Custody authority is the permission to move, mint, upgrade, or otherwise control value-bearing assets. It is usually broader than ordinary administrative access, and it should be treated as a tier-0 function with explicit separation, verification, and revocation controls.
Expanded Definition
Custody authority is the control plane for value-bearing assets, including the ability to move funds, mint new units, upgrade contract logic, change signing rules, or delegate onward control. In security terms, it is not just an elevated permission set. It is a governance boundary that determines who can create, change, or transfer assets in ways that may be irreversible. NHI Management Group treats this as a tier-0 function because compromise affects both the asset and the trust model around it.
In practice, custody authority often spans human approvers, privileged service accounts, multisig signers, hardware-backed keys, and automation that executes transactions or policy changes. That makes the term especially relevant in digital asset operations, token administration, treasury controls, and any environment where signing power is more important than routine system access. The closest operational analogue is privileged control over a high-value system, but custody authority is narrower in one sense and broader in another: narrower because it is tied to asset control, broader because it can include lifecycle powers such as upgrade and issuance. For control design, see NIST SP 800-53 Rev 5 Security and Privacy Controls for privileged access, separation of duties, and accountability patterns.
The most common misapplication is treating custody authority as ordinary admin access, which occurs when teams grant broad signing or minting rights without separately governing approvals, key custody, and revocation.
Examples and Use Cases
Implementing custody authority rigorously often introduces operational friction, requiring organisations to balance fast execution against stronger approval, recovery, and evidence controls.
- A treasury team uses a multisig wallet so no single operator can move reserve assets without independent co-signature approval.
- A protocol admin key can upgrade smart contract logic, but the upgrade path is gated by time delay, change review, and emergency rollback procedure.
- A payment platform separates transaction signing from ledger administration so a compromised support account cannot move customer funds.
- An automated agent is allowed to prepare transfers, but a human approver must release the final custody action after verifying destination and amount.
- A key management team rotates and revokes minting credentials after a breach drill to confirm that issuance power can be removed quickly.
Where custody authority is tied to identity and key assurance, controls aligned to NIST control families help distinguish who can authenticate from who can actually move value. For custody-heavy environments, this distinction is central: possession of a login should never imply possession of the asset.
Why It Matters for Security Teams
Security teams need a precise understanding of custody authority because the failure mode is not merely unauthorized access, but irreversible asset loss, fraudulent issuance, governance capture, or silent alteration of trust-critical state. That makes this term especially important in environments that rely on PAM, separate approval chains, and tightly scoped NHI controls for bots or service accounts that can execute asset movement. If an autonomous agent can trigger transfers, rotate signing keys, or call upgrade functions, then it is participating in custody authority even if it never logs in interactively.
This is where identity security and operational security converge. A weak custody model often means the organisation can authenticate operators, but cannot prove that the right entity controlled the right action at the right time. Strong custody design therefore relies on separation of duties, independent verification, revocation, and evidence trails that survive incident review. Organisations typically encounter the real significance of custody authority only after a key compromise, disputed transfer, or unauthorized upgrade, at which point the control model becomes operationally unavoidable to fix.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AC-4 | Least-privilege access supports limiting who can exercise custody authority. |
| NIST SP 800-53 Rev 5 | AC-5 | Separation of duties is central where one person should not control custody end to end. |
Split initiation, approval, and execution so no single actor can complete custody actions alone.
Related resources from NHI Mgmt Group
- What is the difference between identity governance and authority governance?
- What is the difference between access visibility and access authority?
- What is the difference between delegated user access and machine authority for AI agents?
- What is the difference between delegated access and agent authority?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 18, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
