Governance & trust model
Own is admin-configured, not immutable: parameters, listings, and oracle wiring are governance-set through the ProtocolRegistry's role system. This page states plainly who can do what.
Roles
| Role | Powers | Constraint |
|---|---|---|
| Protocol admin | Set risk parameters, caps, listings, oracle configuration, registry wiring | 3-hour transfer delay; migration to a Safe multisig is a standing commitment |
| Operator | Emergency levers only: trading pause, asset halt, PSM guard acknowledgement, mint pause | Instant, but cannot move funds or change parameters |
| Keeper | Push verified prices, re-stamp marks | Permissionless; anyone can run one |
| Vault Manager | Run one collateral vault: accept LP deposits, manage the lending book, distribute yield | Registered per vault; economics flow to that vault's LPs |
| Market makers / oracle signers | Quote and attest | Semi-trusted, fenced by bands, caps, expiry, and single-use signatures |
| Traders / holders | Everything permissionless | Treated as adversarial by every code path |
The levers, by product
| Product | Levers |
|---|---|
| eTokens | Utilization cap, per-asset issuance caps, concentration caps, settle band, freshness windows, claim threshold, pause/halt |
| eUSD | MCR and liquidation parameters, stability fee, minimum debt, debt ceiling, mint price max age, mint pause, collateral add/disable |
| Oracles | Feed configs, bands, signer set, verifier upgrades (with rollback) |
What admin cannot do
- Mint eTokens or eUSD to itself; issuance only happens through the collateralized paths.
- Seize user balances; eToken and eUSD balances have no admin hook.
- Block exits: repay, close, redeem, PSM redemption, and liquidation have no pause switch by design (a halt changes the price they settle at, never their availability).
The honest trade-off
Immutability (Liquity's model) removes governance risk but freezes every parameter forever. Own chose adjustability because equity collateral, growing asset lists, and a young stablecoin need tunable caps and thresholds. The mitigations are scope (the levers above are the whole list), the operator/admin split, the transfer delay, and the standing rule that exits are ungated. Users should weigh admin-key risk as real; see Risks.