Who you are trusting

"Permissioned" sounds safe. It is worth asking: permissioned by whom?

Two parties hold all the say.

The domain owner writes the guest list. The owner can add a credential or remove one at any time. That can let new accounts in or shut current ones out.

The credential issuers hand out the passes. Each issuer decides what its pass means and who gets one. An issuer can give a pass or take it back whenever it likes.

The ledger does one job here. It checks, every time, that an account holds a pass that is on the list. It does not check that the issuer did real vetting. It does not know anyone's real name.

So a permissioned DEX is exactly as careful as the people behind it. If an issuer is sloppy or gets hacked, every domain that accepts its passes has a hole. If the domain owner is careless or hacked, the same is true.

What this means for you:

• If you trade in one. Read the list. Look up each issuer. Know that your access can end if your pass expires, is revoked or drops off the list. Your open orders stop working when that happens.
• If you run one. Accept only issuers whose standards you know. Guard the owner account's keys. The owner account is the door.
• If you see the word in an ad. It tells you a list exists. It does not tell you who is on it.

Anyone can create a domain. Having one is not a license or a seal of approval.

Trust model, from xrpl.org's security notes for permissioned DEXes:

• The definition of each credential and the requirements to get it are set and enforced by its issuer. The existence of a domain does not inherently mean anything about who can use it in practice.
• A credential issuer can issue or revoke credentials at its discretion. If it is unreliable or compromised, so is any domain that accepts its credentials.
• The domain owner can change the accepted list to grant or deny access arbitrarily. If the owner is untrustworthy or compromised, so is the domain.

What the ledger enforces

Losing access. Offers placed by an account that no longer holds a matching credential are invalid. They stay in the ledger until a transaction touching their order book removes them, and cannot execute meanwhile. Causes: the credential expired or was deleted, the list changed, or the domain was deleted.

Reading a domain. Fetch the PermissionedDomain entry by its ID. Owner is the controlling account. AcceptedCredentials lists each Issuer and CredentialType. Then inspect each issuer account the way you would inspect a token issuer.

Limits that affect risk

• Liquidity is per domain. The best rate in one DEX can differ from another DEX or from the open DEX.
• A transaction cannot combine two domains. Hybrid offers can mix one domain with the open DEX.
• AMM pools cannot be restricted by a domain and cannot fill permissioned trades.
• A domain is a deletion blocker for its owner's account.

Beyond the DEX. Amendments still in voting reuse domains. A private Single Asset Vault admits only depositors with credentials from the vault's domain. Live status: SingleAssetVault, LendingProtocol. Credentials, Permissioned Domains and the Permissioned DEX are separate amendments. The DEX cannot work without the other two.

Related: Check before you hold, Single Asset Vault, Credentials.