> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tiprotocol.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Design principles

> Ti Protocol's architecture rests on seven principles, from separating information and execution to putting every commitment that can go on-chain where anyone can verify it. Whenever Ti adds or changes a feature, it checks these principles first.

Ti Protocol's architecture rests on seven principles drawn from the requirements in the previous chapter. Whenever Ti adds or changes a feature, it first checks whether the change conflicts with these principles.

***

## 1. Separate information from execution

Every Ti component belongs to one of two sides. The information side (Ti AI, the quote API, and price, pool and transaction data) can look up, calculate and display anything, but cannot move funds. The execution side (the user's wallet, the cross-chain router, DEXs and bridges) moves funds, but only with the user's signature. Drawing this boundary clearly means that an error on the information side cannot spread into a loss of funds without the user's confirmation. Even if the AI states a wrong number, the screen the user signs shows the route that will actually execute and the minimum received, and a transaction that cannot meet those conditions fails on the blockchain.

***

## 2. The user signs

Ti does not hold users' assets. It does not take seed phrases or private keys, and it does not sign on the user's behalf. Every swap and transfer executes only when users check the chain, token address, amount and fees in their own wallet and approve. The same applies in Gasless mode, where the network fee is paid on the user's behalf. The relayer only submits the transaction. What is swapped, and on what terms, is fixed in the message the user signed, and the relayer cannot change it.

***

## 3. Compare by amount received

A route is judged by the amount the user finally holds. Pool fees, price impact and bridge fees are compared as they are reflected in the amount received. Costs paid separately in the native token, such as the LayerZero messaging fee, are converted to the same unit and compared alongside them. The quote screen shows the basis for this comparison: the route, the route fee, the price impact and the minimum received. The aim is to filter out routes that advertise a low fee rate but in fact deliver less.

***

## 4. Every number carries a source and a time

The quotes, prices and fees that Ti AI shows are all values its tools actually looked up, and each card states the source and timestamp alongside them. The answer text is only a summary of the card; the card is the reference for the numbers. Values whose source or timestamp cannot be confirmed are not treated as current. This principle keeps a number that a language model recalled from memory from passing as live data.

***

## 5. Use issuer-backed bridges

For moves between chains, Ti uses the cross-chain standard that the stablecoin's issuer operates or has officially adopted. USDC moves through CCTP, which Circle runs directly, and USDT moves as USDT0, which is built on LayerZero OFT and adopted by Tether. With both, the token received on the destination chain is not a wrapped token but that chain's official token. What you have to trust, and how verification works, differ from bridge to bridge, so the quote shows which bridge will be used before you sign.

***

## 6. Minimal permissions, slow changes

The TIP token and the vesting contracts have only the administrative functions they strictly need. Functions that could be used against holders, such as additional minting, upgrades, a global trading halt or transfer fees, were never built. The administrative functions that remain can be called only by a multisig Safe, with a 7-day time delay on changes to roles and permission settings, and a 72-hour time delay on fund-related functions and on re-enabling a function that has been disabled. While a change waits, the scheduled action is public on the blockchain for anyone to see. Conversely, actions that reduce permissions (disabling a function, a permanent seal) execute immediately. The principle is to reduce risk quickly and to expand authority slowly.

***

## 7. Anyone must be able to verify

Every commitment Ti makes to users and token holders that can be put on the blockchain has been put there. Supply, allocation, release schedule, permission structure and time delays can all be checked through verified source code and on-chain state. The tables and charts in this whitepaper are generated from a single facts file, and that file is automatically checked against Polygon mainnet. Where this document and the blockchain disagree, the blockchain is right.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.