A draft change to who can propose and execute

PIP-93’s forum text proposes consolidating the Protocol Council, Polygon PoS and AggLayer multisig arrangements into a Security Council structure on Ethereum and Polygon. The official repository version identifies Christopher von Hessert as author and labels the proposal Draft. Its document date precedes its forum publication; neither date establishes implementation.

The proposed council has eleven signing seats across ten organisations. Polygon Labs would hold two seats; the other organisations would hold one each. Council actions would require eight signatures. The draft would replace the existing two-threshold council structure with this single policy.

The delay applies to one route, not every action

A separate Polygon Labs Operations multisig, with a five-of-nine threshold, could propose upgrades and administrative changes through a seven-day timelock. It could also pause contracts. It would not have authority to bypass the delay or unpause them.

The Security Council would retain broader powers: cancelling queued transactions, originating transactions itself, executing immediately and unpausing contracts. The seven-day period therefore cannot be described as an unconditional exit window for every upgrade. The emergency route deliberately preserves the ability to act without waiting.

The draft’s stated motivation is to reduce the signing workload for routine changes as security fixes and bridge and staking development create more work. That is the proposer’s operational argument; NetNapz has not independently measured signing delays or incident-response performance.

Migration and disclosure are part of the proposal

The first phase would change the signer sets of existing multisigs and reassign operational and pause roles without deploying new contracts. The second would deploy timelocks on both networks and consolidate the remaining structures. The text calls for a published migration order and disclosure of affected addresses before execution.

Organisations holding seats would be published, while individual signer identities and addresses would not. The draft argues this reduces targeting risk. It also acknowledges the trade-off in individual accountability and the potential for correlated risk where organisations serve on several protocols’ councils.

NetNapz assessment: deployment permissions are the decisive test

A clearer division between proposing and reviewing can reduce administrative friction, but a diagram is not an access-control audit. The useful implementation evidence would show that the Operations multisig has no alternative route around the timelock, that council cancellation works as intended, and that pause and unpause permissions match the final approved policy.

The migration itself deserves scrutiny because different contracts could temporarily operate under different signer sets. Publishing the sequence would help observers identify which authority governs each contract at a particular point. An eight-signature threshold also needs organisational context: eleven keys do not represent eleven independent institutions when one organisation holds two seats.

This is a governance-risk development, not proof of an exploited contract or a forecast of POL demand. NetNapz reviewed the draft, official repository and governance-call agenda on 7 November. It did not audit deployed contracts or verify approval, owner changes, timelock deployment or completed consolidation. Those outcomes require separate evidence.