Field note
Account Abstraction: Make Authority a Programmable Resource Rule
Traditional account systems often begin with one privileged signature format and add smart-account features around it. Native account abstraction reverses that priority: every account is governed by programmable validation logic, so key rotation, multiple devices, and recovery are ordinary account policies rather than protocol exceptions.
The target follows Starknet's validate/execute separation. An account kind answers who authorizes this Action? The resource kind answers what effect is legal?
The dual-predicate rule
For every consumed resource R, its owner_kind runs validation and emits a domain-separated signal bound to R.logic, R.cm, and the complete action_digest. Then R.logic verifies that signal while checking conservation or the application transition.
This prevents two dangerous substitutions. Authority for one resource cannot authorize another, because the commitment is bound. Authority for one Action cannot be replayed into another, because the action digest is bound.
Creation needs no owner signal. Its legality follows from the conservation rule of the consumed inputs and the newly created kind. A fee output, for example, is funded by an authorized consumed resource; the new output does not need an independent signature.
A closed account family
AccountV1 is a sealed family with three variants:
SingleKeyproves knowledge of one nullifier key through a hash-based authorization tag.Multisigproves that at leastmdistinct committed key-share holders authorized the same action, without reconstructing one master secret.SocialRecoverylets a guardian threshold authorize a new authority commitment while the active key retains an epoch-counted veto path.
The account objects are validator-only kinds. They do not hold value resources. Value points to an account instance through owner_kind, and the account's proof is included only when a consumption needs it.
Private and post-quantum-plausible by construction
The account family uses hash commitments, private witnesses, and Shamir-style shares instead of an elliptic-curve signature embedded in the protocol. The public proof need not reveal whether a single-key, threshold, or recovery policy authorized a transfer because the target pads account logic to a common shape.
This does not remove all classical cryptography from PayMoney—the mailbox and fiat-evidence leg retain classical primitives—but it keeps the vault's authority core curve-free.
Account abstraction here is not a wallet convenience layer. It is the universal authority model through which every consumed resource must pass, included in the same completeness bus that proves no value object escaped its kind logic.