Wallet and Custody Control Planes

This note narrows the broader control-surfaces and permissions-and-policy lenses to wallet, custody, treasury, and delegated-execution stacks.

The useful question is not just who holds keys? but where does practical authority accumulate after setup?

Questions worth asking:

Does authority live in onchain account logic, workflow software, or an operator-managed signer stack?
Who controls approvals, whitelists, recoveries, policy engines, or routing defaults?
Which parts stay legible onchain, and which vanish into service boundaries?

Canonical comparison set

Visible onchain account substrate: safe, squads, and erc-4337
Hierarchy or policy extension above that substrate: palmera
Institutional custody-policy operators: fireblocks and bitgo
App-owned signer and embedded-wallet operators: privy, turnkey, para, and portal
Relay and session contrast where authority sits in connectivity defaults rather than direct custody: walletconnect

Onchain account substrate keeps the account logic comparatively legible.
Hosted signer / policy surface moves leverage into approval systems, enclaves, recovery flows, or operator dashboards.
Do not let hosted AA middleware become its own fake category center; most of it is signer and policy operations wrapped around stronger account rails.
Session / relay surface matters when the sticky authority is the wallet-app connection rail, namespace grammar, verification layer, or app-kit default rather than the signer backend.
Approval-hygiene and transaction-review surface is adjacent but separate; warning overlays are not signer or custody control.
Execution venue is the chain-facing destination and should not be collapsed into the wallet stack steering activity toward it.

Is the durable authority object an account, a workflow system, an MPC enclave, a relay session, or an approval graph?
Which vendor becomes the practical choke point even when the asset authority looks decentralized?
Does the product move power onchain, or simply move it into nicer middleware?
Are we flattening wallet substrate, hosted signer, and relay infrastructure into one wallet bucket?