Wallet rules

Outis refuses these whatever the user would click:

• Calls to the account itself. That is how owners, guardians and the account's code are changed. The wallet builds those transactions itself.
• Hashes. Outis signs only what it shows: it works out every hash from the transaction or message itself.
• The account's own messages. Messages in the account's reserved domains (owner-alive, sessions) are only ever signed by the wallet.
• Private actions that invoke the account or the pool, or withdraw to the pool.
• Someone else's proof. A proof is only sent back for the site and account it was made for, within fifteen minutes.

An outside execution is shown and checked as the transaction it is. A request is only approved for the wallet it was checked against: switching wallets refuses it.