A guest list on the ledger

A club keeps a guest list. The list does not name people. It names passes: "Anyone with a gold pass from Door A, or a blue pass from Door B, may come in."

A permissioned domain is that guest list, stored on the XRP Ledger. The passes are credentials.

A few things make it simple:

• Any one pass works. The list can name up to ten credentials. You need one of them, not all.
• No sign-up. You never "join" a domain. When you try to use something the domain guards, the ledger looks at your account. If you hold a matching credential, you are in. If not, the transaction fails.
• The pass must be good. You must have accepted the credential, and it must not be expired.

A domain does nothing by itself. It is only a list. Other features point at it and say, "use this list to decide who gets in." The first such feature is the permissioned DEX.

Why a list in the middle? So the rules can change in one place. If the club adds Door C, it edits the guest list. Every room that uses the list follows at once.

Anyone can create a domain. The creator is its owner. Only the owner can edit the list or delete the domain. A domain costs its owner one reserve, 0.2 XRP today.

Permissioned domains went live on mainnet on 2026-02-04.

Creating and editing. PermissionedDomainSet:

Each Credential object holds an Issuer and a CredentialType of 1 to 64 bytes. When modifying, the new list replaces the existing one.

Results:

• tecNO_ISSUER: a listed issuer account does not exist.
• tecNO_ENTRY: the DomainID does not exist.
• tecNO_PERMISSION: the sender is not the domain's owner.
• tecINSUFFICIENT_RESERVE: the sender cannot cover the new owner reserve.
• temDISABLED: PermissionedDomains or Credentials is not enabled. Domains require both.

Deleting. PermissionedDomainDelete takes the DomainID.

The entry. A PermissionedDomain stores Owner, AcceptedCredentials (sorted by issuer) and the Sequence of the creating transaction. Its ID is a hash of the space key 0x0082, the owner and that sequence number. It has no flags.

• Reserve: one item toward the owner's reserve. The number of domains is limited only by the reserve.
• It is a deletion blocker. An account cannot be deleted while it owns a domain.

Access check. When a transaction needs a resource restricted by a domain, it checks whether the account holds a credential matching the accepted list. The credential must be accepted and not expired. If the account has none, the transaction fails. When it fails because credentials are expired, those expired credentials are deleted.

What uses domains

• Live: the permissioned DEX.
• In amendments not yet enabled: private Single Asset Vaults and the Lending Protocol.

The only configurable rule today is the accepted credentials. xrpl.org says future amendments may add other kinds of rules.

Audit. xrpl.org states that Halborn audited Permissioned Domains from December 2024 to January 2025 and found no major flaws. The fixCleanup3_1_3 amendment later added an invariant check so failed transactions cannot modify a domain.