A new XRP Ledger amendment could soon allow businesses to delegate individual account functions, giving separate accounts authority to handle payments or customer approvals without transferring full control of the account.
PermissionDelegationV1_1 entered its 14-day activation window on Sept. 21 after 29 of the network’s 35 trusted validators supported the proposal. It is scheduled to activate on Oct. 5 at 11:18 UTC if at least 80% of validators continue backing it, according to the live amendment dashboard.
The feature is aimed at giving institutional users greater control over how account responsibilities are divided. Stablecoin issuers, custodians and other companies could assign routine tasks to separate systems while keeping their main account keys secured.
For instance, an issuer could allow an internet-connected compliance application to approve customers eligible to hold its stablecoin while keeping the keys with full account authority offline.
Another account could be granted permission to execute payments without being able to change the primary keys or give additional permissions to another account. XRPL documentation allows each delegate to receive as many as 10 permissions, which the controlling account can later modify or revoke.
The design separates operational functions from broader account authority, similar to the way conventional banks divide payment processing, compliance and other duties among different teams or systems.
For the amendment to activate, at least 28 validators must continue supporting it. If support drops below that level, the activation timer resets and must begin again.
This is the second version of the PermissionDelegation feature proposed for the XRP Ledger. The initial version was stopped after developers uncovered a vulnerability related to transaction fees.
The flaw could have enabled an attacker to cause another account to cover fees for transactions it had not correctly authorized. By repeatedly submitting transactions with deliberately high fees, an attacker could potentially have drained XRP from the affected account.
An XRPL vulnerability report said the previous implementation checked an account’s permission to perform a transaction before validating its signature. In certain failure cases, a fee could still be charged, allowing funds to be deducted before the invalid signature was detected.
The vulnerability was reported by a community tester on Sept. 15, 2025, during testing outside the mainnet. Validators were told to vote against the amendment, preventing the original version from activating.
The updated implementation is part of xrpld 3.3.0, the server software that powers XRP Ledger nodes. The fix changes the transaction-validation sequence so unauthorized transactions are rejected without charging a fee before the signature has been confirmed.
