Separating hot-wallet and cold-signing approval paths

---

Hot wallets move daily flow. Cold paths protect reserves. Never reuse the same approval workflow for both without analysis.

Approval tiers

Map ticket sizes to signer counts and device classes. Automate checks that enforce the map.

Physical vs software keys

Hardware-backed signing for large balances; software-only keys only where policy allows — often nowhere for treasury.

Logging

Immutable logs for who approved what, when, and from which device.