> For the complete documentation index, see [llms.txt](https://candora.gitbook.io/whitepaper/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://candora.gitbook.io/whitepaper/candora-grid/operational-model.md). # Operational Model Activation logic, control surfaces, and access mechanics Candora's core claims depend on explicit operating rules. This section defines the primary control mechanisms governing execution, participation, custody, withdrawals, and protective safeguards across the exchange environment. Candora distinguishes between matching neutrality and broader service behavior. Matching neutrality applies to how eligible orders are sequenced and executed inside Orbit. Other infrastructure layers may still apply predefined controls outside the matching engine, including ingress shaping, streaming prioritization, withdrawal pacing, and emergency settlement workflows. ### Shared Stress State Candora coordinates critical infrastructure behavior through a shared system-wide stress state that represents the current level of market and operational strain across the exchange environment. The stress state functions as a common coordination signal consumed by Orbit, Risk Engine, Pulse, Vault, and Connect. Rather than operating as isolated reactive systems, these infrastructure domains continuously adapt to a synchronized view of overall market conditions. The shared stress state is derived from multiple categories of real-time telemetry, including: * Volatility expansion * Liquidity depletion * Spread instability * Execution pressure * Liquidation intensity * Margin utilization * Reserve stress * Infrastructure congestion The resulting stress state is normalized to a bounded range: ``` S(t) ∈ [0,1] ``` where lower values represent stable operating conditions and higher values represent elevated systemic stress. > The stress state does not directly perform execution, pricing, settlement, or risk management. Instead, it acts as a shared coordination signal that allows infrastructure domains to respond coherently to changing market conditions while preserving separation of responsibility between subsystems. As stress increases, infrastructure behavior may become progressively more conservative. Risk Engine can tighten solvency constraints, Orbit can reduce destabilizing execution pressure, Pulse can prioritize execution-critical telemetry, Vault can pace settlement activity, and Connect can increase ingress protections. Because the stress state is derived from deterministic inputs and predefined control logic, infrastructure responses remain reproducible, auditable, and independent of operator discretion. ### Stress Activation Model Adaptive Stabilization Mode is rule-based and cannot be manually triggered. Orbit continuously evaluates the shared stress state alongside execution-specific market conditions. Adaptive Stabilization Mode activates only when predefined activation conditions are satisfied and automatically deactivates when predefined recovery conditions are met. The mechanism is designed to respond to exceptional market instability rather than ordinary volatility. Activation is therefore driven by coordinated stress conditions across the broader infrastructure environment rather than by any single market metric. See Orbit for the execution-state model and activation logic. ### Interval Clearing Standard operation uses FIFO price-time priority. During Adaptive Stabilization Mode, eligible orders are grouped into short fixed intervals rather than processed as a continuous queue race. Orbit computes a single clearing price for each interval by maximizing matched volume across aggregate demand and supply. All price-compatible orders within that interval clear at the same price. This mechanism is designed to reduce microsecond queue races during exceptional stress conditions while preserving replay consistency and equal matching treatment. Stabilization intervals are typically between `10ms` and `100ms`. See Orbit for the clearing model and interval behavior. ### Open Participation Model Candora operates under an Open Participation Model supported by institutional-grade custody infrastructure and automated, non-discretionary sanctions screening. Participation does not depend on traditional identity verification at onboarding where permitted by the asset, transaction profile, and applicable legal framework. Access is governed through sanctions screening, system-level risk controls, and predefined compliance mechanisms. Users retain control over trading decisions, capital deployment, and withdrawal intent. Candora continues to operate the execution, settlement, ledger, reserve-management, and custody systems required to run the platform. The model is designed to reduce unnecessary onboarding friction while maintaining predefined security, compliance, and system-integrity controls. See [System Principles](/whitepaper/system-principles.md) and [Vault](/whitepaper/candora-grid/vault.md) for the operating model. ### Custody, Compliance, and Withdrawals Sanctions screening is automated and non-discretionary at the access layer. Vault serves as the system of record for balances, reserve state, custody operations, and withdrawal authorization. Withdrawals follow a fixed pipeline consisting of: ``` Request → Validation → Risk Review → Signing Queue → Broadcast ``` Under standard risk conditions, daily withdrawals below **$50,000 USD** equivalent are designed to remain streamlined and generally do not require identity disclosure. Additional controls may apply when triggered by sanctions restrictions, elevated withdrawal size, abnormal risk signals, asset-specific obligations, custody constraints, issuer requirements, reserve requirements, or other legal obligations. Assets subject to additional regulatory, issuer, reserve, or custody requirements may be subject to controls beyond those applied to the platform's default participation model. During periods of extreme market stress, withdrawal execution may be paced system-wide to preserve reserve continuity and settlement integrity. This pacing affects settlement timing rather than trade matching priority. It is therefore a service-layer control rather than a matching-layer preference. See [System Principles](/whitepaper/system-principles.md) and [Vault](/whitepaper/candora-grid/vault.md) for the compliance and settlement flow. ### Programmatic Risk Management Removing default identity-based onboarding requirements does not remove responsibility. Rather than relying on broad upfront personal data collection, Candora applies real-time behavioral monitoring and system-level controls to identify toxic flow, abusive order-entry behavior, manipulative quoting, wash-like activity, and other forms of market abuse. These controls are designed to protect market integrity while minimizing unnecessary data collection. This separates participation from ongoing system oversight. Users receive streamlined access while the platform maintains ecosystem stability through predefined, non-discretionary controls. #### Behavioral Profiling Candora uses exchange-native risk management systems to identify manipulative or destabilizing activity in real time. Examples include: * Abusive order-entry and cancellation patterns * Quote distortion * Wash-like activity * Market manipulation attempts * Liquidity-disruptive behavior The objective is to identify behavior that may threaten market integrity while maintaining rule-based and auditable enforcement standards. #### Network-Level Screening Access is governed through automated sanctions screening at the gateway and connection layer. This helps prevent prohibited address interactions while preserving broad access for legitimate participants. #### Threshold and Exception Controls Elevated withdrawal sizes, sanctions flags, or abnormal risk signals may trigger additional controls or verification requirements under predefined policies. These controls are designed to address exceptional circumstances while preserving the platform's broader participation framework. #### Cryptographic Attestation For institutional participants requiring Travel Rule compliance, Candora supports optional cryptographic attestation. This enables Virtual Asset Service Providers (VASPs) to exchange required transaction metadata while preserving the platform's broader privacy and participation framework. ### Abuse Controls, Edge Cases, and False Positives Candora uses bounded system-level controls rather than opaque discretionary intervention. Connect applies validation, rate limits, replay protection, anomaly detection, and session quarantine for abusive ingress behavior. Risk Engine and Vault apply predefined thresholds, anomaly checks, and stress-aware pacing before execution or settlement proceeds. Analytical systems such as Anti-Spoof and Liquidity Mirror are intentionally limited in scope. They improve interpretation of liquidity behavior but do not modify the core order book, alter matching priority, or claim perfect detection. Legitimate repricing can resemble spoof-like behavior in thin or unstable markets, and Candora explicitly acknowledges this limitation. The objective is to improve market interpretation and contain abuse without claiming that false positives can be eliminated entirely. See Connect, Anti-Spoof, and Liquidity Mirror for the protection and interpretation layers.