# Decentralized Trust Model

Tokenising real-world assets does not remove trust from the system. It **restructures and constrains trust** so that it is explicit, distributed, and auditable rather than implicit, centralized, or opaque.

The decentralized trust model defines how responsibility is shared between on-chain logic and off-chain actors, and how inconsistencies between the two are detected and managed.

***

#### Trust Is Isolated, Not Eliminated

In RWA tokenisation, some trust is unavoidable:

* assets exist off-chain
* legal enforcement occurs off-chain
* physical custody cannot be cryptographically enforced

The protocol does not attempt to deny these realities. Instead, it ensures that **no single actor controls all trust surfaces simultaneously**.

Trust is divided across:

* asset custody
* attestation and reporting
* token logic and settlement
* governance and dispute handling

This division prevents unilateral action from silently affecting token holders.

***

#### Separation of Custody and Control

A foundational principle is that **custody of the asset and control of the token must never be the same thing**.

* Custodians maintain physical or legal control of the asset
* The protocol governs token issuance, ownership, and transfers
* Issuers cannot arbitrarily override protocol rules
* Custodians cannot manipulate token state

This separation limits the damage of any single point of failure.

***

#### Attestations as Structured Trust Inputs

Where direct verification is not possible, the protocol relies on **attestations**.

Attestations are:

* explicit statements about off-chain state
* attributable to specific roles
* recorded and updated over time

Examples include:

* confirmation that an asset still exists
* confirmation that custody remains unchanged
* confirmation that cash flows were distributed

Attestations are treated as **claims**, not guarantees.

***

#### Oracles vs Attestations

The trust model distinguishes between *oracles* and *attestations*.

| Mechanism   | Purpose                            | Trust Assumption       |
| ----------- | ---------------------------------- | ---------------------- |
| Oracle      | Feeds objective data (e.g. prices) | Limited, data-specific |
| Attestation | Confirms asset or legal state      | Role-based trust       |

Oracles are suitable for externally observable facts.\
Attestations are used where human or legal judgment is unavoidable.

***

#### What the Protocol Enforces

The blockchain enforces only what it can do deterministically.

This includes:

* token supply limits
* transfer rules and restrictions
* ownership and entitlement tracking
* lifecycle transitions (issuance, freeze, redemption)

The protocol does **not** enforce:

* physical possession
* legal enforcement
* discretionary asset management

This boundary is explicit and non-negotiable.

***

#### Detecting Inconsistency Instead of Assuming Correctness

The trust model is designed to **surface inconsistency early**, rather than assume correctness indefinitely.

Signals include:

* missing or delayed attestations
* mismatches between reported and expected state
* governance-flagged anomalies

When inconsistencies occur:

* on-chain state can be frozen or restricted
* transfers can be paused
* escalation paths become available

The system prefers **safe failure** over silent continuation.

***

#### Trust Over Time

Trust is not static.

Over time:

* custodians may change
* legal structures may evolve
* asset conditions may degrade

The protocol accommodates this by:

* allowing role updates
* supporting attestation rotation
* preserving historical records

Trust changes are **recorded**, not overwritten.

***

#### No Implicit Endorsement

Participation in the protocol does not imply endorsement.

The network does not:

* vouch for asset quality
* guarantee legal enforceability
* insure against default

Token holders are expected to evaluate:

* the asset
* the legal structure
* the attestation providers

The protocol provides transparency, not judgment.

***

#### Why This Trust Model Matters

Many RWA systems fail by:

* hiding trust behind smart contracts
* collapsing custody and control
* treating attestations as facts

This model avoids those failures by:

* making trust inspectable
* limiting authority
* enabling defensive responses

Decentralization here is not ideological — it is **risk-aware system design**.