Compliance

View keys & selective disclosure

Hide from the crowd, not from the law. Cowl is built so you can prove what you owe, to exactly who you owe it, and to no one else.

Live · read-only keys
View keys ship in the CLI today — generate one, hand it over, and it reads without ever being able to spend. Scoping a key to a period, an asset or a counterparty is Era 02, the era now open.

View keys

A view key is a read-only credential you generate from your account. Whoever holds it can seethe shielded activity in its scope — positions, transfers, realized P&L — but can never spend, move, or trade. Handing over a view key is disclosure, not a transfer of control.

cowl viewkey show   # print your public view key
cowl viewkey new    # generate a new one

The private half stays in ~/.cowl/viewkey.json, mode 0600. It is a separate key from the one that spends, which is what makes read-only mean read-only rather than a promise.

Selective disclosure

Scoped disclosure is what Era 02 builds on top of this, so an auditor sees a window rather than your whole life. The scopes it covers:

Scope byExample
Time rangeOne quarter, for a tax review
AssetOne position, for a counterparty who only needs that
Counterparty or flowWhat moved between you and one address, and nothing else

Time-boxing and revocation land with it. Read-only is already true today; the scoping is the part being built.

What you can prove

  • Positions & holdings — solvency or exposure at a point in time.
  • Realized P&L — a clean figure for a tax authority, for one period.
  • Source of funds — which deposit funded a position, matched against the public record of it entering the pool.
Disclosure is a choice, per request
There is no master switch that turns your account public. Each view key is minted for one request, one scope. The public explorer keeps seeing nothing.

Why disclosure, not gatekeeping

Entering the pool is permissionless: no account, no allowlist, nobody’s approval. The compliance story runs the other way round, and it is the stronger one. Every crossing of the boundary is on the public ledger, and what happens inside is disclosable by you, to whoever is owed an answer, with a key that can only read. You answer for your own activity instead of asking a gatekeeper to vouch for it.