What a Public-Surface Authority Review Actually Proves

A detector can observe authority evidence. It cannot prove operational control. That sentence is the whole argument, and the article is an examination of how much follows from it.

Onchain systems are unusually legible, and a public-surface review can read a great deal without asking anyone's permission. A contract may expose an `owner()` call. A proxy may expose an implementation slot or an admin slot. Owner addresses, proxy paths, multisig structures, timelock delays, oracle behaviour, and role systems are all observable from the outside. These are real observations and they matter.

The limitation is that each observation only proves what it was designed to observe. An owner address establishes that an address owns the contract. It does not establish who controls that address, whether the signer policy behind it is sound, or what happens in an emergency. A timelock establishes a delay. It does not establish governance intent, cancellation policy, or whether an emergency bypass exists.

The mistake, then, is treating visibility as verification — seeing an owner and assuming the authority path is understood, seeing a timelock and assuming governance is safe. The observation was never wrong. The inference drawn from it was.

This matters because of where continuity risk actually lives: in the gap between what a contract exposes and how a team operates it. Signer procedures, upgrade approval, treasury movement, incident response — the real controls are operating policies, and operating policies are invisible to public evidence by their nature. No amount of care in reading the chain will surface them, because they were never written to the chain.

The method the article sets out handles this by classifying every finding rather than flattening it: Observed, Inferred, Unresolved, or Evidence Required. The classification is the discipline. It makes a review incapable of claiming more than its evidence supports, because every claim has to declare which of the four it is before it can be stated at all.

The consequence is a standard that cuts in the direction reviewers usually find uncomfortable. A Defense Review should not inflate severity just because evidence is missing, and it should not turn unresolved authority into a vulnerability claim. An unanswered question is an unanswered question. Reporting it as a finding would be the same error as treating visibility as verification, committed in the opposite direction — and it is the more tempting of the two, because it looks like rigour.

The full article is published on The Continuity Desk, Sagitta's Paragraph publication.