Cryptoasset custodial system with vault-specific rules governing different actions allowed for different vaults

A system comprising:

• a hardware security module configured to execute instructions to perform operations comprising:
• receiving a request to take an action with respect to a vault in a cryptoasset custodial system, wherein the action comprises a change to a policy map associated with the vault, wherein the associated policy map defines vault control rules governing which actions are allowed for the vault;
• authenticating the policy map for the vault on which the action is requested based on a cryptographic key controlled by the hardware security module, the hardware security module managing private keys of cryptographic key pairs usable to control access to cryptoassets associated with a customer account of the cryptoasset custodial system;
• checking the action against the policy map for the vault when the policy map for the vault is authenticated based on the cryptographic key controlled by the hardware security module;
• and
• effecting the action when the action is confirmed to be in accordance with the policy map for the vault by:
• generating an updated version of the policy map including the requested change;
• digitally signing the updated version of the policy map using the cryptographic key controlled by the hardware security module;
• and
• storing resulting digital signature data for future use by the hardware security module,
• wherein the action comprising the change to the policy map includes at least one of:
• adding a new user to the customer account, removing an existing user from the customer account, updating a user access level of one or more existing users of the customer account, or modifying a threshold number of users of the cryptoasset custodial system required to approve the action.

A non-transitory computer-readable medium storing computer-executable instructions, which, when executed by a hardware security module, cause the hardware security module to perform operations comprising:

• receiving a request to take an action with respect to a vault in a cryptoasset custodial system, wherein the action comprises a change to a policy map associated with the vault, wherein the associated policy map defines vault control rules governing which actions are allowed for the vault;
• authenticating the policy map for the vault on which the action is requested based on a cryptographic key controlled by the hardware security module, the hardware security module managing private keys of cryptographic key pairs usable to control access to cryptoassets associated with a customer account of the cryptoasset custodial system;
• checking the action against the policy map for the vault when the policy map for the vault is authenticated based on the cryptographic key controlled by the hardware security module;
• and
• effecting the action when the action is confirmed to be in accordance with the policy map for the vault by:
• generating an updated version of the policy map including the requested change;
• digitally signing the updated version of the policy map using the cryptographic key controlled by the hardware security module;
• and
• storing resulting digital signature data for future use by the hardware security module,
• wherein the action comprising the change to the policy map includes at least one of:
• adding a new user to the customer account, removing an existing user from the customer account, updating a user access level of one or more existing users of the customer account, or modifying a threshold number of users of the cryptoasset custodial system required to approve the action.