# Protect identity, custody and private material

Understand where authority lives, what the proof prevents, and which device, file and disclosure boundaries still matter.

Canonical: https://docs.bankeiz.com/security/
Reviewed: 2026-10-25; coordinated packages 129.0.0; ruleset 127.0.0.

## Authority follows the admitted source

Receiz identity, proof, ownership and financial execution are admitted through their actual source contracts. A database row, copied owner label, edited amount or self-hashable wrapper cannot supply stronger authority. The enclosing artifact and required financial/ownership evidence must verify before their fields can be projected. This blocks a display or altered source from becoming a lawful operation merely because it looks convincing.

## Different files carry different authority

**Handle each original by its actual role**

| Material | Protection boundary |
| --- | --- |
| Private Identity Record / Seal / Key | Identity continuity and its required unlocking material. |
| Unprotected Vault private original | A bearer credential carrying separate Vault authority. |
| Passkey-protected Vault original | Encrypted authority requiring the original compatible passkey at its registered origin. |
| Public Vault proof | Selected disclosed evidence without private access authority. |
| Private proof archive | Sensitive retained proof data; the download is not password encrypted. |
| Screenshot or public label | Presentation; it cannot replace original admission. |

## PBI and passkey protection have different jobs

PBI is the implemented proof-bearing identity and supported recovery boundary. A passkey can supply its supported device/origin credential mechanism; it is not the entire source-carried identity, provenance and operation contract. Vault PRF protection encrypts the Vault’s separate private authority. Its recovery depends on the actual authenticator/provider and the original protected file. An ordinary identity backup cannot replace the Vault passkey or qualified Note custody.

- [Identity continuity](https://docs.bankeiz.com/identity/)
- [Vault-specific protection](https://docs.bankeiz.com/vaults/)

## Protect the unlocked environment

- Keep private originals and recovery phrases out of public messages, analytics and model prompts.
- Use the intended trusted application/origin before opening protected authority.
- Review exact recipient, amount, source and operation before approving.
- Treat an unlocked compromised device as a separate authority exposure; cryptographic proof does not make every running program trustworthy.
- Keep current backups and resolve pending custody before removing storage.

## Separate inspection from action

Independent inspection is read-only. It does not consume a Note, credit an account, establish fresh unspentness or authorize another transfer. Public proof should disclose only what the owner deliberately selects. If a source fails admission, retain it and inspect the exact refusal; do not bypass the verifier or create another issuer/signature layer to make the surface pass. Report problems with minimum public-safe references, never private authority.

- [Verification procedure](https://docs.bankeiz.com/verification/)
- [Disclosure guide](https://docs.bankeiz.com/disclosure/)

## Implementation sources

- [Vault custody, protection and independent inspection](https://github.com/kojibai/reality-grade-banking/blob/6c5d582/docs/vaults.md)
- [Private backup sensitivity](https://github.com/kojibai/reality-grade-banking/blob/6c5d582/docs/proof-backup-and-recovery.md)
- [Consent and signing-key boundaries](https://github.com/kojibai/reality-grade-banking/blob/6c5d582/src/receiz/config.ts)
- [Private source closure requirements](https://github.com/kojibai/reality-grade-banking/blob/6c5d582/docs/private-artifact-and-note-source-closures-v129.md)

## Related documentation

- [Vault authority and deliberate sharing](https://docs.bankeiz.com/vaults/)
- [Back up identity and proof originals](https://docs.bankeiz.com/backup/)
- [Consent, scopes and exact-operation approval](https://docs.bankeiz.com/permissions/)
- [Share proof without sharing private authority](https://docs.bankeiz.com/disclosure/)