Permissioned AMMs, explained.

An AMM in three sentences

A liquidity pool holds two assets and prices them by a deterministic formula over its reserves — the constant-product rule being the canonical example. Liquidity providers deposit both assets and receive shares; traders pay one asset in and receive the other out, moving the price along the curve. There is no order book, no matching engine, no counterparty negotiation: price is a function of state.

That property — no discretionary intermediation — is why regulators can scope conditional relief around AMMs: the behavior of the venue is fully determined by public code and public state, and every action is observable onchain.

What "permissioned" means at the contract level

Permissioning is not a login screen. In a permissioned AMM, the pool consults a policy contract on every action — every swap, every liquidity deposit and withdrawal — and refuses anything the policy rejects:

function swap(...) external returns (uint256 out) {
    require(policy.beforePoolAction(pool, msg.sender, Action.Swap, delta),
            "policy rejected");
    // ... deterministic math, no other path ...
}

The policy knows three things: who is acting (is this address admitted, and at what tier?), what (is this pool listed, is it paused?), and how much (does this action stay inside the pool's exposure cap?). A participant interacting through your front end, a raw wallet, or a custom bot hits the identical check. Permissioning is a property of the mechanism, not of the interface.

The single-choke-point pattern

All checks route through one policy contract rather than being scattered across pools and modules. This is deliberate:

• Auditability: an auditor or supervisor reads one door. Every rule the venue enforces — admission, pause, caps, throttle — has one address and one event history.
• Evolvability: rules change. A governed, upgradeable policy absorbs new conditions; immutable pools keep their accounting guarantees. Rule changes are observable, attributable, and revertible.
• Testability: "the venue cannot do X" becomes one invariant suite over one choke point, not a sweep across every contract.

Custody posture: halt, never move

The design rule that keeps a permissioned AMM out of custody scope: the operator can halt activity, but no operator keypath can ever transfer participant funds. Pools hold assets against immutable accounting. Compliance authority is the authority to freeze — pause a pool, delist a pair, restrict an address — never to move. The strongest form of this claim is tested by absence: the invariant suite asserts no such codepath exists, not merely that it is unused.

When a primary-exchange halt arrives, the affected pool refuses swaps for the duration. Balances stay where they are, owned by whom they belong to. When the halt clears, the pool resumes.

Enforcing caps without trusting an oracle

Two kinds of caps, two mechanisms — neither trusts a live price feed:

• Pool exposure caps, onchain and oracle-free: a pool's open exposure is measured as twice its quote-asset reserve — the stablecoin leg it actually holds — against a configured cap. The check depends only on balances the contract itself controls. No oracle, no manipulation surface.
• Per-symbol volume caps, offchain and fail-closed: the operator layer throttles trading to a fraction of prior-month consolidated volume — a monthly aggregate from official feeds, not a live price. On feed loss, the monitor fails closed: throttle first, alert, resume when the feed returns.

Permissioned AMM vs. the alternatives

Where permissioned AMMs fit the world's regimes

In the US, the Innovation Exemption is explicitly AMM-scoped — it is currently the only affirmative lane anywhere for AMM trading of tokenized securities. In the EU and UK, the DLT Pilot Regime and Digital Securities Sandbox are technology-neutral: an AMM venue enters under the same authorization as any other trading facility, and the permissioned architecture supplies the participant controls and records those regimes expect. The same core, different rulebook: EU mapping · UK mapping.

Frequently asked questions