Guard secures what can execute with one CPI call. Authority secures who can authorize: upgrades, mints, freezes, any PDA. Zero changes to the target program.
Guard secures what can execute. Authority secures who can authorize. Together they cover every privileged action on Solana: withdrawals, program upgrades, mint authority, admin keys.
Policy-gated instructions inside programs you own.
use trana_guard::cpi::{enforce}; trana_guard::cpi::enforce( ctx.trana_ctx(), Policy::Require, )?; ctx.accounts.vault.withdraw(amount)?;
Reverts at the instruction boundary on missing proof.
Wraps any transferable authority, including code you don't own.
# transfer real authority to a Trana PDA — once solana program set-upgrade-authority $PROGRAM \ --new-upgrade-authority $TRANA_PDA # now: leaked key cannot upgrade. only the PDA can. # and the PDA only signs after passkey proof.
The leaked admin key can request. It cannot authorize.
Guard sits between the transaction and your program logic. Every sensitive instruction evaluates a policy before it can run. No proof, no execution. The transaction reverts at the instruction boundary.
Solana's secp256r1 verifier is a native precompile, not callable by CPI. Guard reads sibling top-level instructions via the Instructions sysvar, so the precompile and record_proof sit alongside your action in the same transaction.
A leaked seed can sign anything. A guarded program demands a P-256 assertion, bound to this transaction, at execution time. Funds remain even when the keypair is public.
Solana shipped a P-256 verifier as a native precompile. The same curve WebAuthn uses. Passkeys verify on-chain in one instruction.
Each policy is a firewall rule. Stack them, branch them, sunset them. Every evaluation happens on-chain, every block.
Requires a fresh passkey assertion before execution. No proof, no instruction. The strongest guarantee Trana ships.
Caps SOL or SPL transfers per instruction. Below the threshold, no proof needed. Above it, the gate engages.
Locks the gate until slot N. Use it for unlock windows, vesting cliffs, and delayed admin actions. The cluster clock enforces it.
Expires the gate at slot N. Session keys, time-boxed approvals, revocable delegation. All expire without a transaction.
Drop trana_guard::require at the top of your handler. Pass the guard PDA. Done. Your program is now protected by execution-time authorization without restructuring a single account.
require!expands to a single CPI to a single instruction on a single program. No magic accounts, no hidden upgrades. Read the lowering yourself.
On a missing or malformed proof, the action returns GuardError::ProofRequired. The transaction reverts at the instruction boundary. Nothing ever lands.
Program ID. Audit reports. License. The same fields you'd expect on a TLS chain — pinned to slots, not screenshots.