2.2 Internal Workflow Orchestration

The orchestration process on Canton is designed to automate execution while retaining oversight. Two primary workflows are supported:

Flow A — Automated Rebalance (Policy-Driven)

This flow enables fully automated rebalancing when operations are within predefined policy boundaries.

Process Steps

Detailed Flow

1. Data Collection

   • Private Oracle Agents fetch market data and risk feeds
   • Data is cryptographically signed for authenticity
   • Submitted exclusively to Canton Domain

2. Policy Evaluation

   • Daml workflow consumes the signed feed
   • References the current, active VaultPolicy
   • Computes target allocations based on strategy rules

3. Compliance Check

   • Verifies allocations comply with all policy constraints:
     • Maximum exposure limits
     • Protocol whitelists
     • Risk thresholds
     • Timing constraints

4. Automatic Execution

   • If compliant, Canton autonomously exercises choice
   • Generates cryptographically signed ExecutionIntent
   • Emits intent to Relayer for public chain execution

Example: Automated Yield Optimization

choice AutoRebalance : ContractId ExecutionIntent
  with
    marketData: SignedMarketFeed
  controller operator
  do
    -- Verify feed signature
    assertMsg "Invalid feed" (verifyFeedSignature marketData)

    -- Fetch active policy
    policy <- fetch policyContractId

    -- Compute optimal allocation
    let allocations = computeOptimalAllocation marketData policy

    -- Verify compliance
    assertMsg "Exceeds max exposure"
      (all (\(_, pct) -> pct <= policy.maxExposurePerc) allocations)

    -- Generate and emit intent
    create ExecutionIntent with
      vaultId = this.vaultId
      nonce = this.nonce + 1
      actions = allocationsToActions allocations
      deadline = addRelTime marketData.timestamp (hours 1)
      issuer = operator

Flow B — Human-in-the-loop Rebalances (Approval Required)

This workflow is used for higher-risk or discretionary operations requiring explicit authorization.

Process Steps

Detailed Flow

1. Proposal Creation

   • Operator creates RebalanceProposal contract
   • Includes full allocation details (kept private)
   • Automatically notifies designated Approver parties (observers)

2. Multi-Party Review

   • Approvers review proposal independently
   • Can access full details via Daml ledger access
   • Exercise ApproveProposal choice to sign

3. Quorum Enforcement

   • Daml runtime enforces predefined quorum requirement
   • Example: 2-of-3, 3-of-5, or custom thresholds
   • Mathematical verification of consensus

4. Intent Emission

   • Only when consensus is reached
   • Workflow transitions to final stage
   • Emits signed ExecutionIntent

Example: High-Value Rebalance

-- Operator proposes a major reallocation
createProposal : ContractId RebalanceProposal
createProposal = do
  submit operator do
    createCmd RebalanceProposal with
      proposalId = "PROP-2024-001"
      vaultId = "vault-eth-001"
      proposer = operator
      approvers = [approver1, approver2, approver3]
      proposedAllocations =
        [ ("Aave USDC", 40.0)
        , ("Compound ETH", 35.0)
        , ("Uniswap V3 USDC/ETH", 25.0)
        ]
      approvals = []
      quorumRequired = 2
      policy = policyContractId

-- Approvers sign off
approveProposal : Party -> ContractId RebalanceProposal -> Update (ContractId RebalanceProposal)
approveProposal approver proposalCid = do
  exercise proposalCid ApproveProposal with approver

-- Execute when quorum met
executeWhenReady : ContractId RebalanceProposal -> Update (ContractId ExecutionIntent)
executeWhenReady proposalCid = do
  exercise proposalCid ExecuteProposal

Workflow Comparison

Aspect	Flow A (Automated)	Flow B (Approval Required)
Trigger	Private oracle feed	Operator proposal
Authorization	Policy-based automatic	Multi-party approval
Use Case	Routine rebalancing	High-risk operations
Speed	Milliseconds	Minutes to hours
Audit Trail	Feed + policy check	Full proposal history
Human Oversight	Post-execution monitoring	Pre-execution approval

Policy-Driven Decision Making

Both flows share the same underlying principle:

Core Principle

No execution occurs without policy validation

Every operation must satisfy an active VaultPolicy contract, ensuring real-time compliance enforcement at the Canton ledger level.

Benefits

1. Consistency: Same policy rules apply to all flows
2. Auditability: Complete immutable record of decisions
3. Flexibility: Choose automation level based on risk
4. Security: Policy violations caught before public chain interaction
5. Compliance: Continuous regulatory oversight capability