> ## Documentation Index
> Fetch the complete documentation index at: https://protocol.crunchdao.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Access Control

> The Secure Model Protocol that authenticates communication between Coordinators and Model Runners.

Model Runners are reachable on the public network. The **Secure Model Protocol** ensures that:

* Communication between the Coordinator and the Model Runner is encrypted
* Requests genuinely come from the expected Coordinator
* The Model Runner is controlled by the on-chain identity (wallet) it claims

It achieves this by combining **mTLS**, **wallet-signed messages**, and a **rotatable hotkey** that
binds each TLS certificate to an on-chain identity.

## How it works

<Steps>
  <Step title="Certificate issuance">
    The Crunch Protocol issues TLS certificates through a private certificate service, signed by the
    protocol's Certificate Authority (CA).
  </Step>

  <Step title="Mutual TLS (mTLS)">
    Both the Coordinator and the Model Runner present valid certificates when connecting. The
    connection is encrypted end-to-end, and both endpoints are authenticated.
  </Step>

  <Step title="Wallet binding">
    A wallet signature binds the TLS public key to an on-chain identity. A rotatable **hotkey**
    allows the owner to invalidate old bindings if a key is compromised.
  </Step>

  <Step title="Per-request verification">
    Every gRPC request carries authentication metadata so the receiver can verify the caller's
    identity on each call.
  </Step>
</Steps>

## Authentication message

Each side generates a `tls_auth_message` containing:

* The TLS public key (`cert_pub`)
* A hotkey value
* A wallet signature over the message

Every gRPC request then includes:

| Header                 | Description                                                   |
| ---------------------- | ------------------------------------------------------------- |
| `x-auth-message`       | The signed authentication message                             |
| `x-auth-signature`     | Wallet signature over the message                             |
| `x-auth-wallet-pubkey` | Wallet public key (debug only — chain is the source of truth) |

## Verification checks

When a request arrives, the receiver validates three things before accepting it:

1. **Wallet signature** — verify that `x-auth-signature` correctly signs `x-auth-message`, using
   the wallet public key fetched **from the blockchain**
2. **TLS certificate binding** — confirm that the TLS public key in `x-auth-message` matches the
   certificate used in the active mTLS connection
3. **Hotkey validity** — confirm that the hotkey in `x-auth-message` matches the hotkey currently
   registered **on-chain**

If any check fails, the request is rejected.

<Card title="Next: Crunch lifecycle" icon="arrow-right" href="/core-concepts/crunch-lifecycle">
  Understand the full lifecycle of a Crunch — from creation through payout to closure.
</Card>