# Vault authority and deliberate sharing

Use separate Vault custody, save its current private original, and disclose selected proof without handing over access.

Canonical: https://docs.bankeiz.com/vaults/
Reviewed: 2026-10-25; coordinated packages 129.0.0; ruleset 127.0.0.

## Open separate custody

A Vault holds supported money sources, asset originals and investment ownership certificates. Its private original carries separate custody, contained sources and operation history. It contains the Vault key rather than the ordinary account signing key. Open Identity → Your vaults to create a named Vault or open its complete private PNG.

> **An unprotected private original is a bearer credential**
>
> Anyone with that file can use the Vault authority it contains. Keep it private. The public proof is a different original that carries selected evidence without the private key.

## Save and reopen the prepared original

1. **Create or open the Vault** — Use the actual private original and required protection.
2. **Save the prepared source** — Before first custody creation or a new financial operation, save and reopen the exact prepared private original as requested.
3. **Review the operation** — Inspect source, quantity/amount and actual destination.
4. **Save the updated original** — After completion, carry the new result to another device with the updated file. An older saved original cannot contain an unsaved later result.

## Optional passkey protection

Passkey protection encrypts the private authority using the existing WebAuthn PRF path. Opening requires the original PRF-compatible passkey at the registered relying-party origin and the protected file. Replacement-device recovery depends on the actual authenticator/provider. An ordinary Identity Record cannot replace either. Protect the unlocked environment as well as the saved file.

- [Protection and recovery boundaries](https://docs.bankeiz.com/security/)

## Move the actual source

**Vault actions preserve the source type**

| Source | Supported movement |
| --- | --- |
| Balance | Existing funded Note moves Reserve/Settlement into the Vault’s separate custody. |
| Card | One retained checkout is reconciled before its admitted funded value moves. |
| Original | Admitted supported asset moves in kind with quantity, ownership and history. |
| Investment | Admitted Market ownership units move in kind with basis/history; this is not a sale or purchase. |
| Send or return | Exact source and recipient are approved; return targets the original admitted owner account ID. |

## Share and inspect a public proof

Under Share proof, select holdings to disclose. The shared original carries selected native witnesses and a holder signature, without a private key, phrase, login record or spendable bearer token. Its QR identifies the Vault and exact proof digest. Publishing that record is a separate choice; an unpublished locator cannot fetch an unpublished record. Public proof establishes disclosed evidence at its recorded coordinate, not present unspentness.

The dedicated /vault/<vault-id>/?proof=<sha256> reader and standalone Vault reader verify the enclosing artifact before projecting carried evidence. Saved contents open offline; funding, sending, return and custody changes use their connected financial contracts. Lost responses retain the exact request and must recover it without inventing another transaction.

- [Independent inspection](https://docs.bankeiz.com/verification/)
- [Public disclosure controls](https://docs.bankeiz.com/disclosure/)

## Implementation sources

- [Complete Vault custody and inspection guide](https://github.com/kojibai/reality-grade-banking/blob/6c5d582/docs/vaults.md)
- [Standalone Vault reader instructions](https://github.com/kojibai/reality-grade-banking/blob/6c5d582/institution/vault-inspector/README.txt)
- [Exact Vault operation recovery](https://github.com/kojibai/reality-grade-banking/blob/6c5d582/src/receiz/vault/recovery.ts)

## Related documentation

- [Protect identity, custody and private material](https://docs.bankeiz.com/security/)
- [Back up identity and proof originals](https://docs.bankeiz.com/backup/)
- [Verify an Original independently](https://docs.bankeiz.com/verification/)
- [Share proof without sharing private authority](https://docs.bankeiz.com/disclosure/)