Controller governance
Most people never need this page
Giving a computer remote-control rights day-to-day goes through device grants and only needs your account code. This page is about account governance — maintaining the account's governance controller set. It happens rarely, and it uses a different credential.
What this manages
Governance controllers are the members that take part in the account's signing quorum. Their job is to vouch for the account at the governance layer, not to "let a computer do remote control".
The corresponding portal page is Governance controller approvals (「治理控制端授权」) at /account/trust-approvals. The page says it plainly:
This page is only for governance controllers (quorum members) — approving here adds a controller to the account's governance set (taking part in the signing quorum). It requires the keymachine operator code, and the count is bounded by the quorum ceiling. To give a computer remote-control rights day-to-day, use Device grants instead — that only needs the account code and does not consume governance slots.
How the two differ
| Device grants | Controller governance | |
|---|---|---|
| Manages | "Can this computer do remote control" | "Which controllers enter the governance set" |
| Credential | Account code (TOTP) | Keymachine operator code + owner's account code |
| Portal page | Device grants (「设备授权」) | Governance controller approvals (「治理控制端授权」) |
| Frequency | Daily, often | Rarely |
| Slots | Its own device-grant quota | Bounded by the quorum ceiling, does not consume device-grant slots |
| Validity | Expires automatically, 30 days by default | Long-lived, removed explicitly |
The client's Trust Center also has a Governance controllers (「治理控制端」) section, labelled underneath with "for day-to-day remote-control permission use Device grants above".
The keymachine operator code
These operations use the keymachine operator code, not your account code. They are different credentials held through different processes — a deliberate separation of duties: the person who approves grants day to day cannot change the governance set on their own.
WARNING
The operator code is held by whoever is responsible for account governance. If you do not have it, this operation is not yours to perform — talk to the person on your team who handles account governance.
Adding and removing
- Add — put a controller into the governance set. Bounded by the quorum ceiling.
- Remove — for a lost device, someone leaving, or a machine being retired. Needs both the account owner's code and the operator code.
Do this first when a device is lost
When a controller device goes missing, revoke its device grant — and if it is also in the governance set, remove it from there too.
An ordinary member can do neither. Revoking a grant needs an account owner or administrator; removing a governance controller additionally needs the operator code. If you lose a device, contact them immediately — do not assume you can handle it yourself.
For the exact confirmation steps and quorum rules, the app itself is authoritative.
Next
- Device grants — the path you actually want day to day
- Security model — why this is split into two credentials
- Portal guide — where to find these pages