@flowtyio/flow-contracts 0.1.0-beta.11 → 0.1.0-beta.12

package/contracts/hybrid-custody/HybridCustody.cdc

@@ -1,5 +1,7 @@
 // Third-party imports
 import "MetadataViews"
+import "ViewResolver"
+import "Burner"
 
 // HC-owned imports
 import "CapabilityFactory"
@@ -27,39 +29,43 @@ import "CapabilityFilter"
 ///
 /// Repo reference: https://github.com/onflow/hybrid-custody
 ///
-pub contract HybridCustody {
+access(all) contract HybridCustody {
+    access(all) entitlement Owner
+    access(all) entitlement Child
+    access(all) entitlement Publish
+    access(all) entitlement Manage
 
     /* --- Canonical Paths --- */
     //
     // Note: Paths for ChildAccount & Delegator are derived from the parent's address
     //
-    pub let OwnedAccountStoragePath: StoragePath
-    pub let OwnedAccountPublicPath: PublicPath
-    pub let OwnedAccountPrivatePath: PrivatePath
+    access(all) let OwnedAccountStoragePath: StoragePath
+    access(all) let OwnedAccountPublicPath: PublicPath
+    access(all) let OwnedAccountPrivatePath: PrivatePath
 
-    pub let ManagerStoragePath: StoragePath
-    pub let ManagerPublicPath: PublicPath
-    pub let ManagerPrivatePath: PrivatePath
+    access(all) let ManagerStoragePath: StoragePath
+    access(all) let ManagerPublicPath: PublicPath
+    access(all) let ManagerPrivatePath: PrivatePath
 
-    pub let LinkedAccountPrivatePath: PrivatePath
-    pub let BorrowableAccountPrivatePath: PrivatePath
+    access(all) let LinkedAccountPrivatePath: PrivatePath
+    access(all) let BorrowableAccountPrivatePath: PrivatePath
 
     /* --- Events --- */
     //
     /// Manager creation event
-    pub event CreatedManager(id: UInt64)
+    access(all) event CreatedManager(id: UInt64)
     /// OwnedAccount creation event
-    pub event CreatedOwnedAccount(id: UInt64, child: Address)
+    access(all) event CreatedOwnedAccount(id: UInt64, child: Address)
     /// ChildAccount added/removed from Manager
     ///     active  : added to Manager
     ///     !active : removed from Manager
-    pub event AccountUpdated(id: UInt64?, child: Address, parent: Address, active: Bool)
+    access(all) event AccountUpdated(id: UInt64?, child: Address, parent: Address?, active: Bool)
     /// OwnedAccount added/removed or sealed
     ///     active && owner != nil  : added to Manager 
     ///     !active && owner == nil : removed from Manager
-    pub event OwnershipUpdated(id: UInt64, child: Address, previousOwner: Address?, owner: Address?, active: Bool)
+    access(all) event OwnershipUpdated(id: UInt64, child: Address, previousOwner: Address?, owner: Address?, active: Bool)
     /// ChildAccount ready to be redeemed by emitted pendingParent
-    pub event ChildAccountPublished(
+    access(all) event ChildAccountPublished(
         ownedAcctID: UInt64,
         childAcctID: UInt64,
         capDelegatorID: UInt64,
@@ -70,49 +76,52 @@ pub contract HybridCustody {
         pendingParent: Address
     )
     /// OwnedAccount granted ownership to a new address, publishing a Capability for the pendingOwner
-    pub event OwnershipGranted(ownedAcctID: UInt64, child: Address, previousOwner: Address?, pendingOwner: Address)
+    access(all) event OwnershipGranted(ownedAcctID: UInt64, child: Address, previousOwner: Address?, pendingOwner: Address)
     /// Account has been sealed - keys revoked, new AuthAccount Capability generated
-    pub event AccountSealed(id: UInt64, address: Address, parents: [Address])
+    access(all) event AccountSealed(id: UInt64, address: Address, parents: [Address])
 
     /// An OwnedAccount shares the BorrowableAccount capability to itelf with ChildAccount resources
     ///
-    pub resource interface BorrowableAccount {
-        access(contract) fun borrowAccount(): &AuthAccount
-        pub fun check(): Bool
+    access(all) resource interface BorrowableAccount {
+        access(contract) view fun _borrowAccount(): auth(Storage, Contracts, Keys, Inbox, Capabilities) &Account
+        access(all) view fun check(): Bool
     }
 
     /// Public methods anyone can call on an OwnedAccount
     ///
-    pub resource interface OwnedAccountPublic {
+    access(all) resource interface OwnedAccountPublic {
         /// Returns the addresses of all parent accounts
-        pub fun getParentAddresses(): [Address]
+        access(all) view fun getParentAddresses(): [Address]
 
         /// Returns associated parent addresses and their redeemed status - true if redeemed, false if pending
-        pub fun getParentStatuses(): {Address: Bool}
+        access(all) view fun getParentStatuses(): {Address: Bool}
 
         /// Returns true if the given address is a parent of this child and has redeemed it. Returns false if the given
         /// address is a parent of this child and has NOT redeemed it. Returns nil if the given address it not a parent
         /// of this child account.
-        pub fun getRedeemedStatus(addr: Address): Bool?
+        access(all) view fun getRedeemedStatus(addr: Address): Bool?
 
         /// A callback function to mark a parent as redeemed on the child account.
         access(contract) fun setRedeemed(_ addr: Address)
+
+        /// A helper function to find what controller Id to ask for if you are looking for a specific type of capability
+        access(all) view fun getControllerIDForType(type: Type, forPath: StoragePath): UInt64?
     }
 
     /// Private interface accessible to the owner of the OwnedAccount
     ///
-    pub resource interface OwnedAccountPrivate {
+    access(all) resource interface OwnedAccountPrivate {
         /// Deletes the ChildAccount resource being used to share access to this OwnedAccount with the supplied parent
         /// address, and unlinks the paths it was using to reach the underlying account.
-        pub fun removeParent(parent: Address): Bool
+        access(Owner | Remove) fun removeParent(parent: Address): Bool
 
         /// Sets up a new ChildAccount resource for the given parentAddress to redeem. This child account uses the
         /// supplied factory and filter to manage what can be obtained from the child account, and a new
         /// CapabilityDelegator resource is created for the sharing of one-off capabilities. Each of these pieces of
         /// access control are managed through the child account.
-        pub fun publishToParent(
+        access(Publish | Owner) fun publishToParent(
             parentAddress: Address,
-            factory: Capability<&CapabilityFactory.Manager{CapabilityFactory.Getter}>,
+            factory: Capability<&{CapabilityFactory.Getter}>,
             filter: Capability<&{CapabilityFilter.Filter}>
         ) {
             pre {
@@ -124,7 +133,7 @@ pub contract HybridCustody {
         /// Passes ownership of this child account to the given address. Once executed, all active keys on the child
         /// account will be revoked, and the active AuthAccount Capability being used by to obtain capabilities will be
         /// rotated, preventing anyone without the newly generated Capability from gaining access to the account.
-        pub fun giveOwnership(to: Address)
+        access(Owner) fun giveOwnership(to: Address)
 
         /// Revokes all keys on an account, unlinks all currently active AuthAccount capabilities, then makes a new one
         /// and replaces the OwnedAccount's underlying AuthAccount Capability with the new one to ensure that all
@@ -132,12 +141,12 @@ pub contract HybridCustody {
         /// Unless this method is executed via the giveOwnership function, this will leave an account **without** an
         /// owner.
         /// USE WITH EXTREME CAUTION.
-        pub fun seal()
+        access(Owner) fun seal()
 
         // setCapabilityFactoryForParent
         // Override the existing CapabilityFactory Capability for a given parent. This will allow the owner of the
         // account to start managing their own factory of capabilities to be able to retrieve
-        pub fun setCapabilityFactoryForParent(parent: Address, cap: Capability<&CapabilityFactory.Manager{CapabilityFactory.Getter}>) {
+        access(Owner) fun setCapabilityFactoryForParent(parent: Address, cap: Capability<&{CapabilityFactory.Getter}>) {
             pre {
                 cap.check(): "Invalid CapabilityFactory.Getter Capability provided"
             }
@@ -145,7 +154,7 @@ pub contract HybridCustody {
 
         /// Override the existing CapabilityFilter Capability for a given parent. This will allow the owner of the
         /// account to start managing their own filter for retrieving Capabilities on Private Paths
-        pub fun setCapabilityFilterForParent(parent: Address, cap: Capability<&{CapabilityFilter.Filter}>) {
+        access(Owner) fun setCapabilityFilterForParent(parent: Address, cap: Capability<&{CapabilityFilter.Filter}>) {
             pre {
                 cap.check(): "Invalid CapabilityFilter Capability provided"
             }
@@ -153,66 +162,67 @@ pub contract HybridCustody {
 
         /// Adds a capability to a parent's managed @ChildAccount resource. The Capability can be made public,
         /// permitting anyone to borrow it.
-        pub fun addCapabilityToDelegator(parent: Address, cap: Capability, isPublic: Bool) {
+        access(Owner) fun addCapabilityToDelegator(parent: Address, cap: Capability, isPublic: Bool) {
             pre {
                 cap.check<&AnyResource>(): "Invalid Capability provided"
             }
         }
 
         /// Removes a Capability from the CapabilityDelegator used by the specified parent address
-        pub fun removeCapabilityFromDelegator(parent: Address, cap: Capability)
+        access(Owner) fun removeCapabilityFromDelegator(parent: Address, cap: Capability)
 
         /// Returns the address of this OwnedAccount
-        pub fun getAddress(): Address
+        access(all) view fun getAddress(): Address
         
         /// Checks if this OwnedAccount is a child of the specified address
-        pub fun isChildOf(_ addr: Address): Bool
+        access(all) view fun isChildOf(_ addr: Address): Bool
 
         /// Returns all addresses which are parents of this OwnedAccount
-        pub fun getParentAddresses(): [Address]
+        access(all) view fun getParentAddresses(): [Address]
 
         /// Borrows this OwnedAccount's AuthAccount Capability
-        pub fun borrowAccount(): &AuthAccount?
+        access(Owner) view fun borrowAccount(): auth(Storage, Contracts, Keys, Inbox, Capabilities) &Account
 
         /// Returns the current owner of this account, if there is one
-        pub fun getOwner(): Address?
+        access(all) view fun getOwner(): Address?
 
         /// Returns the pending owner of this account, if there is one
-        pub fun getPendingOwner(): Address?
+        access(all) view fun getPendingOwner(): Address?
 
         /// A callback which is invoked when a parent redeems an owned account
         access(contract) fun setOwnerCallback(_ addr: Address)
         
         /// Destroys all outstanding AuthAccount capabilities on this owned account, and creates a new one for the
         /// OwnedAccount to use
-        pub fun rotateAuthAccount()
+        access(Owner) fun rotateAuthAccount()
 
         /// Revokes all keys on this account
-        pub fun revokeAllKeys()
+        access(Owner) fun revokeAllKeys()
     }
 
     /// Public methods exposed on a ChildAccount resource. OwnedAccountPublic will share some methods here, but isn't
     /// necessarily the same.
     ///
-    pub resource interface AccountPublic {
-        pub fun getPublicCapability(path: PublicPath, type: Type): Capability?
-        pub fun getPublicCapFromDelegator(type: Type): Capability?
-        pub fun getAddress(): Address
+    access(all) resource interface AccountPublic {
+        access(all) view fun getPublicCapability(path: PublicPath, type: Type): Capability?
+        access(all) view fun getPublicCapFromDelegator(type: Type): Capability?
+        access(all) view fun getAddress(): Address
+        access(all) view fun getCapabilityFactoryManager(): &{CapabilityFactory.Getter}?
+        access(all) view fun getCapabilityFilter(): &{CapabilityFilter.Filter}?
+        access(all) view fun getControllerIDForType(type: Type, forPath: StoragePath): UInt64?
     }
 
     /// Methods accessible to the designated parent of a ChildAccount
     ///
-    pub resource interface AccountPrivate {
-        pub fun getCapability(path: CapabilityPath, type: Type): Capability? {
+    access(all) resource interface AccountPrivate {
+        access(Child) view fun getCapability(controllerID: UInt64, type: Type): Capability? {
             post {
                 result == nil || [true, nil].contains(self.getManagerCapabilityFilter()?.allowed(cap: result!)):
                     "Capability is not allowed by this account's Parent"
             }
         }
-        pub fun getPublicCapability(path: PublicPath, type: Type): Capability?
-        pub fun getManagerCapabilityFilter():  &{CapabilityFilter.Filter}?
-        pub fun getPublicCapFromDelegator(type: Type): Capability?
-        pub fun getPrivateCapFromDelegator(type: Type): Capability? {
+        access(all) view fun getManagerCapabilityFilter():  &{CapabilityFilter.Filter}?
+        access(Child) view fun getPrivateCapFromDelegator(type: Type): Capability? {
             post {
                 result == nil || [true, nil].contains(self.getManagerCapabilityFilter()?.allowed(cap: result!)):
                     "Capability is not allowed by this account's Parent"
@@ -229,14 +239,14 @@ pub contract HybridCustody {
 
     /// Entry point for a parent to obtain, maintain and access Capabilities or perform other actions on child accounts
     ///
-    pub resource interface ManagerPrivate {
-        pub fun addAccount(cap: Capability<&{AccountPrivate, AccountPublic, MetadataViews.Resolver}>)
-        pub fun borrowAccount(addr: Address): &{AccountPrivate, AccountPublic, MetadataViews.Resolver}?
-        pub fun removeChild(addr: Address)
-        pub fun addOwnedAccount(cap: Capability<&{OwnedAccountPrivate, OwnedAccountPublic, MetadataViews.Resolver}>)
-        pub fun borrowOwnedAccount(addr: Address): &{OwnedAccountPrivate, OwnedAccountPublic, MetadataViews.Resolver}?
-        pub fun removeOwned(addr: Address)
-        pub fun setManagerCapabilityFilter(cap: Capability<&{CapabilityFilter.Filter}>?, childAddress: Address) {
+    access(all) resource interface ManagerPrivate {
+        access(Manage) fun addAccount(cap: Capability<auth(Child) &{AccountPrivate, AccountPublic, ViewResolver.Resolver}>)
+        access(Manage) fun borrowAccount(addr: Address): auth(Child) &{AccountPrivate, AccountPublic, ViewResolver.Resolver}?
+        access(Manage) fun removeChild(addr: Address)
+        access(Manage) fun addOwnedAccount(cap: Capability<auth(Owner) &{OwnedAccountPrivate, OwnedAccountPublic, ViewResolver.Resolver}>)
+        access(Manage) fun borrowOwnedAccount(addr: Address): auth(Owner) &{OwnedAccountPrivate, OwnedAccountPublic, ViewResolver.Resolver}?
+        access(Manage) fun removeOwned(addr: Address)
+        access(Manage) fun setManagerCapabilityFilter(cap: Capability<&{CapabilityFilter.Filter}>?, childAddress: Address) {
             pre {
                 cap == nil || cap!.check(): "Invalid Manager Capability Filter"
             }
@@ -245,39 +255,40 @@ pub contract HybridCustody {
 
     /// Functions anyone can call on a manager to get information about an account such as What child accounts it has
     /// Functions anyone can call on a manager to get information about an account such as what child accounts it has
-    pub resource interface ManagerPublic {
-        pub fun borrowAccountPublic(addr: Address): &{AccountPublic, MetadataViews.Resolver}?
-        pub fun getChildAddresses(): [Address]
-        pub fun getOwnedAddresses(): [Address]
-        pub fun getChildAccountDisplay(address: Address): MetadataViews.Display?
+    access(all) resource interface ManagerPublic {
+        access(all) fun borrowAccountPublic(addr: Address): &{AccountPublic, ViewResolver.Resolver}?
+        access(all) fun getChildAddresses(): [Address]
+        access(all) fun getOwnedAddresses(): [Address]
+        access(all) fun getChildAccountDisplay(address: Address): MetadataViews.Display?
         access(contract) fun removeParentCallback(child: Address)
     }
 
     /// A resource for an account which fills the Parent role of the Child-Parent account management Model. A Manager
     /// can redeem or remove child accounts, and obtain any capabilities exposed by the child account to them.
     ///
-    pub resource Manager: ManagerPrivate, ManagerPublic, MetadataViews.Resolver {
+    access(all) resource Manager: ManagerPrivate, ManagerPublic, ViewResolver.Resolver, Burner.Burnable {
+        access(all) event ResourceDestroyed(uuid: UInt64 = self.uuid)
 
         /// Mapping of restricted access child account Capabilities indexed by their address
-        pub let childAccounts: {Address: Capability<&{AccountPrivate, AccountPublic, MetadataViews.Resolver}>}
+        access(self) let childAccounts: {Address: Capability<auth(Child) &{AccountPrivate, AccountPublic, ViewResolver.Resolver}>}
         /// Mapping of unrestricted owned account Capabilities indexed by their address
-        pub let ownedAccounts: {Address: Capability<&{OwnedAccountPrivate, OwnedAccountPublic, MetadataViews.Resolver}>}
+        access(self) let ownedAccounts: {Address: Capability<auth(Owner) &{OwnedAccountPrivate, OwnedAccountPublic, ViewResolver.Resolver}>}
 
         /// A bucket of structs so that the Manager resource can be easily extended with new functionality.
-        pub let data: {String: AnyStruct}
+        access(self) let data: {String: AnyStruct}
         /// A bucket of resources so that the Manager resource can be easily extended with new functionality.
-        pub let resources: @{String: AnyResource}
+        access(self) let resources: @{String: AnyResource}
 
         /// An optional filter to gate what capabilities are permitted to be returned from a child account For example,
         /// Dapper Wallet parent account's should not be able to retrieve any FungibleToken Provider capabilities.
-        pub var filter: Capability<&{CapabilityFilter.Filter}>?
+        access(self) var filter: Capability<&{CapabilityFilter.Filter}>?
 
         // display metadata for a child account exists on its parent
-        pub let childAccountDisplays: {Address: MetadataViews.Display}
+        access(self) let childAccountDisplays: {Address: MetadataViews.Display}
 
         /// Sets the Display on the ChildAccount. If nil, the display is removed.
         ///
-        pub fun setChildAccountDisplay(address: Address, _ d: MetadataViews.Display?) {
+        access(Manage) fun setChildAccountDisplay(address: Address, _ d: MetadataViews.Display?) {
             pre {
                 self.childAccounts[address] != nil: "There is no child account with this address"
             }
@@ -293,7 +304,7 @@ pub contract HybridCustody {
         /// Adds a ChildAccount Capability to this Manager. If a default Filter is set in the manager, it will also be
         /// added to the ChildAccount
         ///
-        pub fun addAccount(cap: Capability<&{AccountPrivate, AccountPublic, MetadataViews.Resolver}>) {
+        access(Manage) fun addAccount(cap: Capability<auth(Child) &{AccountPrivate, AccountPublic, ViewResolver.Resolver}>) {
             pre {
                 self.childAccounts[cap.address] == nil: "There is already a child account with this address"
             }
@@ -311,17 +322,17 @@ pub contract HybridCustody {
 
         /// Sets the default Filter Capability for this Manager. Does not propagate to child accounts.
         ///
-        pub fun setDefaultManagerCapabilityFilter(cap: Capability<&{CapabilityFilter.Filter}>?) {
+        access(Manage) fun setDefaultManagerCapabilityFilter(cap: Capability<&{CapabilityFilter.Filter}>?) {
             pre {
                 cap == nil || cap!.check(): "supplied capability must be nil or check must pass"
             }
 
             self.filter = cap
         }
-        
+
         /// Sets the Filter Capability for this Manager, propagating to the specified child account
         ///
-        pub fun setManagerCapabilityFilter(cap: Capability<&{CapabilityFilter.Filter}>?, childAddress: Address) {
+        access(Manage) fun setManagerCapabilityFilter(cap: Capability<&{CapabilityFilter.Filter}>?, childAddress: Address) {
             let acct = self.borrowAccount(addr: childAddress) 
                 ?? panic("child account not found")
 
@@ -331,7 +342,7 @@ pub contract HybridCustody {
         /// Removes specified child account from the Manager's child accounts. Callbacks to the child account remove
         /// any associated resources and Capabilities
         ///
-        pub fun removeChild(addr: Address) {
+        access(Manage) fun removeChild(addr: Address) {
             let cap = self.childAccounts.remove(key: addr)
                 ?? panic("child account not found")
 
@@ -347,9 +358,11 @@ pub contract HybridCustody {
             // Get the child account id before removing capability
             let id: UInt64 = acct.uuid
 
-            acct.parentRemoveChildCallback(parent: self.owner!.address) 
+            if self.owner != nil {
+                acct.parentRemoveChildCallback(parent: self.owner!.address) 
+            }
 
-            emit AccountUpdated(id: id, child: cap.address, parent: self.owner!.address, active: false)
+            emit AccountUpdated(id: id, child: cap.address, parent: self.owner?.address, active: false)
         }
 
         /// Contract callback that removes a child account from the Manager's child accounts in the event a child
@@ -363,7 +376,7 @@ pub contract HybridCustody {
         /// Adds an owned account to the Manager's list of owned accounts, setting the Manager account as the owner of
         /// the given account
         ///
-        pub fun addOwnedAccount(cap: Capability<&{OwnedAccountPrivate, OwnedAccountPublic, MetadataViews.Resolver}>) {
+        access(Manage) fun addOwnedAccount(cap: Capability<auth(Owner) &{OwnedAccountPrivate, OwnedAccountPublic, ViewResolver.Resolver}>) {
             pre {
                 self.ownedAccounts[cap.address] == nil: "There is already an owned account with this address"
             }
@@ -384,7 +397,7 @@ pub contract HybridCustody {
 
         /// Returns a reference to a child account
         ///
-        pub fun borrowAccount(addr: Address): &{AccountPrivate, AccountPublic, MetadataViews.Resolver}? {
+        access(Manage) fun borrowAccount(addr: Address): auth(Child) &{AccountPrivate, AccountPublic, ViewResolver.Resolver}? {
             let cap = self.childAccounts[addr]
             if cap == nil {
                 return nil
@@ -395,7 +408,7 @@ pub contract HybridCustody {
 
         /// Returns a reference to a child account's public AccountPublic interface
         ///
-        pub fun borrowAccountPublic(addr: Address): &{AccountPublic, MetadataViews.Resolver}? {
+        access(all) fun borrowAccountPublic(addr: Address): &{AccountPublic, ViewResolver.Resolver}? {
             let cap = self.childAccounts[addr]
             if cap == nil {
                 return nil
@@ -406,7 +419,7 @@ pub contract HybridCustody {
 
         /// Returns a reference to an owned account
         ///
-        pub fun borrowOwnedAccount(addr: Address): &{OwnedAccountPrivate, OwnedAccountPublic, MetadataViews.Resolver}? {
+        access(Manage) fun borrowOwnedAccount(addr: Address): auth(Owner) &{OwnedAccountPrivate, OwnedAccountPublic, ViewResolver.Resolver}? {
             if let cap = self.ownedAccounts[addr] {
                 return cap.borrow()
             }
@@ -417,7 +430,7 @@ pub contract HybridCustody {
         /// Removes specified child account from the Manager's child accounts. Callbacks to the child account remove
         /// any associated resources and Capabilities
         ///
-        pub fun removeOwned(addr: Address) {
+        access(Manage) fun removeOwned(addr: Address) {
             if let acct = self.ownedAccounts.remove(key: addr) {
                 if acct.check() {
                     acct.borrow()!.seal()
@@ -437,7 +450,7 @@ pub contract HybridCustody {
         /// mechanism intended to easily transfer 'root' access on this account to another account and an attempt to
         /// minimize access vectors.
         ///
-        pub fun giveOwnership(addr: Address, to: Address) {
+        access(Manage) fun giveOwnership(addr: Address, to: Address) {
             let acct = self.ownedAccounts.remove(key: addr)
                 ?? panic("account not found")
 
@@ -446,31 +459,31 @@ pub contract HybridCustody {
 
         /// Returns an array of child account addresses
         ///
-        pub fun getChildAddresses(): [Address] {
+        access(all) view fun getChildAddresses(): [Address] {
             return self.childAccounts.keys
         }
 
         /// Returns an array of owned account addresses
         ///
-        pub fun getOwnedAddresses(): [Address] {
+        access(all) view fun getOwnedAddresses(): [Address] {
             return self.ownedAccounts.keys
         }
 
         /// Retrieves the parent-defined display for the given child account
         ///
-        pub fun getChildAccountDisplay(address: Address): MetadataViews.Display? {
+        access(all) view fun getChildAccountDisplay(address: Address): MetadataViews.Display? {
             return self.childAccountDisplays[address]
         }
 
         /// Returns the types of supported views - none at this time
         ///
-        pub fun getViews(): [Type] {
+        access(all) view fun getViews(): [Type] {
             return []
         }
 
         /// Resolves the given view if supported - none at this time
         ///
-        pub fun resolveView(_ view: Type): AnyStruct? {
+        access(all) view fun resolveView(_ view: Type): AnyStruct? {
             return nil
         }
 
@@ -487,8 +500,19 @@ pub contract HybridCustody {
             self.resources <- {}
         }
 
-        destroy () {
-            destroy self.resources
+        // When a manager resource is destroyed, attempt to remove this parent from every
+        // child account it currently has
+        //
+        // Destruction will fail if there are any owned account to prevent loss of access to an account
+        access(contract) fun burnCallback() {
+            pre {
+                // Prevent accidental burning of a resource that has ownership of other accounts
+                self.ownedAccounts.length == 0: "cannot destroy a manager with owned accounts"
+            }
+
+            for c in self.childAccounts.keys {
+                self.removeChild(addr: c)
+            }
         }
     }
 
@@ -501,27 +525,29 @@ pub contract HybridCustody {
     /// able to manage all ChildAccount resources it shares, without worrying about whether the upstream parent can do
     /// anything to prevent it.
     /// 
-    pub resource ChildAccount: AccountPrivate, AccountPublic, MetadataViews.Resolver {
+    access(all) resource ChildAccount: AccountPrivate, AccountPublic, ViewResolver.Resolver, Burner.Burnable {
+        access(all) event ResourceDestroyed(uuid: UInt64 = self.uuid, address: Address = self.childCap.address, parent: Address = self.parent)
+
         /// A Capability providing access to the underlying child account
-        access(self) let childCap: Capability<&{BorrowableAccount, OwnedAccountPublic, MetadataViews.Resolver}>
+        access(self) let childCap: Capability<&{BorrowableAccount, OwnedAccountPublic, ViewResolver.Resolver}>
 
         /// The CapabilityFactory Manager is a ChildAccount's way of limiting what types can be asked for by its parent
         /// account. The CapabilityFactory returns Capabilities which can be casted to their appropriate types once
         /// obtained, but only if the child account has configured their factory to allow it. For instance, a
         /// ChildAccount might choose to expose NonFungibleToken.Provider, but not FungibleToken.Provider
-        pub var factory: Capability<&CapabilityFactory.Manager{CapabilityFactory.Getter}>
+        access(self) var factory: Capability<&{CapabilityFactory.Getter}>
 
         /// The CapabilityFilter is a restriction put at the front of obtaining any non-public Capability. Some wallets
         /// might want to give access to NonFungibleToken.Provider, but only to **some** of the collections it manages,
         /// not all of them.
-        pub var filter: Capability<&{CapabilityFilter.Filter}>
+        access(self) var filter: Capability<&{CapabilityFilter.Filter}>
 
         /// The CapabilityDelegator is a way to share one-off capabilities from the child account. These capabilities
         /// can be public OR private and are separate from the factory which returns a capability at a given path as a 
         /// certain type. When using the CapabilityDelegator, you do not have the ability to specify which path a
         /// capability came from. For instance, Dapper Wallet might choose to expose a Capability to their Full TopShot
         /// collection, but only to the path that the collection exists in.
-        pub let delegator: Capability<&CapabilityDelegator.Delegator{CapabilityDelegator.GetterPublic, CapabilityDelegator.GetterPrivate}>
+        access(self) let delegator: Capability<auth(Capabilities) &{CapabilityDelegator.GetterPublic, CapabilityDelegator.GetterPrivate}>
 
         /// managerCapabilityFilter is a component optionally given to a child account when a manager redeems it. If
         /// this filter is not nil, any Capability returned through the `getCapability` function checks that the
@@ -536,11 +562,11 @@ pub contract HybridCustody {
 
         /// ChildAccount resources have a 1:1 association with parent accounts, the named parent Address here is the 
         /// one with a Capability on this resource.
-        pub let parent: Address
+        access(all) let parent: Address
 
         /// Returns the Address of the underlying child account
         ///
-        pub fun getAddress(): Address {
+        access(all) view fun getAddress(): Address {
             return self.childCap.address
         }
 
@@ -560,24 +586,24 @@ pub contract HybridCustody {
 
         /// Sets the CapabiltyFactory.Manager Capability
         ///
-        pub fun setCapabilityFactory(cap: Capability<&CapabilityFactory.Manager{CapabilityFactory.Getter}>) {
+        access(contract) fun setCapabilityFactory(cap: Capability<&{CapabilityFactory.Getter}>) {
             self.factory = cap
         }
  
         /// Sets the Filter Capability as the one provided
         ///
-        pub fun setCapabilityFilter(cap: Capability<&{CapabilityFilter.Filter}>) {
+        access(contract) fun setCapabilityFilter(cap: Capability<&{CapabilityFilter.Filter}>) {
             self.filter = cap
         }
 
         /// The main function to a child account's capabilities from a parent account. When a PrivatePath type is used,
         /// the CapabilityFilter will be borrowed and the Capability being returned will be checked against it to
-        /// ensure that borrowing is permitted.
+        /// ensure that borrowing is permitted. If not allowed, nil is returned.
         /// Also know that this method retrieves Capabilities via the CapabilityFactory path. To retrieve arbitrary 
         /// Capabilities, see `getPrivateCapFromDelegator()` and `getPublicCapFromDelegator()` which use the
         /// `Delegator` retrieval path.
         ///
-        pub fun getCapability(path: CapabilityPath, type: Type): Capability? {
+        access(Child) view fun getCapability(controllerID: UInt64, type: Type): Capability? {
             let child = self.childCap.borrow() ?? panic("failed to borrow child account")
 
             let f = self.factory.borrow()!.getFactory(type)
@@ -585,12 +611,17 @@ pub contract HybridCustody {
                 return nil
             }
 
-            let acct = child.borrowAccount()
+            let acct = child._borrowAccount()
+            let tmp = f!.getCapability(acct: acct, controllerID: controllerID)
+            if tmp == nil {
+                return nil
+            }
 
-            let cap = f!.getCapability(acct: acct, path: path)
-            
-            if path.getType() == Type<PrivatePath>() {
-                assert(self.filter.borrow()!.allowed(cap: cap), message: "requested capability is not allowed")
+            let cap = tmp!
+            // Check that private capabilities are allowed by either internal or manager filter (if assigned)
+            // If not allowed, return nil
+            if self.filter.borrow()!.allowed(cap: cap) == false || (self.getManagerCapabilityFilter()?.allowed(cap: cap) ?? true) == false {
+                return nil
             }
 
             return cap
@@ -599,7 +630,7 @@ pub contract HybridCustody {
         /// Retrieves a private Capability from the Delegator or nil none is found of the given type. Useful for
         /// arbitrary Capability retrieval
         ///
-        pub fun getPrivateCapFromDelegator(type: Type): Capability? {
+        access(Child) view fun getPrivateCapFromDelegator(type: Type): Capability? {
             if let d = self.delegator.borrow() {
                 return d.getPrivateCapability(type)
             }
@@ -610,7 +641,7 @@ pub contract HybridCustody {
         /// Retrieves a public Capability from the Delegator or nil none is found of the given type. Useful for
         /// arbitrary Capability retrieval
         ///
-        pub fun getPublicCapFromDelegator(type: Type): Capability? {
+        access(all) view fun getPublicCapFromDelegator(type: Type): Capability? {
             if let d = self.delegator.borrow() {
                 return d.getPublicCapability(type)
             }
@@ -620,37 +651,43 @@ pub contract HybridCustody {
         /// Enables retrieval of public Capabilities of the given type from the specified path or nil if none is found.
         /// Callers should be aware this method uses the `CapabilityFactory` retrieval path.
         ///
-        pub fun getPublicCapability(path: PublicPath, type: Type): Capability? {
-            return self.getCapability(path: path, type: type)
+        access(all) view fun getPublicCapability(path: PublicPath, type: Type): Capability? {
+            let child = self.childCap.borrow() ?? panic("failed to borrow child account")
+
+            let f = self.factory.borrow()!.getFactory(type)
+            if f == nil {
+                return nil
+            }
+
+            let acct = child._borrowAccount()
+            return f!.getPublicCapability(acct: acct, path: path)
         }
 
         /// Returns a reference to the stored managerCapabilityFilter if one exists
         ///
-        pub fun getManagerCapabilityFilter():  &{CapabilityFilter.Filter}? {
+        access(all) view fun getManagerCapabilityFilter(): &{CapabilityFilter.Filter}? {
             return self.managerCapabilityFilter != nil ? self.managerCapabilityFilter!.borrow() : nil
         }
 
         /// Sets the child account as redeemed by the given Address
         ///
         access(contract) fun setRedeemed(_ addr: Address) {
-            let acct = self.childCap.borrow()!.borrowAccount()
-            if let o = acct.borrow<&OwnedAccount>(from: HybridCustody.OwnedAccountStoragePath) {
-                o.setRedeemed(addr)
-            }
+            let acct = self.childCap.borrow()!._borrowAccount()
+            acct.storage.borrow<&OwnedAccount>(from: HybridCustody.OwnedAccountStoragePath)?.setRedeemed(addr)
         }
 
         /// Returns a reference to the stored delegator, generally used for arbitrary Capability retrieval
         ///
-        pub fun borrowCapabilityDelegator(): &CapabilityDelegator.Delegator? {
+        access(Owner) fun borrowCapabilityDelegator(): auth(Capabilities) &CapabilityDelegator.Delegator? {
             let path = HybridCustody.getCapabilityDelegatorIdentifier(self.parent)
-            return self.childCap.borrow()!.borrowAccount().borrow<&CapabilityDelegator.Delegator>(
+            return self.childCap.borrow()!._borrowAccount().storage.borrow<auth(Capabilities) &CapabilityDelegator.Delegator>(
                 from: StoragePath(identifier: path)!
             )
         }
 
         /// Returns a list of supported metadata views
         ///
-        pub fun getViews(): [Type] {
+        access(all) view fun getViews(): [Type] {
             return [
                 Type<MetadataViews.Display>()
             ]
@@ -658,17 +695,22 @@ pub contract HybridCustody {
 
         /// Resolves a view of the given type if supported
         ///
-        pub fun resolveView(_ view: Type): AnyStruct? {
+        access(all) fun resolveView(_ view: Type): AnyStruct? {
             switch view {
                 case Type<MetadataViews.Display>():
                     let childAddress = self.getAddress()
-                    let manager = getAccount(self.parent).getCapability<&HybridCustody.Manager{HybridCustody.ManagerPublic}>(HybridCustody.ManagerPublicPath)
+                    let tmp = getAccount(self.parent).capabilities.get<&{HybridCustody.ManagerPublic}>(HybridCustody.ManagerPublicPath)
+                    if tmp == nil {
+                        return nil
+                    }
+
+                    let manager = tmp!
 
                     if !manager.check() {
                         return nil
                     }
 
-                    return manager!.borrow()!.getChildAccountDisplay(address: childAddress)
+                    return manager.borrow()!.getChildAccountDisplay(address: childAddress)
             }
             return nil
         }
@@ -681,22 +723,22 @@ pub contract HybridCustody {
                 return
             }
 
-            let child: &AnyResource{HybridCustody.BorrowableAccount} = self.childCap.borrow()!
+            let child: &{HybridCustody.BorrowableAccount} = self.childCap.borrow()!
             if !child.check() {
                 return
             }
 
-            let acct = child.borrowAccount()
-            if let ownedAcct = acct.borrow<&OwnedAccount>(from: HybridCustody.OwnedAccountStoragePath) {
+            let acct = child._borrowAccount()
+            if let ownedAcct = acct.storage.borrow<auth(Owner) &OwnedAccount>(from: HybridCustody.OwnedAccountStoragePath) {
                 ownedAcct.removeParent(parent: parent)
             }
         }
 
         init(
-            _ childCap: Capability<&{BorrowableAccount, OwnedAccountPublic, MetadataViews.Resolver}>,
-            _ factory: Capability<&CapabilityFactory.Manager{CapabilityFactory.Getter}>,
+            _ childCap: Capability<&{BorrowableAccount, OwnedAccountPublic, ViewResolver.Resolver}>,
+            _ factory: Capability<&{CapabilityFactory.Getter}>,
             _ filter: Capability<&{CapabilityFilter.Filter}>,
-            _ delegator: Capability<&CapabilityDelegator.Delegator{CapabilityDelegator.GetterPublic, CapabilityDelegator.GetterPrivate}>,
+            _ delegator: Capability<auth(Capabilities) &{CapabilityDelegator.GetterPublic, CapabilityDelegator.GetterPrivate}>,
             _ parent: Address
         ) {
             pre {
@@ -716,8 +758,30 @@ pub contract HybridCustody {
             self.resources <- {}
         }
 
-        destroy () {
-            destroy <- self.resources
+        /// Returns a capability to this child account's CapabilityFilter
+        ///
+        access(all) view fun getCapabilityFilter(): &{CapabilityFilter.Filter}? {
+            return self.filter.check() ? self.filter.borrow() : nil
+        }
+
+        /// Returns a capability to this child account's CapabilityFactory
+        ///
+        access(all) view fun getCapabilityFactoryManager(): &{CapabilityFactory.Getter}? {
+            return self.factory.check() ? self.factory.borrow() : nil
+        }
+
+        access(all) view fun getControllerIDForType(type: Type, forPath: StoragePath): UInt64? {
+            let child = self.childCap.borrow()
+            if child == nil {
+                return nil
+            }
+
+            return child!.getControllerIDForType(type: type, forPath: forPath)
+        }
+
+        // When a ChildAccount is destroyed, attempt to remove it from the parent account as well
+        access(contract) fun burnCallback() {
+            self.parentRemoveChildCallback(parent: self.parent)
         }
     }
 
@@ -730,18 +794,19 @@ pub contract HybridCustody {
     /// accounts would still exist, allowing a form of Hybrid Custody which has no true owner over an account, but
     /// shared partial ownership.
     ///
-    pub resource OwnedAccount: OwnedAccountPrivate, BorrowableAccount, OwnedAccountPublic, MetadataViews.Resolver {
+    access(all) resource OwnedAccount: OwnedAccountPrivate, BorrowableAccount, OwnedAccountPublic, ViewResolver.Resolver, Burner.Burnable {
+        access(all) event ResourceDestroyed(uuid: UInt64 = self.uuid, addr: Address = self.acct.address)
         /// Capability on the underlying account object
-        access(self) var acct: Capability<&AuthAccount>
+        access(self) var acct: Capability<auth(Storage, Contracts, Keys, Inbox, Capabilities) &Account>
 
         /// Mapping of current and pending parents, true and false respectively
-        pub let parents: {Address: Bool}
+        access(all) let parents: {Address: Bool}
         /// Address of the pending owner, if one exists
-        pub var pendingOwner: Address?
+        access(all) var pendingOwner: Address?
         /// Address of the current owner, if one exists
-        pub var acctOwner: Address?
+        access(all) var acctOwner: Address?
         /// Owned status of this account
-        pub var currentlyOwned: Bool
+        access(all) var currentlyOwned: Bool
 
         /// A bucket of structs so that the OwnedAccount resource can be easily extended with new functionality.
         access(self) let data: {String: AnyStruct}
@@ -792,12 +857,12 @@ pub contract HybridCustody {
         /// 4. Publish the newly made private link to the designated parent's inbox for them to claim on their @Manager
         ///    resource.
         ///
-        pub fun publishToParent(
+        access(Publish | Owner) fun publishToParent(
             parentAddress: Address,
-            factory: Capability<&CapabilityFactory.Manager{CapabilityFactory.Getter}>,
+            factory: Capability<&{CapabilityFactory.Getter}>,
             filter: Capability<&{CapabilityFilter.Filter}>
         ) {
-            pre{
+            pre {
                 self.parents[parentAddress] == nil: "Address pending or already redeemed as parent"
             }
             let capDelegatorIdentifier = HybridCustody.getCapabilityDelegatorIdentifier(parentAddress)
@@ -808,41 +873,32 @@ pub contract HybridCustody {
             let capDelegatorStorage = StoragePath(identifier: capDelegatorIdentifier)!
             let acct = self.borrowAccount()
 
-            assert(acct.borrow<&AnyResource>(from: capDelegatorStorage) == nil, message: "conflicting resource found in capability delegator storage slot for parentAddress")
-            assert(acct.borrow<&AnyResource>(from: childAccountStorage) == nil, message: "conflicting resource found in child account storage slot for parentAddress")
+            assert(acct.storage.borrow<&AnyResource>(from: capDelegatorStorage) == nil, message: "conflicting resource found in capability delegator storage slot for parentAddress")
+            assert(acct.storage.borrow<&AnyResource>(from: childAccountStorage) == nil, message: "conflicting resource found in child account storage slot for parentAddress")
 
-            if acct.borrow<&CapabilityDelegator.Delegator>(from: capDelegatorStorage) == nil {
+            if acct.storage.borrow<&CapabilityDelegator.Delegator>(from: capDelegatorStorage) == nil {
                 let delegator <- CapabilityDelegator.createDelegator()
-                acct.save(<-delegator, to: capDelegatorStorage)
+                acct.storage.save(<-delegator, to: capDelegatorStorage)
             }
 
             let capDelegatorPublic = PublicPath(identifier: capDelegatorIdentifier)!
-            let capDelegatorPrivate = PrivatePath(identifier: capDelegatorIdentifier)!
+            // let capDelegatorPrivate = PrivatePath(identifier: capDelegatorIdentifier)!
 
-            acct.link<&CapabilityDelegator.Delegator{CapabilityDelegator.GetterPublic}>(
-                capDelegatorPublic,
-                target: capDelegatorStorage
-            )
-            acct.link<&CapabilityDelegator.Delegator{CapabilityDelegator.GetterPublic, CapabilityDelegator.GetterPrivate}>(
-                capDelegatorPrivate,
-                target: capDelegatorStorage
-            )
-            let delegator = acct.getCapability<&CapabilityDelegator.Delegator{CapabilityDelegator.GetterPublic, CapabilityDelegator.GetterPrivate}>(
-                capDelegatorPrivate
-            )
+            let pubCap = acct.capabilities.storage.issue<&{CapabilityDelegator.GetterPublic}>(capDelegatorStorage)
+            acct.capabilities.publish(pubCap, at: capDelegatorPublic)
+
+            let delegator = acct.capabilities.storage.issue<auth(Capabilities) &{CapabilityDelegator.GetterPublic, CapabilityDelegator.GetterPrivate}>(capDelegatorStorage)
             assert(delegator.check(), message: "failed to setup capability delegator for parent address")
 
-            let borrowableCap = self.borrowAccount().getCapability<&{BorrowableAccount, OwnedAccountPublic, MetadataViews.Resolver}>(
-                HybridCustody.OwnedAccountPrivatePath
+            let borrowableCap = self.borrowAccount().capabilities.storage.issue<&{BorrowableAccount, OwnedAccountPublic, ViewResolver.Resolver}>(
+                HybridCustody.OwnedAccountStoragePath
             )
-            let childAcct <- create ChildAccount(borrowableCap, factory, filter, delegator, parentAddress)
 
+            let childAcct <- create ChildAccount(borrowableCap, factory, filter, delegator, parentAddress)
             let childAccountPrivatePath = PrivatePath(identifier: identifier)!
 
-            acct.save(<-childAcct, to: childAccountStorage)
-            acct.link<&ChildAccount{AccountPrivate, AccountPublic, MetadataViews.Resolver}>(childAccountPrivatePath, target: childAccountStorage)
-            
-            let delegatorCap = acct.getCapability<&ChildAccount{AccountPrivate, AccountPublic, MetadataViews.Resolver}>(childAccountPrivatePath)
+            acct.storage.save(<-childAcct, to: childAccountStorage)            
+            let delegatorCap = acct.capabilities.storage.issue<auth(Child) &{AccountPrivate, AccountPublic, ViewResolver.Resolver}>(childAccountStorage)
             assert(delegatorCap.check(), message: "Delegator capability check failed")
 
             acct.inbox.publish(delegatorCap, name: identifier, recipient: parentAddress)
@@ -862,38 +918,43 @@ pub contract HybridCustody {
 
         /// Checks the validity of the encapsulated account Capability
         ///
-        pub fun check(): Bool {
+        access(all) view fun check(): Bool {
             return self.acct.check()
         }
 
         /// Returns a reference to the encapsulated account object
         ///
-        pub fun borrowAccount(): &AuthAccount {
-            return self.acct.borrow()!
+        access(Owner) view fun borrowAccount(): auth(Storage, Contracts, Keys, Inbox, Capabilities) &Account {
+            return self.acct.borrow() ?? panic("unable to borrow Account Capability")
+        }
+
+        // Used internally so that child account resources are able to borrow their underlying Account reference
+        access(contract) view fun _borrowAccount(): auth(Storage, Contracts, Keys, Inbox, Capabilities) &Account {
+            return self.borrowAccount()
         }
 
         /// Returns the addresses of all associated parents pending and active
         ///
-        pub fun getParentAddresses(): [Address] {
+        access(all) view fun getParentAddresses(): [Address] {
             return self.parents.keys
         }
 
         /// Returns whether the given address is a parent of this account
         ///
-        pub fun isChildOf(_ addr: Address): Bool {
+        access(all) view fun isChildOf(_ addr: Address): Bool {
             return self.parents[addr] != nil
         }
 
         /// Returns nil if the given address is not a parent, false if the parent has not redeemed the child account
         /// yet, and true if they have
         ///
-        pub fun getRedeemedStatus(addr: Address): Bool? {
+        access(all) view fun getRedeemedStatus(addr: Address): Bool? {
             return self.parents[addr]
         }
 
         /// Returns associated parent addresses and their redeemed status
         ///
-        pub fun getParentStatuses(): {Address: Bool} {
+        access(all) view fun getParentStatuses(): {Address: Bool} {
             return self.parents
         }
 
@@ -901,7 +962,7 @@ pub contract HybridCustody {
         /// configured for the provided parent address. Once done, the parent will not have any valid capabilities with
         /// which to access the child account.
         ///
-        pub fun removeParent(parent: Address): Bool {
+        access(Owner | Remove) fun removeParent(parent: Address): Bool {
             if self.parents[parent] == nil {
                 return false
             }
@@ -909,21 +970,28 @@ pub contract HybridCustody {
             let capDelegatorIdentifier = HybridCustody.getCapabilityDelegatorIdentifier(parent)
 
             let acct = self.borrowAccount()
-            acct.unlink(PrivatePath(identifier: identifier)!)
-            acct.unlink(PublicPath(identifier: identifier)!)
 
-            acct.unlink(PrivatePath(identifier: capDelegatorIdentifier)!)
-            acct.unlink(PublicPath(identifier: capDelegatorIdentifier)!)
+            // get all controllers which target this storage path
+            let storagePath = StoragePath(identifier: identifier)!
+            let childAccountControllers = acct.capabilities.storage.getControllers(forPath: storagePath)
+            for c in childAccountControllers {
+                c.delete()
+            }
+            Burner.burn(<- acct.storage.load<@AnyResource>(from: storagePath))
 
-            destroy <- acct.load<@AnyResource>(from: StoragePath(identifier: identifier)!)
-            destroy <- acct.load<@AnyResource>(from: StoragePath(identifier: capDelegatorIdentifier)!)
+            let delegatorStoragePath = StoragePath(identifier: capDelegatorIdentifier)!
+            let delegatorControllers = acct.capabilities.storage.getControllers(forPath: delegatorStoragePath)
+            for c in delegatorControllers {
+                c.delete()
+            }
+            Burner.burn(<- acct.storage.load<@AnyResource>(from: delegatorStoragePath))
 
             self.parents.remove(key: parent)
             emit AccountUpdated(id: self.uuid, child: self.acct.address, parent: parent, active: false)
 
-            let parentManager = getAccount(parent).getCapability<&Manager{ManagerPublic}>(HybridCustody.ManagerPublicPath)
-            if parentManager.check() {
-                parentManager.borrow()?.removeParentCallback(child: self.owner!.address)
+            let parentManager = getAccount(parent).capabilities.get<&{ManagerPublic}>(HybridCustody.ManagerPublicPath)
+            if parentManager?.check() == true {
+                parentManager!.borrow()?.removeParentCallback(child: acct.address)
             }
 
             return true
@@ -931,21 +999,21 @@ pub contract HybridCustody {
 
         /// Returns the address of the encapsulated account
         ///
-        pub fun getAddress(): Address {
+        access(all) view fun getAddress(): Address {
             return self.acct.address
         }
 
         /// Returns the address of the pending owner if one is assigned. Pending owners are assigned when ownership has
         /// been granted, but has not yet been redeemed.
         ///
-        pub fun getPendingOwner(): Address? {
+        access(all) view fun getPendingOwner(): Address? {
             return self.pendingOwner
         }
 
         /// Returns the address of the current owner if one is assigned. Current owners are assigned when ownership has
         /// been redeemed.
         ///
-        pub fun getOwner(): Address? {
+        access(all) view fun getOwner(): Address? {
             if !self.currentlyOwned {
                 return nil
             }
@@ -961,22 +1029,17 @@ pub contract HybridCustody {
         /// mechanism intended to easily transfer 'root' access on this account to another account and an attempt to
         /// minimize access vectors.
         ///
-        pub fun giveOwnership(to: Address) {
+        access(Owner) fun giveOwnership(to: Address) {
             self.seal()
             
             let acct = self.borrowAccount()
-            // Unlink existing owner's Capability if owner exists
-            if self.acctOwner != nil {
-                acct.unlink(
-                    PrivatePath(identifier: HybridCustody.getOwnerIdentifier(self.acctOwner!))!
-                )
-            }
+
             // Link a Capability for the new owner, retrieve & publish
             let identifier =  HybridCustody.getOwnerIdentifier(to)
-            let cap = acct.link<&{OwnedAccountPrivate, OwnedAccountPublic, MetadataViews.Resolver}>(
-                    PrivatePath(identifier: identifier)!,
-                    target: HybridCustody.OwnedAccountStoragePath
-                ) ?? panic("failed to link child account capability")
+            let cap = acct.capabilities.storage.issue<auth(Owner) &{OwnedAccountPrivate, OwnedAccountPublic, ViewResolver.Resolver}>(HybridCustody.OwnedAccountStoragePath)
+
+            // make sure we can borrow the newly issued owned account
+            cap.borrow()!.borrowAccount()
 
             acct.inbox.publish(cap, name: identifier, recipient: to)
 
@@ -988,7 +1051,7 @@ pub contract HybridCustody {
 
         /// Revokes all keys on the underlying account
         ///
-        pub fun revokeAllKeys() {
+        access(Owner) fun revokeAllKeys() {
             let acct = self.borrowAccount()
 
             // Revoke all keys
@@ -1007,33 +1070,25 @@ pub contract HybridCustody {
         /// assumes ownership of an account to guarantee that the previous owner doesn't maintain admin access to the
         /// account via other AuthAccount Capabilities.
         ///
-        pub fun rotateAuthAccount() {
+        access(Owner) fun rotateAuthAccount() {
             let acct = self.borrowAccount()
 
             // Find all active AuthAccount capabilities so they can be removed after we make the new auth account cap
-            let pathsToUnlink: [PrivatePath] = []
-            acct.forEachPrivate(fun (path: PrivatePath, type: Type): Bool {
-                if type.identifier == "Capability<&AuthAccount>" {
-                    pathsToUnlink.append(path)
-                }
-                return true
-            })
+            let controllersToDestroy = acct.capabilities.account.getControllers()
 
             // Link a new AuthAccount Capability
-            // NOTE: This path cannot be sufficiently randomly generated, an app calling this function could build a
-            // capability to this path before it is made, thus maintaining ownership despite making it look like they
-            // gave it away. Until capability controllers, this method should not be fully trusted.
-            let authAcctPath = "HybridCustodyRelinquished".concat(HybridCustody.account.address.toString()).concat(getCurrentBlock().height.toString())
-            let acctCap = acct.linkAccount(PrivatePath(identifier: authAcctPath)!)!
+            let acctCap = acct.capabilities.account.issue<auth(Storage, Contracts, Keys, Inbox, Capabilities) &Account>()
 
             self.acct = acctCap
             let newAcct = self.acct.borrow()!
 
             // cleanup, remove all previously found paths. We had to do it in this order because we will be unlinking
             // the existing path which will cause a deference issue with the originally borrowed auth account
-            for  p in pathsToUnlink {
-                newAcct.unlink(p)
+            for con in controllersToDestroy {
+                newAcct.capabilities.account.getController(byCapabilityID: con.capabilityID)?.delete()
             }
+
+            assert(self.acct.check(), message: "new auth account capability is not valid")
         }
 
         /// Revokes all keys on an account, unlinks all currently active AuthAccount capabilities, then makes a new one
@@ -1043,7 +1098,7 @@ pub contract HybridCustody {
         ///
         /// USE WITH EXTREME CAUTION.
         ///
-        pub fun seal() {
+        access(Owner) fun seal() {
             self.rotateAuthAccount()
             self.revokeAllKeys() // There needs to be a path to giving ownership that doesn't revoke keys   
             emit AccountSealed(id: self.uuid, address: self.acct.address, parents: self.parents.keys)
@@ -1052,16 +1107,16 @@ pub contract HybridCustody {
 
         /// Retrieves a reference to the ChildAccount associated with the given parent account if one exists.
         ///
-        pub fun borrowChildAccount(parent: Address): &ChildAccount? {
+        access(Owner) fun borrowChildAccount(parent: Address): auth(Capabilities) &ChildAccount? {
             let identifier = HybridCustody.getChildAccountIdentifier(parent)
-            return self.borrowAccount().borrow<&ChildAccount>(from: StoragePath(identifier: identifier)!)
+            return self.borrowAccount().storage.borrow<auth(Capabilities) &ChildAccount>(from: StoragePath(identifier: identifier)!)
         }
 
         /// Sets the CapabilityFactory Manager for the specified parent in the associated ChildAccount.
         ///
-        pub fun setCapabilityFactoryForParent(
+        access(Owner) fun setCapabilityFactoryForParent(
             parent: Address,
-            cap: Capability<&CapabilityFactory.Manager{CapabilityFactory.Getter}>
+            cap: Capability<&{CapabilityFactory.Getter}>
         ) {
             let p = self.borrowChildAccount(parent: parent) ?? panic("could not find parent address")
             p.setCapabilityFactory(cap: cap)
@@ -1069,21 +1124,21 @@ pub contract HybridCustody {
 
         /// Sets the Filter for the specified parent in the associated ChildAccount.
         ///
-        pub fun setCapabilityFilterForParent(parent: Address, cap: Capability<&{CapabilityFilter.Filter}>) {
+        access(Owner) fun setCapabilityFilterForParent(parent: Address, cap: Capability<&{CapabilityFilter.Filter}>) {
             let p = self.borrowChildAccount(parent: parent) ?? panic("could not find parent address")
             p.setCapabilityFilter(cap: cap)
         }
 
         /// Retrieves a reference to the Delegator associated with the given parent account if one exists.
         ///
-        pub fun borrowCapabilityDelegatorForParent(parent: Address): &CapabilityDelegator.Delegator? {
+        access(Owner) fun borrowCapabilityDelegatorForParent(parent: Address): auth(Mutate) &CapabilityDelegator.Delegator? {
             let identifier = HybridCustody.getCapabilityDelegatorIdentifier(parent)
-            return self.borrowAccount().borrow<&CapabilityDelegator.Delegator>(from: StoragePath(identifier: identifier)!)
+            return self.borrowAccount().storage.borrow<auth(Mutate) &CapabilityDelegator.Delegator>(from: StoragePath(identifier: identifier)!)
         }
 
         /// Adds the provided Capability to the Delegator associated with the given parent account.
         ///
-        pub fun addCapabilityToDelegator(parent: Address, cap: Capability, isPublic: Bool) {
+        access(Owner) fun addCapabilityToDelegator(parent: Address, cap: Capability, isPublic: Bool) {
             let p = self.borrowChildAccount(parent: parent) ?? panic("could not find parent address")
             let delegator = self.borrowCapabilityDelegatorForParent(parent: parent)
                 ?? panic("could not borrow capability delegator resource for parent address")
@@ -1092,20 +1147,20 @@ pub contract HybridCustody {
 
         /// Removes the provided Capability from the Delegator associated with the given parent account.
         ///
-        pub fun removeCapabilityFromDelegator(parent: Address, cap: Capability) {
+        access(Owner) fun removeCapabilityFromDelegator(parent: Address, cap: Capability) {
             let p = self.borrowChildAccount(parent: parent) ?? panic("could not find parent address")
             let delegator = self.borrowCapabilityDelegatorForParent(parent: parent)
                 ?? panic("could not borrow capability delegator resource for parent address")
             delegator.removeCapability(cap: cap)
         }
 
-        pub fun getViews(): [Type] {
+        access(all) view fun getViews(): [Type] {
             return [
                 Type<MetadataViews.Display>()
             ]
         }
 
-        pub fun resolveView(_ view: Type): AnyStruct? {
+        access(all) fun resolveView(_ view: Type): AnyStruct? {
             switch view {
                 case Type<MetadataViews.Display>():
                     return self.display
@@ -1115,12 +1170,27 @@ pub contract HybridCustody {
 
         /// Sets this OwnedAccount's display to the one provided
         ///
-        pub fun setDisplay(_ d: MetadataViews.Display) {
+        access(Owner) fun setDisplay(_ d: MetadataViews.Display) {
             self.display = d
         }
 
+        access(all) view fun getControllerIDForType(type: Type, forPath: StoragePath): UInt64? {
+            let acct = self.acct.borrow()
+            if acct == nil {
+                return nil
+            }
+
+            for c in acct!.capabilities.storage.getControllers(forPath: forPath) {
+                if c.borrowType.isSubtype(of: type) {
+                    return c.capabilityID
+                }
+            }
+
+            return nil
+        }
+
         init(
-            _ acct: Capability<&AuthAccount>
+            _ acct: Capability<auth(Storage, Contracts, Keys, Inbox, Capabilities) &Account>
         ) {
             self.acct = acct
 
@@ -1134,36 +1204,39 @@ pub contract HybridCustody {
             self.display = nil
         }
 
-        destroy () {
-            destroy <- self.resources
+        // When an OwnedAccount is destroyed, remove it from every configured parent account
+        access(contract) fun burnCallback() {
+            for p in self.parents.keys {
+                self.removeParent(parent: p)
+            }
         }
     }
 
     /// Utility function to get the path identifier for a parent address when interacting with a ChildAccount and its
     /// parents
     ///
-    pub fun getChildAccountIdentifier(_ addr: Address): String {
+    access(all) view fun getChildAccountIdentifier(_ addr: Address): String {
         return "ChildAccount_".concat(addr.toString())
     }
 
     /// Utility function to get the path identifier for a parent address when interacting with a Delegator and its
     /// parents
     ///
-    pub fun getCapabilityDelegatorIdentifier(_ addr: Address): String {
+    access(all) view fun getCapabilityDelegatorIdentifier(_ addr: Address): String {
         return "ChildCapabilityDelegator_".concat(addr.toString())
     }
 
     /// Utility function to get the path identifier for a parent address when interacting with an OwnedAccount and its
     /// owners
     ///
-    pub fun getOwnerIdentifier(_ addr: Address): String {
+    access(all) view fun getOwnerIdentifier(_ addr: Address): String {
         return "HybridCustodyOwnedAccount_".concat(HybridCustody.account.address.toString()).concat(addr.toString())
     }
 
     /// Returns an OwnedAccount wrapping the provided AuthAccount Capability.
     ///
-    pub fun createOwnedAccount(
-        acct: Capability<&AuthAccount>
+    access(all) fun createOwnedAccount(
+        acct: Capability<auth(Storage, Contracts, Keys, Inbox, Capabilities) &Account>
     ): @OwnedAccount {
         pre {
             acct.check(): "invalid auth account capability"
@@ -1176,7 +1249,7 @@ pub contract HybridCustody {
 
     /// Returns a new Manager with the provided Filter as default (if not nil).
     ///
-    pub fun createManager(filter: Capability<&{CapabilityFilter.Filter}>?): @Manager {
+    access(all) fun createManager(filter: Capability<&{CapabilityFilter.Filter}>?): @Manager {
         pre {
             filter == nil || filter!.check(): "Invalid CapabilityFilter Filter capability provided"
         }