The XRP Ledger has activated a feature that lets businesses hand out specific account permissions without handing over the keys with full control. PermissionDelegationV1_1 went live on October 8, giving stablecoin issuers and other operators a way to separate routine work from the authority that controls their main account.
That sounds like an administrative change. For a business approving customers or signing transactions throughout the day, it addresses a real security problem: an online operational key should not automatically have the same powers as the keys kept in cold storage.
A narrower set of keys for everyday work
The activation was reported by CoinDesk, citing XRPL Dashboard. With the cited list of 35 trusted validators, the amendment needed at least 29 supporters to maintain more than 80% support for two consecutive weeks. Its countdown had reset in September after support fell below the threshold.
The account granting authority is the delegator. The account receiving it is the delegate. The owner sends a DelegateSet transaction naming the delegate and its permitted actions. The owner can later change or revoke those permissions, and can appoint multiple delegates with different responsibilities.
A stablecoin issuer, for example, could let a compliance account authorize individual customer trust lines after required checks. The operational team would use its own keys for that task while the keys with broader authority remain offline. A compromised delegate would still be dangerous within its assigned powers, but it would not automatically receive unrestricted account control.
What the upgrade allows, and what it does not
The official documentation divides permissions into transaction-type permissions and granular permissions. The first covers an allowed transaction category. The second covers a narrower function within one category, such as authorizing or freezing an individual trust line.
- Each delegate can receive up to 10 permissions.
- Owners can create different permission sets for different delegates.
- Delegates cannot receive powers that let them change account keys or grant more permissions.
- Granular permissions come from a fixed list. Owners cannot invent custom rules, such as allowing payments only in one chosen currency.
That last limitation deserves attention. A permissions system is not automatically a full corporate policy engine. Teams still have to examine what each available permission permits, rather than assume that an appealing label matches their internal spending or compliance rules.
The safety warning operators should not skip
XRPL’s documentation warns against delegating the PaymentBurn granular permission until the fixCleanup3_4_0 amendment is enabled. Before that fix, a delegate with PaymentBurn can also mint new fungible tokens, including trust-line tokens or multi-purpose tokens, in certain circumstances. The warning says other granular permissions are unaffected.
The reporting reviewed for this article does not establish whether that separate fix is currently enabled. Operators should verify its status before granting PaymentBurn. The warning does not say every delegated account is unsafe; it identifies a specific permission whose behavior can exceed what its name suggests.
Delegation is not a replacement for multisigning
Delegation restricts what another account can do. Multisigning determines which combination of signers must approve a transaction. They solve different problems and can be used together: a delegate can use its own multisigning configuration, with signatures checked against the delegate’s signer list.
There are operational costs, too. Each delegation entry counts toward the owner’s reserve requirement. Delegates need funded on-ledger accounts and pay the transaction fee. Delegated transactions cannot wait in the transaction queue; if they cannot apply immediately to the open ledger, they fail instead of being queued.
For XRP investors, the activation is evidence of new network functionality, not proof of fresh institutional adoption or guaranteed token demand. The next useful evidence is whether businesses put these controls into production.
XRPL now offers a more precise way to divide account authority. Its value will depend on careful permission choices, real operational use and attention to the documented limits. Keeping the master keys offline is a good start; reading the permissions is the part nobody gets to outsource.
———
Author: Cedric Holloway
New York Newsroom
Breaking Crypto News
Be the first to comment