CERO

Every send of a token needs the right to hold and send it twice: from the account that sends and from the account that receives. The token's owner always has it.

A token is public when its default gives that right to anyone, and private when it does not: then only the accounts it names have it. A row of an account's own replaces the default, so on a public token an empty row keeps that one account from it.

A private token can let in the holders of a certificate instead of naming accounts one by one: a key account qualifies with a certificate of its own that is still valid and was issued under the named one -- the network checks the signature, not the name. A storage account or a multisig cannot qualify that way: it needs a row of its own.

A wallet acts by its own key, and nobody else may act for it unless it grants them a right: to send its tokens, to update its info, or everything as an admin. A token, storage or network account has no key: exactly one owner runs it, with any admins the owner names.

A token, storage or network account also has a default: what anyone may do without a right of their own, such as depositing into a storage account or holding a token. A right of one's own replaces the default rather than adding to it, so an empty right blocks.

A right can be given to the holders of a certificate rather than to an account: whoever holds a certificate from that issuer has it. A multisig's signers and quorum are set when it is created and can never change.