Introduction
Access Rules are declarative authorisation policies attached to Blueprint and Component methods. They define what Proofs must be present for a call to succeed. Auth Zones are per-call-frame containers that hold Proofs during Transaction Manifest execution, forming Radix's native authorisation system.
This model replaces Ethereum's msg.sender pattern with a more flexible, composable approach. Instead of checking "who called this function", Radix checks "what Proofs are available" — enabling multi-factor authentication, role-based access, and delegated authority natively.
Badges
A badge is any resource — fungible token or NFT — that a Component's Access Rules reference for authorisation. There is nothing structurally special about a badge; it is simply a resource used for access control. For example, an "admin badge" NFT might be required to call a set_price method on a DEX Component.
Access Rules support composite logic:
- require(resource) — must present Proof of a specific resource
- require_amount(n, resource) — must prove ownership of at least n units
- require_any_of / require_all_of — OR / AND composition of multiple badge requirements
- require_n_of(n, resources) — threshold (N of M) badge requirements
Auth Zone Mechanics
Each call frame in a transaction has its own Auth Zone — a stack of Proofs. When a Transaction Manifest creates a Proof (e.g., from an Account's Vault) and pushes it, subsequent method calls in the same frame can see it.
Proof propagation rules provide security guarantees:
- Proofs move up the call stack freely — a method can return a Proof to the manifest's Auth Zone
- Proofs move down the stack once — if the manifest pushes a Proof and calls Component A, then Component B, both see the Proof
- But if Component B internally calls Component C, Proofs from the manifest do not propagate to C's frame — preventing unintended authorisation delegation
Access Rules can be configured as locked (immutable) or updatable, and support named roles (e.g., "admin", "minter") that map to different badge requirements. Smart Accounts use a specialised Access Controller Component that implements multi-factor authentication using this same mechanism.
External Links
- Proofs / Auth — Radix Documentation
- Authorization Model — Radix Documentation
- Multi-Factor Smart Accounts — Radix Blog
Connect your wallet to join the discussion.