Skip to main content
An Access Control List (ACL) is the group of named people authorised to approve the recovery of a backup. Each backup has its own ACL. Changing who’s on an ACL isn’t an administrative action. The people already on the list decide, by a simple majority. That’s what ensures no single person — not one of your own administrators, and not CoinCover — can quietly change who is able to release your material.

​
At a glance

​
How approval works

A change to an ACL — adding, removing or replacing a member — is approved by a simple majority of the people currently on it. Each member verifies their identity at the moment they vote, so an approval is tied to a verified person at the time it’s given, not just to someone who signed in earlier. Where your organisation has hardware security keys enabled, members also tap a registered security key as they vote — an extra physical confirmation on top of the identity check.

​
Set up your first ACL

1

Onboard your approvers

Everyone you want on the ACL first needs a Control account. Invite them from the Team page and have them complete account setup and identity verification. Only active users of your organisation can be added to an ACL.
2

Add your first members together

While an ACL is being established, you add its first members and approve them in one step. Add everyone who should be on it, then approve.
3

Confirm at least three members

An ACL needs at least three members before it can be used to approve a recovery. Once it’s established, every later change goes to a vote.
Choose your ACL size with a margin. To remove or replace someone on a three- or four-member list, every remaining member has to approve — so a list of five or more keeps approvals moving even when someone is away.

​
Change who’s on an ACL

Once an ACL is established, adding, removing or replacing a member is proposed and then voted on.
1

Propose the change

On the backup, open its Access Control List and propose adding, removing or replacing a member.
2

The members vote

Everyone currently on the ACL is asked to approve or reject, and each verifies their identity as they vote. The person being removed or replaced doesn’t vote on their own change.
3

The change takes effect

Once a simple majority approves, the change is applied. See Approve or reject an ACL change for the voter’s side.

​
Good to know

  • One change at a time. Finish or cancel a pending change before proposing another.
  • ACLs are frozen during a recovery. A backup’s ACL can’t be edited while a recovery is running on it, and a recovery can’t be started while a change to its ACL is in progress. Plan membership changes outside recovery windows.
  • Remove people from the ACL before the organisation. Control won’t remove a person from your organisation while they’re still on any Access Control List, so take them off their ACLs first.

​
What’s next

Approve or reject an ACL change

The voter’s side of a membership change.

Recover key material

Use the ACL to approve a recovery.

Get started

Onboard the people who’ll be on your ACLs.