Accountability sits with the protocol maintainers, multisig signers, and governance designers who choose the thresholds, delays, and execution boundaries. The framework question is whether ownership of voting, signing, and upgrade authority is clearly separated, because blurred responsibility makes it easier for a takeover to reach execution.
How Governance Power Becomes a Question of Accountability
Accountability follows the authority chain, not just the proposal text. When malicious proposals can influence voting, signing, or execution, the people who defined the guardrails are accountable for making those guardrails legible, enforceable, and separable. The practical question is whether the protocol can distinguish who proposes, who approves, and who can actually execute a change.
That separation matters because governance systems often fail at the boundary between intent and execution. A proposal may look legitimate while still carrying hidden assumptions about quorum, signer behaviour, or upgrade rights. When those controls are blurred, accountability becomes diffuse, and the path from malicious proposal to harmful execution becomes shorter.
Why Thresholds, Delays, and Execution Boundaries Matter
Thresholds and delays are not cosmetic controls, they define who can turn governance into action. If a malicious proposal can pass with weak participation, rushed timing, or overly broad execution rights, then the system has effectively delegated too much trust to a single decision point. That is why maintainers and governance designers are accountable for making the approval path resistant to manipulation.
Execution boundaries are equally important. A proposal should not be able to reach production impact unless the protocol explicitly permits that outcome. Where upgrade authority, treasury authority, and parameter-change authority are bundled together, a compromised governance process can create consequences well beyond the original vote. NIST Cybersecurity Framework 2.0 is useful here because it frames governance as an accountable control function, not just a procedural layer.
Who Should Own the Safeguards Around Malicious Proposals?
Protocol maintainers should own the technical design of proposal handling, multisig signers should own the integrity of execution approval, and governance designers should own the policy choices that limit abuse. No single role should be able to draft, approve, and execute the same material change without independent review. That is the core accountability test, because concentrated authority is what makes malicious proposals dangerous in the first place.
For practitioners, the strongest check is whether ownership is explicit enough that a failure can be traced to one control decision rather than a vague community process. The State of NHI & AI Agent Breach Report 2026 reinforces the broader lesson that abuse succeeds when authority and access are not tightly bounded. Even though this question is about governance, the operational principle is the same: separation of duties only works when execution rights are narrow and visible.
Risk and Threat Considerations
Malicious proposals are risky because they exploit trust that is already built into governance. If thresholds are too low, delays too short, or signers too concentrated, an attacker only needs one successful path to move a proposal from influence to execution. The result can be unauthorized upgrades, treasury movement, or control-plane capture.
Failure mechanism: The governance process collapses when proposal approval and execution are not independently constrained, allowing a malicious change to inherit legitimate authority.
Impact: The protocol can lose decision integrity, and any downstream asset, upgrade, or administrative action controlled by governance may be exposed to takeover.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.OC-01 — Organizational Context | Governance authority and ownership boundaries are central to this protocol question. |
| GV.RM-01 — Risk Management Strategy | Thresholds and delays are risk decisions that shape governance exposure. | |
| Recommendation — Define governance ownership and decision boundaries for proposal approval and execution. Set approval thresholds and delay policies based on governance risk tolerance. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Execution boundaries depend on limiting who can exercise privileged governance actions. |
| AU-2 — Event Logging | Malicious proposal handling needs auditable records of proposal, approval, and execution. | |
| Recommendation — Restrict governance execution rights to the minimum set of trusted roles. Log governance actions so proposal-to-execution decisions remain attributable. | ||
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | The issue is concentrated authority, which mirrors overprivileged non-human execution paths. |
| Recommendation — Reduce governance execution privileges to shrink takeover blast radius. | ||
Practitioner Guidance
What to verify: Confirm that proposal creation, voting, signing, and execution are owned by different parties or at least different control points, with no single path that can bypass review.
Decision rule: If a proposal can change security-critical state, treat it as a privileged action and require stronger delay, quorum, and signer independence than for routine parameter updates.
Common mistake: Treating governance legitimacy as equivalent to security safety. A vote can be procedurally valid and still be operationally dangerous if the execution path is too broad.
Practitioner takeaway: Accountability is strongest when the protocol can prove who decided, who approved, and who executed, because that separation is what limits a malicious proposal from becoming a successful takeover.