> For the complete documentation index, see [llms.txt](https://city-protocol.gitbook.io/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://city-protocol.gitbook.io/docs/issuance-and-operation-layer/otp-architecture/security-and-risk-controls.md). # Security and Risk Controls The OTP Architecture inherits City Protocol's security framework, adapted to a structure in which the protocol never holds participant assets.

Control	Function
Constituent whitelisting	Only validated, backed, verifiably priced tokenized assets may enter a portfolio.
Methodology enforcement	The executor cannot deviate from published constituents, weights, cadence, or triggers. Changes are published and versioned before taking effect.
Permission scoping	Delegated permissions are bounded to specific constituents, venues, and call selectors. They carry no withdrawal authority and cannot move assets out of the participant's account.
Owner revocability	The account owner may revoke execution permissions unilaterally and immediately. Revocation halts automation and leaves holdings untouched.
Execution bounds	Slippage caps, approved venues and routers, and balance-delta verification after every execution batch.
Price and status checks	Rebalancing halts on stale pricing, and status propagation halts it where a constituent is paused, impaired, unbacked, or ineligible.
Role separation	Methodology, execution, whitelist management, verification, guardianship, and governance are held by different keys.
Fee visibility	The full fee schedule is disclosed before subscription and accrues visibly.
Emergency pause	Halts new subscriptions and rebalancing during market, execution, or security anomalies. It does not block participant exit, which requires no action by City Protocol.
Disclosure versioning	Methodology, constituent list, weights, and risk disclosures are maintained under version control with published change history.
Structural look-through	Transparency is a property of the structure rather than a reporting feature. Holdings sit in the participant's own account and are readable onchain at any time.