | Purpose |
|---|---|
| App session | Proves the user is logged into the app or identity provider. |
| Wallet Session | Admits reusable wallet-user operations. |
| Threshold session | Identifies curve-specific protocol state and signing material. |
| Wallet Session quota | Defines the expiry and remaining uses for reusable signing. |
| Capability grant | Authorizes one exact operation and capability use. |
| Delegation grant | Policy and audit object for delegated execution. |
| API credential | Machine credential for scoped project or server routes. |
Host application login and Console administrator login have separate scopes. Neither login grants wallet signing authority. A threshold session identifier also needs exact operation authorization and validated material before signing.
App sessions alone cannot authorize transaction signing, key export, device linking, agent lane issuance, or delegated execution.
Why it matters
Each plane answers a different question:
- Who is logged in?
- Which wallet operation is allowed?
- Which exact signing lane may participate?
- Which budget or mandate is being spent?
- Can the request still execute after revocation and replay checks?
Keeping those questions separate prevents a broad login token from becoming wallet signing authority.