In digital-asset operations, a withdrawal is a decision long before it is an event. It is requested, reviewed, approved, queued. None of that moves value. Value moves at one specific moment: release.
A withdrawal becomes real when value is released.
A withdrawal is submitted from a customer account and approved through the normal review. It enters the release queue. Everything on record is in order: the request is authorized, the amount is within limits, the approver signed off.
Then time passes between approval and release. Not much — minutes, hours, sometimes less. In that window, the account's situation is no longer identical to the moment the approval was given.
At approval, the picture was clean. By the time the release opens, one of the conditions that justified it has shifted: the session that raised the request is no longer the one acting, the account has been flagged since, the amount now sits above a limit that was recalculated, or the approval itself has simply aged past the point where it still describes the present.
The approval record does not know any of this. It captured a moment. It cannot re-check a later one.
Most controls sit before the release. A policy defines what is allowed. A review confirms the request met it. A log records that it happened. Each is real, and each looks backward or sideways — none of them stands at the release itself and asks whether the action is still admissible now.
So the release inherits trust from an earlier moment. If the earlier moment no longer holds, the release does not notice. The keys still sign. The queue still moves. The value still leaves.
The execution boundary is the point where the approved withdrawal is about to be released. At that instant, before value moves, it re-checks the present:
If all four still hold, the release opens. If one has changed, the release does not.
The withdrawal is not cancelled and not silently passed. It is held at the boundary, with the reason preserved. What was allowed a moment ago is simply not allowed to become real until the present supports it again.
When a withdrawal that should not have released leaves the exchange, the cost is not a policy gap on paper. It is value gone, an incident to reconstruct, and a regulator asking why an authorized action was allowed to execute under conditions that had already changed. The control that would have caught it does not live in the approval. It lives at the release.
The approval was never wrong. It was simply history by the time the release opened — and history is not the same as a check at the moment value moves.
This scenario, and four others across custody and financial operations, are shown in the Execution Boundary Atlas.
View the Execution Boundary Atlas →