> ## Documentation Index
> Fetch the complete documentation index at: https://docs.picon.finance/llms.txt
> Use this file to discover all available pages before exploring further.

# Governance

> The admin authority: what it can and can't do

## Scope

There is a single, transferable admin authority (`AdminConfig.authority`) that gates:

* pool creation,
* protocol-fee withdrawal,
* empty-bin-array deletion,
* pool config updates (dynamic fee config, protocol share).

Everything else — swapping, depositing, withdrawing, claiming, and repositioning the active bin
across empty bins — is fully permissionless.

<Warning>
  **The admin authority cannot touch LP funds.** It cannot withdraw, freeze, or redirect a
  position's principal or accrued LP fees. Its powers are limited to the four items above —
  notably including that **pool creation itself is admin-gated**, unlike some other DLMM
  designs where anyone can spin up a pool. This is deliberate: it lets Token-2022 transfer-hook
  mints be curated rather than accepted permissionlessly, since a hook is program logic the
  pool doesn't control. See [Token-2022](/concepts/token-2022).
</Warning>

## Bootstrap

`create_admin_config` solves the chicken-and-egg problem of gating the very first admin action
— nothing in `AdminConfig` exists yet to check a signer against, and a naive permissionless
bootstrap would be front-runnable. Instead, this one instruction is gated by the **program's
own on-chain upgrade authority** (verified via the SPL BPF Upgradeable Loader's
`programdata_address`/`upgrade_authority_address`, not a hardcoded pubkey) — only whoever holds
upgrade authority over the deployed program binary can bootstrap `AdminConfig`.

## Two-step authority transfer

```
transfer_admin_authority(new_authority)   -- current authority signs, sets pending_authority
accept_admin_authority()                  -- pending_authority signs, becomes the new authority
```

Two steps, not one, so a transfer can't be completed by mistake or to an address the new party
never actually controls — the nominee has to actively accept.

## Metadata-update authority

`AdminConfig.metadata_update_authority` is a deliberately separate role from `authority`, even
though both default to the same key at bootstrap — it's the authority position NFTs' Token-2022
metadata pointer is set to, rotatable independently via `set_metadata_update_authority` without
touching the main admin authority.

## Recovery

`reset_admin_authority` — also gated to the program's upgrade authority, not the current
`AdminConfig.authority` — resets both `authority` and `metadata_update_authority` back to the
caller. This is a break-glass recovery lever for a lost admin key: whoever controls the
program's upgrade authority can always regain admin control, independent of whether the
previous admin key is recoverable.