> For the complete documentation index, see [llms.txt](https://docs.zoth.io/zoth/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.zoth.io/zoth/zvaults/gating-in-zvaults.md).

# Gating in zVaults

Every deposit, redemption, and token transfer in a zVault passes through a compliance sequence before it executes. The sequence has three gates, checked in order, and a failure at any gate reverts the entire transaction:

<figure><img src="/files/I6PC7q1tk1laYFB6PGJN" alt=""><figcaption></figcaption></figure>

| Gate      | Controls                                       | Default state                                 | On failure               |
| --------- | ---------------------------------------------- | --------------------------------------------- | ------------------------ |
| Greenlist | Who is permitted to enter                      | Configurable per vault (off = permissionless) | Reverts: not greenlisted |
| Blacklist | Which addresses are blocked                    | Always on                                     | Reverts: blacklisted     |
| Sanctions | OFAC-sanctioned addresses, via external oracle | Always on                                     | Reverts: sanctioned      |

Greenlisting and blacklisting are inverses. Greenlisting is an opt-in allowlist that a vault can switch on to restrict participation to an approved set. Blacklisting is an always-on blocklist that bars specific bad addresses. The sanctions gate sits alongside both as an automated external check.