A control map records who can influence a material outcome, how they can do it, what constrains them, and what evidence proves the answer.
1. Smart-contract authority
Inventory proxies, upgrade keys, pause functions, guardians, allowlists, oracles, registries, fee setters, routers, and emergency roles. Trace each role to its final controller. For multisigs, record threshold, signers, replacement process, key protection, and the social approval required before execution.
2. Interface and routing
Map the website, mobile app, API, wallet connector, transaction builder, simulation service, token lists, remote configuration, analytics, hosting, DNS, and release pipeline. Determine whether the interface only displays public data or prepares a transaction, chooses liquidity, adds a fee, or controls a relayer. Record alternative interfaces and whether they are genuinely usable.
3. Governance and concentration
Review circulating voting power, delegation, turnout, proposal thresholds, quorum, vetoes, emergency councils, execution, and recurring coalitions. Formal token distribution does not show who writes proposals, funds development, decides technical feasibility, or controls implementation. Document both legal authority and practical influence.
4. Operations and incidents
Identify who monitors the system, receives alerts, coordinates security researchers, communicates status, investigates abuse, and decides whether to pause or migrate. Include relayers, keepers, sequencers, oracles, hosted nodes, cloud platforms, key systems, and vendors. Ask what stops if each participant withdraws.
5. Commercial power
Trace protocol and front-end fees, spreads, referral payments, rebates, grants, emissions, listing arrangements, and partner contracts. Record who sets and changes the economics. Compensation is not a universal legal test, but it can show which participant operates or benefits from a service.
6. Communications and trust
Who controls documentation, terms, social accounts, support, official warnings, migration instructions, and the brand? During an incident, users often follow the participant they trust rather than the formal governance chart. Communication authority belongs in the operating map.
7. Change over time
Build a timeline for deployments, key transfers, timelocks, governance launches, fee switches, entity formation, service-provider changes, and incidents. A current decentralized state does not erase earlier operations, and a future managed feature can change a prior conclusion.
Review checklist
- Production permissions match public documentation.
- Every key and service account has an accountable owner.
- Governance execution matches the vote and implementation record.
- Fees and commercial agreements are included.
- Emergency powers have scope, duration, tests, and review.
- Historical versions are preserved.
Continue with the long-form guide on DeFi control and VASP scope, or apply the results to the jurisdiction map.