Protocol owner

Can: Configure non-custodial parameters that the program exposes.

Cannot: Cannot mint $STOCKED or withdraw the settlement reserve to an arbitrary address.

Treasury

Can: Hold operational funds separate from the settlement reserve.

Cannot: Cannot access the settlement reserve.

Fee router

Can: Verify eligible creator-fee receipts and route funds toward the reserve strategy.

Cannot: Cannot redirect fees to an external destination or hold user funds.

Redemption program

Can: Release proportional quantities of the 15 reserve stocks to eligible wallets without burning tokens.

Cannot: Cannot pay out more than the caller's proportional share of eligible reserves.

Token authority

Can: Should be revoked at deployment so supply is fixed.

Cannot: Must not retain mint authority; any retained authority is disclosed here.