Security Council

The Security Council is the strategy's emergency oversight body and its final line of defense. It holds no power to run the strategy in normal times: it cannot open positions or change parameters at will. Its job is to watch, veto, and intervene when something threatens user funds.

Responsibilities

• Veto pending changes. The Council reviews timelocked changes scheduled by the Risk Manager (especially instruction-root updates) and can cancel any that introduce unacceptable risk before they take effect.
• Trigger Recovery Mode. In response to a hack, Operator or Risk Manager misbehavior, abnormal share-price movement, or funds otherwise at risk, the Council can put the strategy into Recovery Mode. While active, the Council assumes the Operator's role and the strategy is restricted to unwinding only.
• Initiate Security Module slashing. When a genuine shortfall occurs, and where the strategy has a Security Module configured, the Council can trigger its slashing to cover losses for share holders.
• Bypass the share-price guard when legitimate. The Council can force an AUM update even when the share-price change exceeds the normal rate limit, useful when a large, legitimate move must be reflected.
• Relay spoke accounting as a fallback. If the Chainlink CRE path that normally delivers spoke accounting snapshots is unavailable, the Council can publish them to the Machine directly.

Unlike the Operator and Risk Manager, whose powers are bounded by limits they cannot exceed, the Security Council is a fully trusted actor. Several of its powers are immediate, unilateral, and destructive if misused:

• During Recovery Mode it assumes the Operator's role (itself still bounded by the instruction set and loss caps).
• It can reset a token's bridging state, force-withdrawing pending funds from the bridge adapters and clearing that token's in-flight accounting.
• As an always-authorized accounting source, it can force an AUM update even when the change exceeds the share-price rate limit.
• It can publish spoke accounting snapshots directly, bypassing the CRE forwarder and workflow authorization (the mailbox and freshness checks still apply).
• Where a Security Module is configured, it can trigger slashing, seizing staked funds (up to a configured cap) to cover a shortfall.

The Security Council is a multisig protected by the safeguards described in Multisig Security, and at the protocol-wide level it holds the Guardian role that can cancel scheduled upgrades.