> For the complete documentation index, see [llms.txt](https://docs.fast.poker/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.fast.poker/architecture/permissions.md).

# Permission system

Fast Poker uses account permissions to keep private table state private while still letting the protocol run.

## What needs privacy

| State                | Why                                                           |
| -------------------- | ------------------------------------------------------------- |
| Hole cards           | Only the owning player and TEE should see them during a hand. |
| Deck state           | The deck cannot leak before reveal.                           |
| Private table access | Room creators may gate access with whitelists.                |

## What stays public

| State            | Why                                       |
| ---------------- | ----------------------------------------- |
| Table phase      | Needed for liveness and dealer operation. |
| Public seats     | Needed for lobby and table display.       |
| Payouts and rake | Needed for verification.                  |
| Reward claims    | Needed for auditability.                  |

## Dealer access

Dealers submit actions. They do not gain special read access to hole cards.

## Player access

Players can see their own cards and public table state. They cannot read another player's private hole-card account.

During a scheduled duel, the seat wallet or its registered approved/session signer can submit that seat's `sng_duel_action`. Duel start, timeout, and ready resolution are permissionless crank lanes constrained by on-chain state and deadlines. Emission configuration is separately authority-gated on `EmissionCtrl`; ordinary dealers only pass the governed accounts required by settlement.

## On-chain access guards

Fast Poker uses account-level checks for three important trust boundaries:

| Guard                   | What it enforces                                                                                                                                             |
| ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `ProtocolGuard`         | Short-duration pause flags for selected ingress and fund-flow paths: table creation, SNG queue joins, cash deposits, top-ups, and cashouts.                  |
| Private-table whitelist | Room creators can require `WhitelistEntry` PDAs before non-creator wallets join a private cash table. Whitelist removal is also enforced at hand boundaries. |
| `ValidatorRegistry`     | Delegation paths check the TEE validator against the on-chain validator allowlist before accounts are delegated.                                             |

`ProtocolGuard` is scoped by flag and expiry slot. It is not a custody override and does not let an admin rewrite hands, change payouts, or withdraw player balances outside program rules.