Approval workflow
Reward requests move through pending, approved, rejected, flagged, processing, and completed states.
Trust and security
Designed for controlled rewards, not frontend fund movement.
VowRewards separates merchant operations from token and settlement authority so operators can work quickly while production approvals remain governed.
Current model
Guardrails already represented in the product.
These controls define how merchant work should move through production approval workflows.
Role-aware portal
Owner, operator, reviewer, support, and admin roles are modelled for production RBAC.
Treasury guardrails
No frontend-only fund movement. Token and settlement actions remain backend-approved.
Audit-ready data
Status transitions, support tickets, and admin decisions are prepared for audit logging.
Launch requirements
Security items to complete before live operator access.
The interface is production-shaped, but real credentials and fund-related actions require these controls.
Server-side auth
Add a production authentication provider, password hashing, reset flows, and session storage.
RBAC enforcement
Apply owner, operator, reviewer, support, and admin permissions to pages and API routes.
Audit logs
Record status transitions, approvals, rejections, and support decisions with actor context.
Wallet challenge
Introduce signed wallet challenge-response login only after the auth boundary is ready.