> For the complete documentation index, see [llms.txt](https://delpho.gitbook.io/delpho-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://delpho.gitbook.io/delpho-docs/risk/governance-and-parameter-risk.md).

# Governance and parameter risk

Even without token-vote governance at V1, Delpho has operational authority over parameters and contracts. That authority is a real trust surface, and is documented as one rather than hidden.

## **Where authority sits**

* **Pause authority.** Held by a multisig with documented timelock behavior. Emergency pauses can bypass the timelock; routine pauses observe it.
* **Contract upgrades.** The USDV token, the sUSDV staking contract, and the hedge orchestration logic are upgradable through the multisig with an extended timelock.
* **Per-collateral parameters.** Adjustable through the multisig. See [Parameters](/delpho-docs/parameters.md) for current values, and *Risk advisor reports* for the StableWatch quantitative input that informs parameter changes.

## **Failure modes**

* **Multisig compromise.** If multisig keys are compromised or signers collude, the protocol's pause, upgrade, and parameter controls could be misused.
* **Adversarial or buggy upgrade.** An upgrade could change protocol behavior in ways that harm users. The extended timelock is the primary mitigation, giving the community time to react.
* **Inadequate emergency response.** A timelock that is too long can delay a response to an active exploit; one that is too short reduces the protection the timelock provides.

## **Mitigations**

* **Documented timelocks** for non-emergency upgrades and parameter changes.
* **Observable authority.** The matrix of which actor controls which function is published. See [Trust assumptions and multisig](/delpho-docs/risk/trust-assumptions-and-multisig.md).
* **External quantitative input** from StableWatch on parameter selection. See [Risk advisor reports](/delpho-docs/audits-and-security/risk-advisor-reports.md).
* **Progressive decentralization** is on the roadmap. The V1 multisig model is not the endpoint. See [Governance](/delpho-docs/governance.md).

## **Residual risk**

Multisig-controlled administrative authority is a real centralization risk. Timelocks and observability make it bounded and predictable, but they do not eliminate it.