diff --git a/applications/tari_dan_app_utilities/src/transaction_executor.rs b/applications/tari_dan_app_utilities/src/transaction_executor.rs
index 0d331ec307..e59cfe0aad 100644
--- a/applications/tari_dan_app_utilities/src/transaction_executor.rs
+++ b/applications/tari_dan_app_utilities/src/transaction_executor.rs
@@ -66,8 +66,7 @@ where TTemplateProvider: TemplateProvider<Template = LoadedTemplate>
         };
 
         let initial_cost = 0;
-        let modules: Vec<Arc<dyn RuntimeModule<TTemplateProvider>>> =
-            vec![Arc::new(FeeModule::new(initial_cost, self.fee_table.clone()))];
+        let modules: Vec<Arc<dyn RuntimeModule>> = vec![Arc::new(FeeModule::new(initial_cost, self.fee_table.clone()))];
 
         let processor = TransactionProcessor::new(
             self.template_provider.clone(),
@@ -80,7 +79,7 @@ where TTemplateProvider: TemplateProvider<Template = LoadedTemplate>
         let result = match processor.execute(transaction.clone()) {
             Ok(result) => result,
             Err(err) => ExecuteResult {
-                finalize: FinalizeResult::new_rejectted(tx_id, RejectReason::ExecutionFailure(err.to_string())),
+                finalize: FinalizeResult::new_rejected(tx_id, RejectReason::ExecutionFailure(err.to_string())),
                 transaction_failure: None,
                 fee_receipt: None,
             },
diff --git a/applications/tari_dan_wallet_daemon/src/services/account_monitor.rs b/applications/tari_dan_wallet_daemon/src/services/account_monitor.rs
index eb98e1a7e8..9a7cfa21ef 100644
--- a/applications/tari_dan_wallet_daemon/src/services/account_monitor.rs
+++ b/applications/tari_dan_wallet_daemon/src/services/account_monitor.rs
@@ -19,7 +19,7 @@ use tari_dan_wallet_sdk::{
     DanWalletSdk,
 };
 use tari_engine_types::{
-    indexed_value::{IndexedValue, IndexedValueVisitorError},
+    indexed_value::{IndexedValue, IndexedValueError},
     non_fungible::NonFungibleContainer,
     resource::Resource,
     substate::{Substate, SubstateAddress, SubstateDiff, SubstateValue},
@@ -261,63 +261,61 @@ where
             account_addr,
             balance
         );
-        if let Some(outputs) = vault.get_confidential_outputs() {
+        if let Some(commitments) = vault.get_confidential_commitments() {
             info!(
                 target: LOG_TARGET,
-                "🔒️ vault {} in account {} has {} confidential outputs",
+                "🔒️ vault {} in account {} has {} confidential commitments",
                 vault.vault_id(),
                 account_addr,
-                outputs.len()
+                commitments.len()
             );
             self.wallet_sdk
                 .confidential_outputs_api()
-                .verify_and_update_confidential_outputs(account_addr, &vault_addr, outputs)?;
+                .verify_and_update_confidential_outputs(account_addr, &vault_addr, commitments.values())?;
         }
 
-        if let Some(nft_ids) = vault.get_non_fungible_ids() {
-            for id in nft_ids {
-                let nft = match nfts.get(id) {
-                    Some(nft) => *nft,
-                    None => {
-                        error!(
-                            target: LOG_TARGET,
-                            "NonFungible ID {} is found in the vault, but not found in substate diff", id
-                        );
-                        continue;
-                    },
-                };
+        for id in vault.get_non_fungible_ids() {
+            let nft = match nfts.get(id) {
+                Some(nft) => *nft,
+                None => {
+                    error!(
+                        target: LOG_TARGET,
+                        "NonFungible ID {} is found in the vault, but not found in substate diff", id
+                    );
+                    continue;
+                },
+            };
 
-                let is_burned = nft.contents().is_none();
-                let nft_contents = if let Some(contents) = nft.contents() {
-                    contents
-                } else {
-                    // TODO: in this case, we are burning an nft, make sure to update the database in that case`
+            let is_burned = nft.contents().is_none();
+            let nft_contents = if let Some(contents) = nft.contents() {
+                contents
+            } else {
+                // TODO: in this case, we are burning an nft, make sure to update the database in that case`
+                continue;
+            };
+            let metadata = match nft_contents.decode_data() {
+                Ok(data) => data,
+                Err(e) => {
+                    error!(
+                        target: LOG_TARGET,
+                        "Failed to decode non fungible metadata, with error: {}", e
+                    );
                     continue;
-                };
-                let metadata = match nft_contents.decode_data() {
-                    Ok(data) => data,
-                    Err(e) => {
-                        error!(
-                            target: LOG_TARGET,
-                            "Failed to decode non fungible metadata, with error: {}", e
-                        );
-                        continue;
-                    },
-                };
-                let resource_address = vault.resource_address();
-                let resource = self.fetch_resource(*resource_address).await?;
-                let token_symbol = resource.token_symbol();
-
-                let non_fungible = NonFungibleToken {
-                    is_burned,
-                    vault_id: *vault.vault_id(),
-                    nft_id: id.clone(),
-                    metadata,
-                    token_symbol: String::from(token_symbol),
-                };
-
-                non_fungibles_api.store_new_nft(&non_fungible)?;
-            }
+                },
+            };
+            let resource_address = vault.resource_address();
+            let resource = self.fetch_resource(*resource_address).await?;
+            let token_symbol = resource.token_symbol();
+
+            let non_fungible = NonFungibleToken {
+                is_burned,
+                vault_id: *vault.vault_id(),
+                nft_id: id.clone(),
+                metadata,
+                token_symbol: String::from(token_symbol),
+            };
+
+            non_fungibles_api.store_new_nft(&non_fungible)?;
         }
         Ok(())
     }
@@ -543,7 +541,7 @@ pub enum AccountMonitorError {
     #[error("Non Fungibles API error: {0}")]
     NonFungibleTokens(#[from] NonFungibleTokensApiError),
     #[error("Failed to decode binary value: {0}")]
-    DecodeValueFailed(#[from] IndexedValueVisitorError),
+    DecodeValueFailed(#[from] IndexedValueError),
     #[error("Unexpected substate: {0}")]
     UnexpectedSubstate(String),
     #[error("Monitor service is not running")]
diff --git a/applications/tari_validator_node/src/bootstrap.rs b/applications/tari_validator_node/src/bootstrap.rs
index 33d9cc8abe..5b36623657 100644
--- a/applications/tari_validator_node/src/bootstrap.rs
+++ b/applications/tari_validator_node/src/bootstrap.rs
@@ -58,9 +58,11 @@ use tari_indexer_lib::substate_scanner::SubstateScanner;
 use tari_shutdown::ShutdownSignal;
 use tari_state_store_sqlite::SqliteStateStore;
 use tari_template_lib::{
+    auth::ResourceAccessRules,
     constants::{CONFIDENTIAL_TARI_RESOURCE_ADDRESS, PUBLIC_IDENTITY_RESOURCE_ADDRESS},
+    crypto::RistrettoPublicKeyBytes,
     models::Metadata,
-    prelude::ResourceType,
+    prelude::{OwnerRule, ResourceType},
 };
 use tari_transaction::Transaction;
 use tari_validator_node_rpc::client::TariCommsValidatorNodeClientFactory;
@@ -375,7 +377,15 @@ where
         SubstateRecord {
             address,
             version: 0,
-            substate_value: Resource::new(ResourceType::NonFungible, "ID".to_string(), Default::default()).into(),
+            substate_value: Resource::new(
+                ResourceType::NonFungible,
+                RistrettoPublicKeyBytes::default(),
+                OwnerRule::None,
+                ResourceAccessRules::new(),
+                "ID".to_string(),
+                Default::default(),
+            )
+            .into(),
             state_hash: Default::default(),
             created_by_transaction: Default::default(),
             created_justify: *genesis_block.justify().id(),
@@ -393,7 +403,15 @@ where
         SubstateRecord {
             address,
             version: 0,
-            substate_value: Resource::new(ResourceType::Confidential, "tXTR2".to_string(), Metadata::new()).into(),
+            substate_value: Resource::new(
+                ResourceType::Confidential,
+                RistrettoPublicKeyBytes::default(),
+                OwnerRule::None,
+                ResourceAccessRules::new(),
+                "tXTR2".to_string(),
+                Metadata::new(),
+            )
+            .into(),
             state_hash: Default::default(),
             created_by_transaction: Default::default(),
             created_justify: *genesis_block.justify().id(),
diff --git a/clients/wallet_daemon_client/src/types.rs b/clients/wallet_daemon_client/src/types.rs
index 8d993dad8e..f648253673 100644
--- a/clients/wallet_daemon_client/src/types.rs
+++ b/clients/wallet_daemon_client/src/types.rs
@@ -39,7 +39,7 @@ use tari_engine_types::{
 };
 use tari_template_lib::{
     args::Arg,
-    auth::AccessRules,
+    auth::ComponentAccessRules,
     models::{Amount, ConfidentialOutputProof, NonFungibleId, ResourceAddress},
     prelude::{ConfidentialWithdrawProof, ResourceType},
 };
@@ -193,7 +193,7 @@ pub struct KeysCreateResponse {
 #[derive(Debug, Clone, Deserialize, Serialize)]
 pub struct AccountsCreateRequest {
     pub account_name: Option<String>,
-    pub custom_access_rules: Option<AccessRules>,
+    pub custom_access_rules: Option<ComponentAccessRules>,
     pub fee: Option<Amount>,
     pub is_default: bool,
     pub key_id: Option<u64>,
diff --git a/dan_layer/consensus_tests/src/consensus.rs b/dan_layer/consensus_tests/src/consensus.rs
index 655d89baae..0d43b2f3fe 100644
--- a/dan_layer/consensus_tests/src/consensus.rs
+++ b/dan_layer/consensus_tests/src/consensus.rs
@@ -242,6 +242,7 @@ async fn multi_shard_propose_blocks_with_new_transactions_until_all_committed()
     test.assert_clean_shutdown().await;
 }
 
+#[ignore = "FIXME: This test is very flaky"]
 #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
 async fn foreign_shard_decides_to_abort() {
     setup_logger();
diff --git a/dan_layer/consensus_tests/src/support/transaction.rs b/dan_layer/consensus_tests/src/support/transaction.rs
index 5f8377d0a0..fed95a2502 100644
--- a/dan_layer/consensus_tests/src/support/transaction.rs
+++ b/dan_layer/consensus_tests/src/support/transaction.rs
@@ -9,7 +9,6 @@ use tari_dan_storage::consensus_models::{Decision, ExecutedTransaction};
 use tari_engine_types::{
     commit_result::{ExecuteResult, FinalizeResult, RejectReason, TransactionResult},
     fees::{FeeCostBreakdown, FeeReceipt},
-    resource_container::ResourceContainer,
     substate::SubstateDiff,
 };
 use tari_transaction::Transaction;
@@ -43,13 +42,7 @@ pub fn build_transaction_from(
             transaction_failure: None,
             fee_receipt: Some(FeeReceipt {
                 total_fee_payment: fee.try_into().unwrap(),
-                fee_resource: ResourceContainer::Confidential {
-                    address: "resource_0000000000000000000000000000000000000000000000000000000000000000"
-                        .parse()
-                        .unwrap(),
-                    commitments: Default::default(),
-                    revealed_amount: fee.try_into().unwrap(),
-                },
+                total_fees_paid: fee.try_into().unwrap(),
                 cost_breakdown: vec![],
             }),
         },
@@ -75,19 +68,14 @@ pub fn build_transaction(decision: Decision, fee: u64, num_shards: usize, num_co
 }
 
 pub fn change_decision(tx: ExecutedTransaction, new_decision: Decision) -> ExecutedTransaction {
-    let total_fees_charged = tx
+    let total_fees_paid = tx
         .result()
         .fee_receipt
         .as_ref()
         .unwrap()
-        .total_fees_paid()
+        .total_allocated_fee_payments()
         .as_u64_checked()
         .unwrap();
     let resulting_outputs = tx.resulting_outputs().to_vec();
-    build_transaction_from(
-        tx.into_transaction(),
-        new_decision,
-        total_fees_charged,
-        resulting_outputs,
-    )
+    build_transaction_from(tx.into_transaction(), new_decision, total_fees_paid, resulting_outputs)
 }
diff --git a/dan_layer/engine/src/bootstrap.rs b/dan_layer/engine/src/bootstrap.rs
index 8b1a17705c..d5e2c196c2 100644
--- a/dan_layer/engine/src/bootstrap.rs
+++ b/dan_layer/engine/src/bootstrap.rs
@@ -6,21 +6,29 @@ use tari_engine_types::{
     substate::{Substate, SubstateAddress},
 };
 use tari_template_lib::{
+    auth::{AccessRule, ResourceAccessRules},
     constants::{CONFIDENTIAL_TARI_RESOURCE_ADDRESS, PUBLIC_IDENTITY_RESOURCE_ADDRESS},
+    crypto::RistrettoPublicKeyBytes,
     models::Metadata,
-    prelude::ResourceType,
+    prelude::{OwnerRule, ResourceType},
 };
 
 use crate::state_store::{StateStoreError, StateWriter};
 
 pub fn bootstrap_state<T: StateWriter>(state_db: &mut T) -> Result<(), StateStoreError> {
-    let address = SubstateAddress::Resource(PUBLIC_IDENTITY_RESOURCE_ADDRESS);
     // Create the resource for badges
     state_db.set_state(
-        &address,
+        &SubstateAddress::Resource(PUBLIC_IDENTITY_RESOURCE_ADDRESS),
         Substate::new(
             0,
-            Resource::new(ResourceType::NonFungible, "ID".to_string(), Default::default()),
+            Resource::new(
+                ResourceType::NonFungible,
+                RistrettoPublicKeyBytes::default(),
+                OwnerRule::None,
+                ResourceAccessRules::deny_all(),
+                "ID".to_string(),
+                Default::default(),
+            ),
         ),
     )?;
 
@@ -33,7 +41,16 @@ pub fn bootstrap_state<T: StateWriter>(state_db: &mut T) -> Result<(), StateStor
         &address,
         Substate::new(
             0,
-            Resource::new(ResourceType::Confidential, "tXTR2".to_string(), metadata),
+            Resource::new(
+                ResourceType::Confidential,
+                RistrettoPublicKeyBytes::default(),
+                OwnerRule::None,
+                ResourceAccessRules::new()
+                    .withdrawable(AccessRule::AllowAll)
+                    .depositable(AccessRule::AllowAll),
+                "tXTR2".to_string(),
+                metadata,
+            ),
         ),
     )?;
 
diff --git a/dan_layer/engine/src/fees/fee_module.rs b/dan_layer/engine/src/fees/fee_module.rs
index 8223932a88..f1f8d64bb8 100644
--- a/dan_layer/engine/src/fees/fee_module.rs
+++ b/dan_layer/engine/src/fees/fee_module.rs
@@ -4,17 +4,13 @@
 use std::{collections::HashMap, io};
 
 use tari_bor::encode_into;
-use tari_dan_common_types::services::template_provider::TemplateProvider;
 use tari_engine_types::{
     fees::FeeSource,
     substate::{SubstateAddress, SubstateValue},
 };
 
 use super::FeeTable;
-use crate::{
-    packager::LoadedTemplate,
-    runtime::{RuntimeModule, RuntimeModuleError, StateTracker},
-};
+use crate::runtime::{RuntimeModule, RuntimeModuleError, StateTracker};
 
 pub struct FeeModule {
     initial_cost: u64,
@@ -30,24 +26,20 @@ impl FeeModule {
     }
 }
 
-impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate>> RuntimeModule<TTemplateProvider> for FeeModule {
-    fn on_initialize(&self, track: &StateTracker<TTemplateProvider>) -> Result<(), RuntimeModuleError> {
+impl RuntimeModule for FeeModule {
+    fn on_initialize(&self, track: &StateTracker) -> Result<(), RuntimeModuleError> {
         track.add_fee_charge(FeeSource::Initial, self.initial_cost);
         Ok(())
     }
 
-    fn on_runtime_call(
-        &self,
-        track: &StateTracker<TTemplateProvider>,
-        _call: &'static str,
-    ) -> Result<(), RuntimeModuleError> {
+    fn on_runtime_call(&self, track: &StateTracker, _call: &'static str) -> Result<(), RuntimeModuleError> {
         track.add_fee_charge(FeeSource::RuntimeCall, self.fee_table.per_module_call_cost());
         Ok(())
     }
 
     fn on_before_finalize(
         &self,
-        track: &StateTracker<TTemplateProvider>,
+        track: &StateTracker,
         changes: &HashMap<SubstateAddress, SubstateValue>,
     ) -> Result<(), RuntimeModuleError> {
         let total_storage = changes
diff --git a/dan_layer/engine/src/flow/flow_context.rs b/dan_layer/engine/src/flow/flow_context.rs
index d932df747f..1a2ace1aa0 100644
--- a/dan_layer/engine/src/flow/flow_context.rs
+++ b/dan_layer/engine/src/flow/flow_context.rs
@@ -5,17 +5,12 @@ use std::{collections::HashMap, sync::Arc};
 
 use tari_dan_common_types::services::template_provider::TemplateProvider;
 
-use crate::{
-    function_definitions::FunctionArgDefinition,
-    packager::LoadedTemplate,
-    runtime::{AuthorizationScope, Runtime},
-};
+use crate::{function_definitions::FunctionArgDefinition, packager::LoadedTemplate, runtime::Runtime};
 
 pub struct FlowContext<TTemplateProvider: TemplateProvider<Template = LoadedTemplate>> {
     pub template_provider: Arc<TTemplateProvider>,
     pub runtime: Runtime,
-    pub auth_scope: AuthorizationScope,
-    pub args: HashMap<String, (Vec<u8>, FunctionArgDefinition)>,
+    pub args: HashMap<String, (tari_bor::Value, FunctionArgDefinition)>,
     pub recursion_depth: usize,
     pub max_recursion_depth: usize,
 }
diff --git a/dan_layer/engine/src/flow/flow_factory.rs b/dan_layer/engine/src/flow/flow_factory.rs
index 561e053588..f505d6d2b3 100644
--- a/dan_layer/engine/src/flow/flow_factory.rs
+++ b/dan_layer/engine/src/flow/flow_factory.rs
@@ -14,7 +14,7 @@ use crate::{
     flow::{FlowContext, FlowEngineError, FlowInstance},
     function_definitions::{FlowFunctionDefinition, FunctionArgDefinition},
     packager::LoadedTemplate,
-    runtime::{AuthorizationScope, Runtime},
+    runtime::Runtime,
 };
 
 #[derive(Debug, Clone)]
@@ -69,7 +69,6 @@ impl FlowFactory {
         &self,
         template_provider: Arc<TTemplateProvider>,
         runtime: Runtime,
-        auth_scope: AuthorizationScope,
         // In future we might allow calling different functions in a flow
         _function: &str,
         args: Vec<Arg>,
@@ -83,7 +82,6 @@ impl FlowFactory {
         new_instance.invoke(
             template_provider,
             runtime,
-            auth_scope,
             &args,
             &self.args,
             recursion_depth,
diff --git a/dan_layer/engine/src/flow/flow_instance.rs b/dan_layer/engine/src/flow/flow_instance.rs
index 0094e6b12d..0ab6ccedb3 100644
--- a/dan_layer/engine/src/flow/flow_instance.rs
+++ b/dan_layer/engine/src/flow/flow_instance.rs
@@ -17,7 +17,7 @@ use crate::{
     },
     function_definitions::FunctionArgDefinition,
     packager::LoadedTemplate,
-    runtime::{AuthorizationScope, Runtime},
+    runtime::Runtime,
 };
 
 #[derive(Clone, Debug)]
@@ -48,14 +48,13 @@ impl FlowInstance {
         &self,
         template_provider: Arc<TTemplateProvider>,
         runtime: Runtime,
-        auth_scope: AuthorizationScope,
         args: &[Arg],
         arg_defs: &[FunctionArgDefinition],
         recursion_depth: usize,
         max_recursion_depth: usize,
     ) -> Result<InstructionResult, FlowEngineError> {
         let engine = Engine::new("tari@0.1.0".to_string(), load_workers());
-        let args = runtime.resolve_args(args.to_vec())?;
+        let args = runtime.resolve_args(args)?;
         let mut args_map = HashMap::new();
         for (i, arg_def) in arg_defs.iter().enumerate() {
             if i >= args.len() {
@@ -69,7 +68,6 @@ impl FlowInstance {
         let context = FlowContext {
             template_provider,
             runtime,
-            auth_scope,
             args: args_map,
             recursion_depth,
             max_recursion_depth,
diff --git a/dan_layer/engine/src/flow/workers/arg_worker.rs b/dan_layer/engine/src/flow/workers/arg_worker.rs
index 5df06bcce0..6045917d3c 100644
--- a/dan_layer/engine/src/flow/workers/arg_worker.rs
+++ b/dan_layer/engine/src/flow/workers/arg_worker.rs
@@ -4,6 +4,7 @@
 use std::collections::HashMap;
 
 use d3ne::{Node, OutputValue, Worker};
+use tari_bor::from_value;
 use tari_dan_common_types::services::template_provider::TemplateProvider;
 
 use crate::{flow::FlowContext, function_definitions::ArgType, packager::LoadedTemplate};
@@ -30,13 +31,10 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate>> Worker<Flow
         let mut result = HashMap::new();
         match arg_def.arg_type {
             ArgType::String => {
-                result.insert(
-                    "default".to_string(),
-                    OutputValue::String(String::from_utf8(value.clone())?),
-                );
+                result.insert("default".to_string(), OutputValue::String(from_value(value)?));
             },
             ArgType::Bytes => {
-                result.insert("default".to_string(), OutputValue::Bytes(value.clone()));
+                result.insert("default".to_string(), OutputValue::Bytes(from_value(value)?));
             },
         };
         Ok(result)
diff --git a/dan_layer/engine/src/flow/workers/call_method_worker.rs b/dan_layer/engine/src/flow/workers/call_method_worker.rs
index 94584b3642..4e041c34e5 100644
--- a/dan_layer/engine/src/flow/workers/call_method_worker.rs
+++ b/dan_layer/engine/src/flow/workers/call_method_worker.rs
@@ -79,9 +79,8 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate>> Worker<Flow
         }
 
         let exec_result = TransactionProcessor::call_method(
-            context.template_provider.clone(),
+            &*context.template_provider,
             &context.runtime,
-            context.auth_scope.clone(),
             &component_address,
             method_name,
             // TODO: put in rest of args
diff --git a/dan_layer/engine/src/runtime/actions.rs b/dan_layer/engine/src/runtime/actions.rs
new file mode 100644
index 0000000000..14ce9c16d7
--- /dev/null
+++ b/dan_layer/engine/src/runtime/actions.rs
@@ -0,0 +1,56 @@
+//   Copyright 2023 The Tari Project
+//   SPDX-License-Identifier: BSD-3-Clause
+
+use std::fmt::{Display, Formatter};
+
+use tari_template_lib::{args::ComponentAction, auth::ResourceAuthAction};
+
+#[derive(Debug, Clone)]
+pub enum ActionIdent {
+    Native(NativeAction),
+    ComponentCallMethod { method: String },
+}
+
+impl From<NativeAction> for ActionIdent {
+    fn from(native: NativeAction) -> Self {
+        Self::Native(native)
+    }
+}
+
+impl From<ComponentAction> for ActionIdent {
+    fn from(component_action: ComponentAction) -> Self {
+        Self::Native(NativeAction::Component(component_action))
+    }
+}
+
+impl From<ResourceAuthAction> for ActionIdent {
+    fn from(action: ResourceAuthAction) -> Self {
+        Self::Native(NativeAction::Resource(action))
+    }
+}
+
+impl Display for ActionIdent {
+    fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
+        match self {
+            ActionIdent::Native(native_fn) => write!(f, "native.{}", native_fn),
+            ActionIdent::ComponentCallMethod { method } => {
+                write!(f, "{}", method)
+            },
+        }
+    }
+}
+
+#[derive(Debug, Clone)]
+pub enum NativeAction {
+    Component(ComponentAction),
+    Resource(ResourceAuthAction),
+}
+
+impl Display for NativeAction {
+    fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
+        match self {
+            NativeAction::Component(action) => write!(f, "component.call_method.{:?}", action),
+            NativeAction::Resource(action) => write!(f, "resource.{:?}", action),
+        }
+    }
+}
diff --git a/dan_layer/engine/src/runtime/auth.rs b/dan_layer/engine/src/runtime/auth.rs
index 6b356bc368..f13d1127d3 100644
--- a/dan_layer/engine/src/runtime/auth.rs
+++ b/dan_layer/engine/src/runtime/auth.rs
@@ -3,53 +3,48 @@
 
 use std::sync::Arc;
 
-use tari_template_lib::{auth::AccessRules, models::NonFungibleAddress};
-
-use crate::runtime::{FunctionIdent, RuntimeError};
+use tari_template_lib::models::{NonFungibleAddress, ProofId};
 
 #[derive(Debug, Clone)]
 pub struct AuthParams {
     pub initial_ownership_proofs: Vec<NonFungibleAddress>,
 }
 
-#[derive(Clone)]
+#[derive(Debug, Clone)]
 pub struct AuthorizationScope {
     /// Virtual proofs are system-issued non-fungibles that exist for no longer than the execution e.g. derived from
-    /// the transaction sender public key
+    /// the transaction signer public key
     virtual_proofs: Arc<Vec<NonFungibleAddress>>,
+
+    /// Resource-based proofs
+    proofs: Vec<ProofId>,
 }
 
 impl AuthorizationScope {
-    pub fn new(virtual_proofs: Arc<Vec<NonFungibleAddress>>) -> Self {
-        Self { virtual_proofs }
+    pub fn new(virtual_proofs: Vec<NonFungibleAddress>) -> Self {
+        Self {
+            virtual_proofs: Arc::new(virtual_proofs),
+            proofs: vec![],
+        }
     }
 
-    pub fn check_access_rules(&self, fn_ident: &FunctionIdent, access_rules: &AccessRules) -> Result<(), RuntimeError> {
-        match fn_ident {
-            FunctionIdent::Native(native_fn) => {
-                if access_rules
-                    .get_native_access_rule(native_fn)
-                    .is_access_allowed(&self.virtual_proofs)
-                {
-                    Ok(())
-                } else {
-                    Err(RuntimeError::AccessDenied {
-                        fn_ident: fn_ident.clone(),
-                    })
-                }
-            },
-            FunctionIdent::Template { function, .. } => {
-                if access_rules
-                    .get_method_access_rule(function)
-                    .is_access_allowed(&self.virtual_proofs)
-                {
-                    Ok(())
-                } else {
-                    Err(RuntimeError::AccessDenied {
-                        fn_ident: fn_ident.clone(),
-                    })
-                }
-            },
-        }
+    pub fn virtual_proofs(&self) -> &[NonFungibleAddress] {
+        &self.virtual_proofs
+    }
+
+    pub fn proofs(&self) -> &[ProofId] {
+        &self.proofs
+    }
+
+    pub fn add_proof(&mut self, proof_id: ProofId) {
+        // unwrap: if the RwLock is poisoned, then another panic occurred
+        self.proofs.push(proof_id);
+    }
+
+    pub fn remove_proof(&mut self, proof_id: &ProofId) -> Option<ProofId> {
+        self.proofs
+            .iter()
+            .position(|p| p == proof_id)
+            .map(|i| self.proofs.remove(i))
     }
 }
diff --git a/dan_layer/engine/src/runtime/engine_args.rs b/dan_layer/engine/src/runtime/engine_args.rs
index f0c6226a06..d954db64a2 100644
--- a/dan_layer/engine/src/runtime/engine_args.rs
+++ b/dan_layer/engine/src/runtime/engine_args.rs
@@ -33,6 +33,17 @@ impl EngineArgs {
             })
     }
 
+    pub fn assert_one_arg<T: DeserializeOwned>(&self) -> Result<T, RuntimeError> {
+        if self.len() == 1 {
+            self.get(0)
+        } else {
+            Err(RuntimeError::InvalidArgument {
+                argument: type_name::<T>(),
+                reason: format!("Expected only one argument but got {}", self.len()),
+            })
+        }
+    }
+
     pub fn len(&self) -> usize {
         self.args.len()
     }
@@ -40,6 +51,17 @@ impl EngineArgs {
     pub fn is_empty(&self) -> bool {
         self.args.is_empty()
     }
+
+    pub fn assert_is_empty(&self, op_name: &'static str) -> Result<(), RuntimeError> {
+        if self.is_empty() {
+            Ok(())
+        } else {
+            Err(RuntimeError::InvalidArgument {
+                argument: op_name,
+                reason: format!("Expected no arguments but got {}", self.len()),
+            })
+        }
+    }
 }
 
 impl From<Vec<Vec<u8>>> for EngineArgs {
diff --git a/dan_layer/engine/src/runtime/error.rs b/dan_layer/engine/src/runtime/error.rs
index 01bb3f9d91..cfb7ca5bc1 100644
--- a/dan_layer/engine/src/runtime/error.rs
+++ b/dan_layer/engine/src/runtime/error.rs
@@ -27,6 +27,7 @@ use tari_bor::BorError;
 use tari_common_types::types::PublicKey;
 use tari_dan_common_types::{optional::IsNotFoundError, Epoch};
 use tari_engine_types::{
+    indexed_value::IndexedValueError,
     resource_container::ResourceError,
     substate::SubstateAddress,
     transaction_receipt::TransactionReceiptAddress,
@@ -37,6 +38,7 @@ use tari_template_lib::models::{
     BucketId,
     ComponentAddress,
     NonFungibleId,
+    ProofId,
     ResourceAddress,
     TemplateAddress,
     UnclaimedConfidentialOutputAddress,
@@ -46,14 +48,16 @@ use tari_transaction::id_provider::IdProviderError;
 
 use super::workspace::WorkspaceError;
 use crate::{
-    runtime::{FunctionIdent, RuntimeModuleError},
+    runtime::{ActionIdent, RuntimeModuleError},
     state_store::StateStoreError,
 };
 
 #[derive(Debug, thiserror::Error)]
 pub enum RuntimeError {
-    #[error("Runtime encoding error: {0}")]
+    #[error("Encoding error: {0}")]
     EncodingError(#[from] BorError),
+    #[error("Indexed value error: {0}")]
+    IndexedValueError(#[from] IndexedValueError),
     #[error("State DB error: {0}")]
     StateDbError(#[from] anyhow::Error),
     #[error("State storage error: {0}")]
@@ -89,6 +93,8 @@ pub enum RuntimeError {
     },
     #[error("Bucket not found with id {bucket_id}")]
     BucketNotFound { bucket_id: BucketId },
+    #[error("Proof not found with id {proof_id}")]
+    ProofNotFound { proof_id: ProofId },
     #[error("Resource not found with address {resource_address}")]
     ResourceNotFound { resource_address: ResourceAddress },
     #[error(transparent)]
@@ -105,8 +111,10 @@ pub enum RuntimeError {
     TooManyOutputs(#[from] IdProviderError),
     #[error("Duplicate NFT token id: {token_id}")]
     DuplicateNonFungibleId { token_id: NonFungibleId },
-    #[error("Access Denied: {fn_ident}")]
-    AccessDenied { fn_ident: FunctionIdent },
+    #[error("Access Denied: {action_ident}")]
+    AccessDenied { action_ident: ActionIdent },
+    #[error("Access Denied: {action}")]
+    AccessDeniedOwnerRequired { action: ActionIdent },
     #[error("Invalid method address rule for {template_name}: {details}")]
     InvalidMethodAccessRule { template_name: String, details: String },
     #[error("Runtime module error: {0}")]
@@ -155,6 +163,10 @@ pub enum RuntimeError {
     VirtualSubstateNotFound { address: VirtualSubstateAddress },
     #[error("Double claimed fee for epoch {epoch} vn address {address:.10}")]
     DoubleClaimedFee { address: PublicKey, epoch: Epoch },
+    #[error("Invalid return value: {0}")]
+    InvalidReturnValue(IndexedValueError),
+    #[error("Attempt to pop auth scope stack but it was empty")]
+    AuthScopeStackEmpty,
 }
 
 impl RuntimeError {
@@ -171,7 +183,8 @@ impl IsNotFoundError for RuntimeError {
                 RuntimeError::VaultNotFound { .. } |
                 RuntimeError::BucketNotFound { .. } |
                 RuntimeError::ResourceNotFound { .. } |
-                RuntimeError::NonFungibleNotFound { .. }
+                RuntimeError::NonFungibleNotFound { .. } |
+                RuntimeError::ProofNotFound { .. }
         )
     }
 }
@@ -180,6 +193,10 @@ impl IsNotFoundError for RuntimeError {
 pub enum TransactionCommitError {
     #[error("{count} dangling buckets remain after transaction execution")]
     DanglingBuckets { count: usize },
+    #[error("{count} dangling proofs remain after transaction execution")]
+    DanglingProofs { count: usize },
+    #[error("Locked value (amount: {locked_amount}) remaining in vault {vault_id}")]
+    DanglingLockedValueInVault { vault_id: VaultId, locked_amount: Amount },
     #[error("{count} dangling items in workspace after transaction execution")]
     WorkspaceNotEmpty { count: usize },
     #[error(transparent)]
diff --git a/dan_layer/engine/src/runtime/functions.rs b/dan_layer/engine/src/runtime/functions.rs
deleted file mode 100644
index a43926e65e..0000000000
--- a/dan_layer/engine/src/runtime/functions.rs
+++ /dev/null
@@ -1,21 +0,0 @@
-//   Copyright 2023 The Tari Project
-//   SPDX-License-Identifier: BSD-3-Clause
-
-use std::fmt::{Display, Formatter};
-
-use tari_template_lib::auth::NativeFunctionCall;
-
-#[derive(Debug, Clone)]
-pub enum FunctionIdent {
-    Native(NativeFunctionCall),
-    Template { module_name: String, function: String },
-}
-
-impl Display for FunctionIdent {
-    fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
-        match self {
-            FunctionIdent::Native(native_fn) => write!(f, "native.{}", native_fn),
-            FunctionIdent::Template { module_name, function } => write!(f, "template.{}.{}", module_name, function),
-        }
-    }
-}
diff --git a/dan_layer/engine/src/runtime/impl.rs b/dan_layer/engine/src/runtime/impl.rs
index 180ac80976..bffcaa09c6 100644
--- a/dan_layer/engine/src/runtime/impl.rs
+++ b/dan_layer/engine/src/runtime/impl.rs
@@ -20,20 +20,12 @@
 //   WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
 //   USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-use std::{
-    collections::{BTreeSet, HashMap},
-    sync::Arc,
-};
+use std::{collections::HashMap, sync::Arc};
 
 use log::warn;
-use tari_bor::encode;
 use tari_common_types::types::PublicKey;
-use tari_crypto::{
-    range_proof::RangeProofService,
-    ristretto::{RistrettoPublicKey, RistrettoSecretKey},
-    tari_utilities::ByteArray,
-};
-use tari_dan_common_types::{services::template_provider::TemplateProvider, Epoch};
+use tari_crypto::{range_proof::RangeProofService, ristretto::RistrettoPublicKey, tari_utilities::ByteArray};
+use tari_dan_common_types::{optional::Optional, services::template_provider::TemplateProvider, Epoch};
 use tari_engine_types::{
     base_layer_hashing::ownership_proof_hasher,
     commit_result::FinalizeResult,
@@ -41,14 +33,15 @@ use tari_engine_types::{
     confidential::{get_commitment_factory, get_range_proof_service, ConfidentialClaim, ConfidentialOutput},
     events::Event,
     fees::FeeReceipt,
+    indexed_value::IndexedValue,
     logs::LogEntry,
     resource_container::ResourceContainer,
     substate::{SubstateAddress, SubstateValue},
+    TemplateAddress,
 };
 use tari_template_abi::TemplateDef;
 use tari_template_lib::{
     args::{
-        Arg,
         BucketAction,
         BucketRef,
         CallAction,
@@ -67,27 +60,30 @@ use tari_template_lib::{
         MintResourceArg,
         NonFungibleAction,
         PayFeeArg,
+        ProofAction,
+        ProofRef,
         ResourceAction,
         ResourceGetNonFungibleArg,
         ResourceRef,
         ResourceUpdateNonFungibleDataArg,
         VaultAction,
+        VaultCreateProofByFungibleAmountArg,
+        VaultCreateProofByNonFungiblesArg,
         VaultWithdrawArg,
         WorkspaceAction,
     },
-    auth::AccessRules,
+    auth::{ComponentAccessRules, ResourceAccessRules, ResourceAuthAction},
     constants::CONFIDENTIAL_TARI_RESOURCE_ADDRESS,
     crypto::RistrettoPublicKeyBytes,
-    models::{Amount, BucketId, ComponentAddress, Metadata, NonFungibleAddress, VaultRef},
+    models::{Amount, BucketId, ComponentAddress, Metadata, NonFungibleAddress, NotAuthorized, VaultRef},
 };
 
-use super::{tracker::FinalizeTracker, AuthorizationScope, Runtime};
+use super::{tracker::FinalizeTracker, Runtime};
 use crate::{
     packager::LoadedTemplate,
     runtime::{
         engine_args::EngineArgs,
         tracker::StateTracker,
-        AuthParams,
         RuntimeError,
         RuntimeInterface,
         RuntimeModule,
@@ -98,11 +94,11 @@ use crate::{
 
 const LOG_TARGET: &str = "tari::dan::engine::runtime::impl";
 
-pub struct RuntimeInterfaceImpl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate>> {
-    tracker: StateTracker<TTemplateProvider>,
-    _auth_params: AuthParams,
+pub struct RuntimeInterfaceImpl<TTemplateProvider> {
+    tracker: StateTracker,
+    template_provider: Arc<TTemplateProvider>,
     sender_public_key: RistrettoPublicKey,
-    modules: Vec<Arc<dyn RuntimeModule<TTemplateProvider>>>,
+    modules: Vec<Arc<dyn RuntimeModule>>,
 }
 
 pub struct StateFinalize {
@@ -112,14 +108,14 @@ pub struct StateFinalize {
 
 impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate>> RuntimeInterfaceImpl<TTemplateProvider> {
     pub fn initialize(
-        tracker: StateTracker<TTemplateProvider>,
-        auth_params: AuthParams,
+        tracker: StateTracker,
+        template_provider: Arc<TTemplateProvider>,
         sender_public_key: RistrettoPublicKey,
-        modules: Vec<Arc<dyn RuntimeModule<TTemplateProvider>>>,
+        modules: Vec<Arc<dyn RuntimeModule>>,
     ) -> Result<Self, RuntimeError> {
         let runtime = Self {
             tracker,
-            _auth_params: auth_params,
+            template_provider,
             sender_public_key,
             modules,
         };
@@ -127,14 +123,6 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate>> RuntimeInte
         Ok(runtime)
     }
 
-    // TODO: this will be needed when we restrict Resources
-    // fn check_access_rules(&self, function: FunctionIdent, access_rules: &AccessRules) -> Result<(), RuntimeError> {
-    //     // TODO: In this very basic auth system, you can only call on owned objects (because initial_ownership_proofs
-    // is     //       usually set to include the owner token).
-    //     let auth_zone = AuthorizationScope::new(&self.auth_params.initial_ownership_proofs);
-    //     auth_zone.check_access_rules(&function, access_rules)
-    // }
-
     fn invoke_modules_on_initialize(&self) -> Result<(), RuntimeError> {
         for module in &self.modules {
             module.on_initialize(&self.tracker)?;
@@ -158,6 +146,59 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate>> RuntimeInte
         }
         Ok(())
     }
+
+    pub fn get_template_def(&self, template_address: &TemplateAddress) -> Result<TemplateDef, RuntimeError> {
+        let loaded = self
+            .template_provider
+            .get_template_module(template_address)
+            .map_err(|e| RuntimeError::FailedToLoadTemplate {
+                address: *template_address,
+                details: e.to_string(),
+            })?
+            .ok_or(RuntimeError::TemplateNotFound {
+                template_address: *template_address,
+            })?;
+
+        Ok(loaded.template_def().clone())
+    }
+
+    fn validate_return_value(&self, value: &IndexedValue) -> Result<(), RuntimeError> {
+        for bucket_id in value.bucket_ids() {
+            if !self.tracker.bucket_exists(bucket_id) {
+                return Err(RuntimeError::BucketNotFound { bucket_id: *bucket_id });
+            }
+        }
+
+        for proof_id in value.proof_ids() {
+            if !self.tracker.proof_exists(proof_id) {
+                return Err(RuntimeError::ProofNotFound { proof_id: *proof_id });
+            }
+        }
+
+        for vault_id in value.vault_ids() {
+            if !self.tracker.vault_exists(vault_id)? {
+                return Err(RuntimeError::VaultNotFound { vault_id: *vault_id });
+            }
+        }
+
+        for resource_address in value.resource_addresses() {
+            if !self.tracker.resource_exists(resource_address)? {
+                return Err(RuntimeError::ResourceNotFound {
+                    resource_address: *resource_address,
+                });
+            }
+        }
+
+        for component_address in value.component_addresses() {
+            if !self.tracker.component_exists(component_address)? {
+                return Err(RuntimeError::ComponentNotFound {
+                    address: *component_address,
+                });
+            }
+        }
+
+        Ok(())
+    }
 }
 
 impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate>> RuntimeInterface
@@ -172,7 +213,7 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate>> RuntimeInte
     fn emit_event(&self, topic: String, payload: Metadata) -> Result<(), RuntimeError> {
         self.invoke_modules_on_runtime_call("emit_event")?;
 
-        let component_address = self.tracker.runtime_state_component_address()?;
+        let component_address = self.tracker.with_runtime_state(|s| Ok(s.component_address))?;
         let tx_hash = self.tracker.transaction_hash();
         let template_address = self.tracker.get_template_address()?;
 
@@ -206,12 +247,19 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate>> RuntimeInte
     fn caller_context_invoke(&self, action: CallerContextAction) -> Result<InvokeResult, RuntimeError> {
         self.invoke_modules_on_runtime_call("caller_context_invoke")?;
 
-        let sender_public_key = RistrettoPublicKeyBytes::from_bytes(self.sender_public_key.as_bytes()).expect(
-            "RistrettoPublicKeyBytes::from_bytes should be infallible when called with RistrettoPublicKey bytes",
-        );
-
         match action {
-            CallerContextAction::GetCallerPublicKey => Ok(InvokeResult::encode(&sender_public_key)?),
+            CallerContextAction::GetCallerPublicKey => {
+                let sender_public_key = RistrettoPublicKeyBytes::from_bytes(self.sender_public_key.as_bytes()).expect(
+                    "RistrettoPublicKeyBytes::from_bytes should be infallible when called with RistrettoPublicKey \
+                     bytes",
+                );
+
+                Ok(InvokeResult::encode(&sender_public_key)?)
+            },
+            CallerContextAction::GetComponentAddress => {
+                let component_address = self.tracker.with_runtime_state(|s| Ok(s.component_address))?;
+                Ok(InvokeResult::encode(&component_address)?)
+            },
         }
     }
 
@@ -226,11 +274,16 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate>> RuntimeInte
         match action {
             ComponentAction::Create => {
                 let arg: CreateComponentArg = args.get(0)?;
-                let template_def = self.tracker.get_template_def()?;
-                validate_access_rules(&arg.access_rules, &template_def)?;
-                let component_address =
-                    self.tracker
-                        .new_component(arg.encoded_state, arg.access_rules, arg.component_id)?;
+                let template_def = self
+                    .tracker
+                    .with_runtime_state(|runtime_state| self.get_template_def(&runtime_state.template_address))?;
+                validate_component_access_rule_methods(&arg.access_rules, &template_def)?;
+                let component_address = self.tracker.new_component(
+                    arg.encoded_state,
+                    arg.owner_rule,
+                    arg.access_rules,
+                    arg.component_id,
+                )?;
                 Ok(InvokeResult::encode(&component_address)?)
             },
 
@@ -266,9 +319,14 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate>> RuntimeInte
                         argument: "component_ref",
                         reason: "SetAccessRules component action requires a component address".to_string(),
                     })?;
-                let access_rules: AccessRules = args.get(0)?;
+
+                let access_rules: ComponentAccessRules = args.get(0)?;
                 let mut component = self.tracker.get_component(&address)?;
 
+                self.tracker
+                    .authorization()
+                    .require_ownership(ComponentAction::SetAccessRules, component.as_ownership())?;
+
                 component.access_rules = access_rules;
                 self.tracker.set_component(address, component)?;
                 Ok(InvokeResult::unit())
@@ -276,6 +334,7 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate>> RuntimeInte
         }
     }
 
+    #[allow(clippy::too_many_lines)]
     fn resource_invoke(
         &self,
         resource_ref: ResourceRef,
@@ -288,9 +347,13 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate>> RuntimeInte
             ResourceAction::Create => {
                 let arg: CreateResourceArg = args.get(0)?;
 
-                let resource_address =
-                    self.tracker
-                        .new_resource(arg.resource_type, arg.token_symbol.clone(), arg.metadata)?;
+                let resource_address = self.tracker.new_resource(
+                    arg.resource_type,
+                    arg.owner_rule,
+                    arg.access_rules,
+                    arg.token_symbol.clone(),
+                    arg.metadata,
+                )?;
 
                 let mut output_bucket = None;
                 if let Some(mint_arg) = arg.mint_arg {
@@ -310,11 +373,6 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate>> RuntimeInte
                             reason: "GetResourceType resource action requires a resource address".to_string(),
                         })?;
                 let resource = self.tracker.get_resource(&resource_address)?;
-                // TODO: access check
-                // self.check_access_rules(
-                //     FunctionIdent::Native(NativeFunctionCall::Resource(ResourceAction::GetTotalSupply)),
-                //     &component.access_rules,
-                // )?;
                 let total_supply = resource.total_supply();
                 Ok(InvokeResult::encode(&total_supply)?)
             },
@@ -327,7 +385,6 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate>> RuntimeInte
                             reason: "GetResourceType resource action requires a resource address".to_string(),
                         })?;
                 let resource = self.tracker.get_resource(&resource_address)?;
-                // TODO: access check
                 let resource_type = resource.resource_type();
                 Ok(InvokeResult::encode(&resource_type)?)
             },
@@ -340,7 +397,12 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate>> RuntimeInte
                             reason: "Mint resource action requires a resource address".to_string(),
                         })?;
                 let mint_resource: MintResourceArg = args.get(0)?;
-                // TODO: access check
+
+                let resource = self.tracker.get_resource(&resource_address)?;
+                self.tracker
+                    .authorization()
+                    .check_resource_access_rules(ResourceAuthAction::Mint, &resource)?;
+
                 let bucket_id = self.tracker.mint_resource(resource_address, mint_resource.mint_arg)?;
                 let bucket = tari_template_lib::models::Bucket::from_id(bucket_id);
                 Ok(InvokeResult::encode(&bucket)?)
@@ -357,7 +419,7 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate>> RuntimeInte
                 let nf_container = self
                     .tracker
                     .get_non_fungible(&NonFungibleAddress::new(resource_address, arg.id.clone()))?;
-                // TODO: access check
+
                 if nf_container.is_burnt() {
                     return Err(RuntimeError::InvalidOpNonFungibleBurnt {
                         op: "GetNonFungible",
@@ -378,12 +440,36 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate>> RuntimeInte
                             reason: "UpdateNonFungibleData resource action requires a resource address".to_string(),
                         })?;
                 let arg: ResourceUpdateNonFungibleDataArg = args.get(0)?;
-                // TODO: access check
+
+                let resource = self.tracker.get_resource(&resource_address)?;
+                self.tracker
+                    .authorization()
+                    .check_resource_access_rules(ResourceAuthAction::UpdateNonFungibleData, &resource)?;
+
                 self.tracker
                     .set_non_fungible_data(&NonFungibleAddress::new(resource_address, arg.id), arg.data)?;
 
                 Ok(InvokeResult::unit())
             },
+            ResourceAction::UpdateAccessRules => {
+                let resource_address =
+                    resource_ref
+                        .as_resource_address()
+                        .ok_or_else(|| RuntimeError::InvalidArgument {
+                            argument: "resource_ref",
+                            reason: "UpdateAccessRules resource action requires a resource address".to_string(),
+                        })?;
+                let access_rules: ResourceAccessRules = args.get(0)?;
+
+                let resource = self.tracker.get_resource(&resource_address)?;
+                self.tracker
+                    .authorization()
+                    .require_ownership(ResourceAuthAction::UpdateAccessRules, resource.as_ownership())?;
+
+                self.tracker
+                    .set_resource_access_rules(&resource_address, access_rules)?;
+                Ok(InvokeResult::unit())
+            },
         }
     }
 
@@ -404,6 +490,8 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate>> RuntimeInte
                         argument: "vault_ref",
                         reason: "Create vault action requires a resource address".to_string(),
                     })?;
+                args.assert_is_empty("CreateVault")?;
+
                 let resource = self.tracker.get_resource(resource_address)?;
 
                 let vault_id = self.tracker.new_vault(*resource_address, resource.resource_type())?;
@@ -414,10 +502,15 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate>> RuntimeInte
                     argument: "vault_ref",
                     reason: "Put vault action requires a vault id".to_string(),
                 })?;
-                let bucket_id: BucketId = args.get(0)?;
-                // TODO: access check
-
+                let bucket_id: BucketId = args.assert_one_arg()?;
                 let bucket = self.tracker.take_bucket(bucket_id)?;
+
+                let resource_address = self.tracker.borrow_vault(vault_id, |vault| *vault.resource_address())?;
+                let resource = self.tracker.get_resource(&resource_address)?;
+                self.tracker
+                    .authorization()
+                    .check_resource_access_rules(ResourceAuthAction::Deposit, &resource)?;
+
                 self.tracker
                     .borrow_vault_mut(vault_id, |vault| vault.deposit(bucket))??;
                 Ok(InvokeResult::unit())
@@ -425,17 +518,22 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate>> RuntimeInte
             VaultAction::Withdraw => {
                 let vault_id = vault_ref.vault_id().ok_or_else(|| RuntimeError::InvalidArgument {
                     argument: "vault_ref",
-                    reason: "WithdrawFungible vault action requires a vault id".to_string(),
+                    reason: "Withdraw vault action requires a vault id".to_string(),
                 })?;
-                let arg: VaultWithdrawArg = args.get(0)?;
+                let arg: VaultWithdrawArg = args.assert_one_arg()?;
 
-                // TODO: access check
-                let resource = self.tracker.borrow_vault_mut(vault_id, |vault| match arg {
+                let resource_address = self.tracker.borrow_vault(vault_id, |vault| *vault.resource_address())?;
+                let resource = self.tracker.get_resource(&resource_address)?;
+                self.tracker
+                    .authorization()
+                    .check_resource_access_rules(ResourceAuthAction::Withdraw, &resource)?;
+
+                let resource_container = self.tracker.borrow_vault_mut(vault_id, |vault| match arg {
                     VaultWithdrawArg::Fungible { amount } => vault.withdraw(amount),
                     VaultWithdrawArg::NonFungible { ids } => vault.withdraw_non_fungibles(&ids),
                     VaultWithdrawArg::Confidential { proof } => vault.withdraw_confidential(*proof),
                 })??;
-                let bucket = self.tracker.new_bucket(resource)?;
+                let bucket = self.tracker.new_bucket(resource_container)?;
                 Ok(InvokeResult::encode(&bucket)?)
             },
             VaultAction::WithdrawAll => {
@@ -444,6 +542,14 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate>> RuntimeInte
                     reason: "WithdrawAll vault action requires a vault id".to_string(),
                 })?;
 
+                args.assert_is_empty("Vault::WithdrawAll")?;
+
+                let resource_address = self.tracker.borrow_vault(vault_id, |vault| *vault.resource_address())?;
+                let resource = self.tracker.get_resource(&resource_address)?;
+                self.tracker
+                    .authorization()
+                    .check_resource_access_rules(ResourceAuthAction::Withdraw, &resource)?;
+
                 // TODO: access check
                 let resource = self
                     .tracker
@@ -456,7 +562,7 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate>> RuntimeInte
                     argument: "vault_ref",
                     reason: "GetBalance vault action requires a vault id".to_string(),
                 })?;
-                // TODO: access check
+                args.assert_is_empty("Vault::GetBalance")?;
 
                 let balance = self.tracker.borrow_vault(vault_id, |v| v.balance())?;
                 Ok(InvokeResult::encode(&balance)?)
@@ -466,8 +572,8 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate>> RuntimeInte
                     argument: "vault_ref",
                     reason: "vault action requires a vault id".to_string(),
                 })?;
+                args.assert_is_empty("Vault::GetResourceAddress")?;
 
-                // TODO: access check
                 let address = self
                     .tracker
                     .borrow_vault_mut(vault_id, |vault| *vault.resource_address())?;
@@ -478,11 +584,10 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate>> RuntimeInte
                     argument: "vault_ref",
                     reason: "vault action requires a vault id".to_string(),
                 })?;
+                args.assert_is_empty("Vault::GetNonFungibleIds")?;
 
-                // TODO: access check
                 let resp = self.tracker.borrow_vault(vault_id, |vault| {
-                    let empty = BTreeSet::new();
-                    let ids = vault.get_non_fungible_ids().unwrap_or(&empty);
+                    let ids = vault.get_non_fungible_ids();
                     // NOTE: A BTreeSet does not decode when received in the WASM
                     InvokeResult::encode(&ids.iter().collect::<Vec<_>>())
                 })??;
@@ -495,6 +600,8 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate>> RuntimeInte
                     reason: "vault action requires a vault id".to_string(),
                 })?;
 
+                args.assert_is_empty("Vault::GetCommitmentCount")?;
+
                 self.tracker.borrow_vault(vault_id, |vault| {
                     let count = vault.get_commitment_count();
                     Ok(InvokeResult::encode(&count)?)
@@ -503,10 +610,16 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate>> RuntimeInte
             VaultAction::ConfidentialReveal => {
                 let vault_id = vault_ref.vault_id().ok_or_else(|| RuntimeError::InvalidArgument {
                     argument: "vault_ref",
-                    reason: "vault action requires a vault id".to_string(),
+                    reason: "Vault::ConfidentialReveal action requires a vault id".to_string(),
                 })?;
 
-                let arg: ConfidentialRevealArg = args.get(0)?;
+                let arg: ConfidentialRevealArg = args.assert_one_arg()?;
+
+                let resource_address = self.tracker.borrow_vault(vault_id, |vault| *vault.resource_address())?;
+                let resource = self.tracker.get_resource(&resource_address)?;
+                self.tracker
+                    .authorization()
+                    .check_resource_access_rules(ResourceAuthAction::Withdraw, &resource)?;
 
                 // TODO: access check
                 let resource = self
@@ -519,10 +632,10 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate>> RuntimeInte
             VaultAction::PayFee => {
                 let vault_id = vault_ref.vault_id().ok_or_else(|| RuntimeError::InvalidArgument {
                     argument: "vault_ref",
-                    reason: "vault action requires a vault id".to_string(),
+                    reason: "PayFee vault action requires a vault id".to_string(),
                 })?;
 
-                let arg: PayFeeArg = args.get(0)?;
+                let arg: PayFeeArg = args.assert_one_arg()?;
                 if arg.amount.is_negative() {
                     return Err(RuntimeError::InvalidArgument {
                         argument: "amount",
@@ -530,6 +643,12 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate>> RuntimeInte
                     });
                 }
 
+                let resource_address = self.tracker.borrow_vault(vault_id, |vault| *vault.resource_address())?;
+                let resource = self.tracker.get_resource(&resource_address)?;
+                self.tracker
+                    .authorization()
+                    .check_resource_access_rules(ResourceAuthAction::Withdraw, &resource)?;
+
                 let resource = self.tracker.borrow_vault_mut(vault_id, |vault| {
                     let mut resource = ResourceContainer::confidential(*vault.resource_address(), None, Amount::zero());
                     if !arg.amount.is_zero() {
@@ -552,6 +671,65 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate>> RuntimeInte
                 self.tracker.pay_fee(resource, vault_id)?;
                 Ok(InvokeResult::unit())
             },
+            VaultAction::CreateProofByResource => {
+                let vault_id = vault_ref.vault_id().ok_or_else(|| RuntimeError::InvalidArgument {
+                    argument: "vault_ref",
+                    reason: "CreateProofByResource vault action requires a vault id".to_string(),
+                })?;
+                args.assert_is_empty("CreateProofByResource")?;
+
+                let resource_address = self.tracker.borrow_vault(vault_id, |vault| *vault.resource_address())?;
+                let resource = self.tracker.get_resource(&resource_address)?;
+                self.tracker
+                    .authorization()
+                    .check_resource_access_rules(ResourceAuthAction::Withdraw, &resource)?;
+
+                let locked = self.tracker.borrow_vault_mut(vault_id, |vault| vault.lock_all())??;
+                let proof_id = self.tracker.new_proof(locked)?;
+                self.tracker.add_proof_to_auth_scope(proof_id)?;
+                Ok(InvokeResult::encode(&proof_id)?)
+            },
+            VaultAction::CreateProofByFungibleAmount => {
+                let vault_id = vault_ref.vault_id().ok_or_else(|| RuntimeError::InvalidArgument {
+                    argument: "vault_ref",
+                    reason: "CreateProofByFungibleAmount vault action requires a vault id".to_string(),
+                })?;
+                let arg: VaultCreateProofByFungibleAmountArg = args.assert_one_arg()?;
+
+                let resource_address = self.tracker.borrow_vault(vault_id, |vault| *vault.resource_address())?;
+                let resource = self.tracker.get_resource(&resource_address)?;
+                self.tracker
+                    .authorization()
+                    .check_resource_access_rules(ResourceAuthAction::Withdraw, &resource)?;
+
+                let locked = self
+                    .tracker
+                    .borrow_vault_mut(vault_id, |vault| vault.lock_by_amount(arg.amount))??;
+                let proof_id = self.tracker.new_proof(locked)?;
+                self.tracker.add_proof_to_auth_scope(proof_id)?;
+                Ok(InvokeResult::encode(&proof_id)?)
+            },
+            VaultAction::CreateProofByNonFungibles => {
+                let vault_id = vault_ref.vault_id().ok_or_else(|| RuntimeError::InvalidArgument {
+                    argument: "vault_ref",
+                    reason: "CreateProofByNonFungibles vault action requires a vault id".to_string(),
+                })?;
+                let arg: VaultCreateProofByNonFungiblesArg = args.assert_one_arg()?;
+
+                let resource_address = self.tracker.borrow_vault(vault_id, |vault| *vault.resource_address())?;
+                let resource = self.tracker.get_resource(&resource_address)?;
+                self.tracker
+                    .authorization()
+                    .check_resource_access_rules(ResourceAuthAction::Withdraw, &resource)?;
+
+                let locked = self
+                    .tracker
+                    .borrow_vault_mut(vault_id, |vault| vault.lock_by_non_fungible_ids(arg.ids))??;
+                let proof_id = self.tracker.new_proof(locked)?;
+                self.tracker.add_proof_to_auth_scope(proof_id)?;
+                Ok(InvokeResult::encode(&proof_id)?)
+            },
+            VaultAction::CreateProofByConfidentialResource => todo!("CreateProofByConfidentialResource"),
         }
     }
 
@@ -564,42 +742,30 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate>> RuntimeInte
         self.invoke_modules_on_runtime_call("bucket_invoke")?;
 
         match action {
-            BucketAction::Create => {
-                let resource_address = bucket_ref
-                    .resource_address()
-                    .ok_or_else(|| RuntimeError::InvalidArgument {
-                        argument: "bucket_ref",
-                        reason: "Create bucket action requires a resource address".to_string(),
-                    })?;
-                let resource = self.tracker.get_resource(&resource_address)?;
-                let bucket_id = self
-                    .tracker
-                    .new_empty_bucket(resource_address, resource.resource_type())?;
-                Ok(InvokeResult::encode(&bucket_id)?)
-            },
             BucketAction::GetResourceAddress => {
                 let bucket_id = bucket_ref.bucket_id().ok_or_else(|| RuntimeError::InvalidArgument {
                     argument: "bucket_ref",
                     reason: "GetResourceAddress action requires a bucket id".to_string(),
                 })?;
-                let bucket = self.tracker.get_bucket(bucket_id)?;
-                Ok(InvokeResult::encode(bucket.resource_address())?)
+
+                self.tracker
+                    .borrow_bucket(bucket_id, |bucket| Ok(InvokeResult::encode(bucket.resource_address())?))?
             },
             BucketAction::GetResourceType => {
                 let bucket_id = bucket_ref.bucket_id().ok_or_else(|| RuntimeError::InvalidArgument {
                     argument: "bucket_ref",
                     reason: "GetResourceType action requires a bucket id".to_string(),
                 })?;
-                let bucket = self.tracker.get_bucket(bucket_id)?;
-                Ok(InvokeResult::encode(&bucket.resource_type())?)
+                self.tracker
+                    .borrow_bucket(bucket_id, |bucket| Ok(InvokeResult::encode(&bucket.resource_type())?))?
             },
             BucketAction::GetAmount => {
                 let bucket_id = bucket_ref.bucket_id().ok_or_else(|| RuntimeError::InvalidArgument {
                     argument: "bucket_ref",
                     reason: "GetAmount bucket action requires a bucket id".to_string(),
                 })?;
-                let bucket = self.tracker.get_bucket(bucket_id)?;
-                Ok(InvokeResult::encode(&bucket.amount())?)
+                self.tracker
+                    .borrow_bucket(bucket_id, |bucket| Ok(InvokeResult::encode(&bucket.amount())?))?
             },
             BucketAction::Take => {
                 let bucket_id = bucket_ref.bucket_id().ok_or_else(|| RuntimeError::InvalidArgument {
@@ -642,12 +808,96 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate>> RuntimeInte
                     argument: "bucket_ref",
                     reason: "Burn bucket action requires a bucket id".to_string(),
                 })?;
+
+                // Check access
+                let resource_address = self
+                    .tracker
+                    .borrow_bucket(bucket_id, |bucket| *bucket.resource_address())?;
+                let resource = self.tracker.get_resource(&resource_address)?;
+                self.tracker
+                    .authorization()
+                    .check_resource_access_rules(ResourceAuthAction::Burn, &resource)?;
+
                 self.tracker.burn_bucket(bucket_id)?;
                 Ok(InvokeResult::unit())
             },
         }
     }
 
+    fn proof_invoke(
+        &self,
+        proof_ref: ProofRef,
+        action: ProofAction,
+        args: EngineArgs,
+    ) -> Result<InvokeResult, RuntimeError> {
+        match action {
+            ProofAction::GetAmount => {
+                let proof_id = proof_ref.proof_id().ok_or_else(|| RuntimeError::InvalidArgument {
+                    argument: "proof_ref",
+                    reason: "GetAmount proof action requires a proof id".to_string(),
+                })?;
+                args.assert_is_empty("Proof.GetAmount")?;
+                self.tracker
+                    .borrow_proof(&proof_id, |proof| Ok(InvokeResult::encode(&proof.amount())?))?
+            },
+            ProofAction::GetResourceAddress => {
+                let proof_id = proof_ref.proof_id().ok_or_else(|| RuntimeError::InvalidArgument {
+                    argument: "proof_ref",
+                    reason: "GetResourceAddress proof action requires a proof id".to_string(),
+                })?;
+                args.assert_is_empty("Proof.GetResourceAddress")?;
+                self.tracker
+                    .borrow_proof(&proof_id, |proof| Ok(InvokeResult::encode(proof.resource_address())?))?
+            },
+            ProofAction::GetResourceType => {
+                let proof_id = proof_ref.proof_id().ok_or_else(|| RuntimeError::InvalidArgument {
+                    argument: "proof_ref",
+                    reason: "GetResourceType proof action requires a proof id".to_string(),
+                })?;
+
+                args.assert_is_empty("Proof.GetResourceType")?;
+
+                self.tracker
+                    .borrow_proof(&proof_id, |proof| Ok(InvokeResult::encode(&proof.resource_type())?))?
+            },
+            ProofAction::Authorize => {
+                let proof_id = proof_ref.proof_id().ok_or_else(|| RuntimeError::InvalidArgument {
+                    argument: "proof_ref",
+                    reason: "Authorize proof action requires a proof id".to_string(),
+                })?;
+                args.assert_is_empty("Proof.CreateAccess")?;
+
+                if self.tracker.add_proof_to_auth_scope(proof_id).optional()?.is_some() {
+                    Ok(InvokeResult::encode(&Ok::<_, NotAuthorized>(()))?)
+                } else {
+                    Ok(InvokeResult::encode(&Err::<(), _>(NotAuthorized))?)
+                }
+            },
+            ProofAction::DropAuthorize => {
+                let proof_id = proof_ref.proof_id().ok_or_else(|| RuntimeError::InvalidArgument {
+                    argument: "proof_ref",
+                    reason: "DropAuthorize proof action requires a proof id".to_string(),
+                })?;
+                args.assert_is_empty("Proof.DropAuthorize")?;
+
+                self.tracker.remove_proof_from_auth_scope(&proof_id)?;
+
+                Ok(InvokeResult::unit())
+            },
+            ProofAction::Drop => {
+                let proof_id = proof_ref.proof_id().ok_or_else(|| RuntimeError::InvalidArgument {
+                    argument: "proof_ref",
+                    reason: "Drop proof action requires a proof id".to_string(),
+                })?;
+                args.assert_is_empty("Proof.Drop")?;
+
+                self.tracker.drop_proof(proof_id)?;
+
+                Ok(InvokeResult::unit())
+            },
+        }
+    }
+
     fn workspace_invoke(&self, action: WorkspaceAction, args: EngineArgs) -> Result<InvokeResult, RuntimeError> {
         self.invoke_modules_on_runtime_call("workspace_invoke")?;
         match action {
@@ -655,7 +905,6 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate>> RuntimeInte
                 let bucket_ids = self.tracker.list_buckets();
                 Ok(InvokeResult::encode(&bucket_ids)?)
             },
-            WorkspaceAction::Put => todo!(),
             // Basically names an output on the workspace so that you can refer to it as an
             // Arg::Variable
             WorkspaceAction::PutLastInstructionOutput => {
@@ -664,13 +913,29 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate>> RuntimeInte
                     .tracker
                     .take_last_instruction_output()
                     .ok_or(RuntimeError::NoLastInstructionOutput)?;
-                self.tracker.put_in_workspace(key, last_output)?;
+
+                self.validate_return_value(&last_output)?;
+
+                self.tracker
+                    .with_workspace_mut(|workspace| workspace.insert(key, last_output))?;
                 Ok(InvokeResult::unit())
             },
             WorkspaceAction::Get => {
                 let key: Vec<u8> = args.get(0)?;
                 let value = self.tracker.get_from_workspace(&key)?;
-                Ok(InvokeResult::encode(&value)?)
+                Ok(InvokeResult::encode(value.value())?)
+            },
+
+            WorkspaceAction::DropAllProofs => {
+                let proofs = self
+                    .tracker
+                    .with_workspace_mut(|workspace| workspace.drain_all_proofs());
+
+                for proof_id in proofs {
+                    self.tracker.drop_proof(proof_id)?;
+                }
+
+                Ok(InvokeResult::unit())
             },
         }
     }
@@ -736,38 +1001,30 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate>> RuntimeInte
         self.invoke_modules_on_runtime_call("call_invoke")?;
 
         // we are initializing a new runtime for the nested call
-        let call_runtime_interface = RuntimeInterfaceImpl::initialize(
+        // Push current auth scopes out of scope, so that they do not apply to the cross-template call
+        self.tracker.push_auth_scope();
+        let call_runtime = Runtime::new(Arc::new(RuntimeInterfaceImpl::initialize(
             self.tracker.clone(),
-            // for safety reasons we are not going to propagate proofs to the call component or template
-            AuthParams {
-                initial_ownership_proofs: vec![],
-            },
+            self.template_provider.clone(),
             self.sender_public_key.clone(),
             self.modules.clone(),
-        )?;
-
-        // for safety reasons, we explicitly avoid propagating any auth scope to the template/component we are calling
-        // so all nested calls can only be done to not auth restricted template methods.
-        // this prevents, for example, to withdraw from an account in a nested call
-        let auth_scope = AuthorizationScope::new(Arc::new(vec![]));
+        )?));
 
         // extract all the common required information for both types of calls
-        let template_provider = self.tracker.get_template_provider();
-        let current_runtime_state = self.tracker.runtime_state()?;
-        let max_recursion_depth = current_runtime_state.max_recursion_depth;
+        // the runtime state will be overridden by the call so we store a copy to revert back afterwards
+        let caller_runtime_state = self.tracker.clone_runtime_state()?;
+        let max_recursion_depth = caller_runtime_state.max_recursion_depth;
 
         // a nested call starts with an increased recursion depth
-        let new_recursion_depth = current_runtime_state.recursion_depth + 1;
-
-        // the runtime state will be overriden by the call so we store a copy to revert back afterwards
-        let caller_runtime_state = self.tracker.runtime_state()?;
+        let new_recursion_depth = caller_runtime_state.recursion_depth + 1;
 
         let exec_result = match action {
             CallAction::CallFunction => {
                 // extract the args from the invoke operation
                 let arg: CallFunctionArg = args.get(0)?;
                 let template_address = arg.template_address;
-                let template_name = template_provider
+                let template_name = self
+                    .template_provider
                     .get_template_module(&template_address)
                     .map_err(|e| RuntimeError::FailedToLoadTemplate {
                         address: template_address,
@@ -777,22 +1034,21 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate>> RuntimeInte
                     .template_name()
                     .to_string();
                 let function = arg.function;
-                let args = arg.args.into_iter().map(Arg::Literal).collect();
+                let args = arg.args;
 
                 let new_state = RuntimeState {
                     template_name,
                     template_address,
+                    transaction_signer_public_key: caller_runtime_state.transaction_signer_public_key,
                     component_address: None,
                     recursion_depth: new_recursion_depth,
                     max_recursion_depth,
                 };
-                call_runtime_interface.set_current_runtime_state(new_state)?;
-                let call_runtime = Runtime::new(Arc::new(call_runtime_interface));
+                call_runtime.interface().set_current_runtime_state(new_state)?;
 
                 TransactionProcessor::call_function(
-                    template_provider,
+                    &*self.template_provider,
                     &call_runtime,
-                    auth_scope,
                     &template_address,
                     &function,
                     // TODO: put in rest of args
@@ -814,22 +1070,21 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate>> RuntimeInte
                 let template_name = component_header.module_name;
                 let template_address = component_header.template_address;
                 let method = arg.method;
-                let args = arg.args.into_iter().map(Arg::Literal).collect();
+                let args = arg.args;
 
                 let new_state = RuntimeState {
                     template_name,
                     template_address,
+                    transaction_signer_public_key: caller_runtime_state.transaction_signer_public_key,
                     component_address: Some(component_address),
                     recursion_depth: new_recursion_depth,
                     max_recursion_depth,
                 };
-                call_runtime_interface.set_current_runtime_state(new_state)?;
-                let call_runtime = Runtime::new(Arc::new(call_runtime_interface));
+                call_runtime.interface().set_current_runtime_state(new_state)?;
 
                 TransactionProcessor::call_method(
-                    template_provider,
+                    &*self.template_provider,
                     &call_runtime,
-                    auth_scope,
                     &component_address,
                     &method,
                     args,
@@ -844,7 +1099,8 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate>> RuntimeInte
             },
         };
 
-        // the runtime state was overriden by the call so we revert
+        self.tracker.pop_auth_scope()?;
+        // the runtime state was overridden by the call so we revert
         self.tracker.set_current_runtime_state(caller_runtime_state);
 
         Ok(InvokeResult::raw(exec_result.raw))
@@ -856,7 +1112,7 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate>> RuntimeInte
         Ok(uuid)
     }
 
-    fn set_last_instruction_output(&self, value: Option<Vec<u8>>) -> Result<(), RuntimeError> {
+    fn set_last_instruction_output(&self, value: IndexedValue) -> Result<(), RuntimeError> {
         self.invoke_modules_on_runtime_call("set_last_instruction_output")?;
         self.tracker.set_last_instruction_output(value);
         Ok(())
@@ -879,11 +1135,7 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate>> RuntimeInte
             .chain_update(&self.sender_public_key)
             .result();
 
-        if !proof_of_knowledge.verify(
-            &unclaimed_output.commitment,
-            &RistrettoSecretKey::from_bytes(&challenge).map_err(|_e| RuntimeError::InvalidClaimingSignature)?,
-            get_commitment_factory(),
-        ) {
+        if !proof_of_knowledge.verify_challenge(&unclaimed_output.commitment, &challenge, get_commitment_factory()) {
             warn!(target: LOG_TARGET, "Claim burn failed - Invalid signature");
             return Err(RuntimeError::InvalidClaimingSignature);
         }
@@ -917,15 +1169,16 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate>> RuntimeInte
         }
 
         let bucket_id = self.tracker.new_bucket(resource)?;
-
-        self.tracker.set_last_instruction_output(Some(encode(&bucket_id)?));
+        self.tracker
+            .set_last_instruction_output(IndexedValue::from_type(&bucket_id)?);
         Ok(())
     }
 
     fn claim_validator_fees(&self, epoch: Epoch, validator_public_key: PublicKey) -> Result<(), RuntimeError> {
         let resource = self.tracker.claim_fee(epoch, validator_public_key)?;
         let bucket_id = self.tracker.new_bucket(resource)?;
-        self.tracker.set_last_instruction_output(Some(encode(&bucket_id)?));
+        self.tracker
+            .set_last_instruction_output(IndexedValue::from_type(&bucket_id)?);
         Ok(())
     }
 
@@ -941,7 +1194,8 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate>> RuntimeInte
         );
 
         let bucket_id = self.tracker.new_bucket(resource)?;
-        self.tracker.set_last_instruction_output(Some(encode(&bucket_id)?));
+        self.tracker
+            .set_last_instruction_output(IndexedValue::from_type(&bucket_id)?);
         Ok(bucket_id)
     }
 
@@ -989,9 +1243,22 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate>> RuntimeInte
 
         Ok(StateFinalize { finalized, fee_receipt })
     }
+
+    fn get_transaction_signer_public_key(&self) -> Result<RistrettoPublicKey, RuntimeError> {
+        Ok(self.sender_public_key.clone())
+    }
+
+    fn check_component_access_rules(&self, method: &str, component: &ComponentHeader) -> Result<(), RuntimeError> {
+        self.tracker
+            .authorization()
+            .check_component_access_rules(method, component)
+    }
 }
 
-fn validate_access_rules(access_rules: &AccessRules, template_def: &TemplateDef) -> Result<(), RuntimeError> {
+fn validate_component_access_rule_methods(
+    access_rules: &ComponentAccessRules,
+    template_def: &TemplateDef,
+) -> Result<(), RuntimeError> {
     for (name, _) in access_rules.method_access_rules_iter() {
         if template_def.functions.iter().all(|f| f.name != *name) {
             return Err(RuntimeError::InvalidMethodAccessRule {
diff --git a/dan_layer/engine/src/runtime/mod.rs b/dan_layer/engine/src/runtime/mod.rs
index 1bdb211eec..b1bdd4c251 100644
--- a/dan_layer/engine/src/runtime/mod.rs
+++ b/dan_layer/engine/src/runtime/mod.rs
@@ -32,8 +32,8 @@ pub use crate::runtime::engine_args::EngineArgs;
 mod error;
 pub use error::{RuntimeError, TransactionCommitError};
 
-mod functions;
-pub use functions::FunctionIdent;
+mod actions;
+pub use actions::*;
 
 mod module;
 pub use module::{RuntimeModule, RuntimeModuleError};
@@ -44,16 +44,20 @@ mod tracker;
 mod virtual_substate;
 pub use virtual_substate::VirtualSubstates;
 
+mod tracker_auth;
 mod working_state;
 mod workspace;
 
 use std::{fmt::Debug, sync::Arc};
 
+use tari_bor::decode;
 use tari_common_types::types::PublicKey;
+use tari_crypto::ristretto::RistrettoPublicKey;
 use tari_dan_common_types::Epoch;
 use tari_engine_types::{
     component::ComponentHeader,
     confidential::{ConfidentialClaim, ConfidentialOutput},
+    indexed_value::IndexedValue,
 };
 use tari_template_lib::{
     args::{
@@ -69,6 +73,8 @@ use tari_template_lib::{
         InvokeResult,
         LogLevel,
         NonFungibleAction,
+        ProofAction,
+        ProofRef,
         ResourceAction,
         ResourceRef,
         VaultAction,
@@ -116,6 +122,12 @@ pub trait RuntimeInterface: Send + Sync {
         args: EngineArgs,
     ) -> Result<InvokeResult, RuntimeError>;
 
+    fn proof_invoke(
+        &self,
+        proof_ref: ProofRef,
+        action: ProofAction,
+        args: EngineArgs,
+    ) -> Result<InvokeResult, RuntimeError>;
     fn workspace_invoke(&self, action: WorkspaceAction, args: EngineArgs) -> Result<InvokeResult, RuntimeError>;
 
     fn non_fungible_invoke(
@@ -131,7 +143,7 @@ pub trait RuntimeInterface: Send + Sync {
 
     fn generate_uuid(&self) -> Result<[u8; 32], RuntimeError>;
 
-    fn set_last_instruction_output(&self, value: Option<Vec<u8>>) -> Result<(), RuntimeError>;
+    fn set_last_instruction_output(&self, value: IndexedValue) -> Result<(), RuntimeError>;
 
     fn claim_burn(&self, claim: ConfidentialClaim) -> Result<(), RuntimeError>;
 
@@ -149,6 +161,10 @@ pub trait RuntimeInterface: Send + Sync {
     fn caller_context_invoke(&self, action: CallerContextAction) -> Result<InvokeResult, RuntimeError>;
 
     fn call_invoke(&self, action: CallAction, args: EngineArgs) -> Result<InvokeResult, RuntimeError>;
+
+    fn get_transaction_signer_public_key(&self) -> Result<RistrettoPublicKey, RuntimeError>;
+
+    fn check_component_access_rules(&self, method: &str, component: &ComponentHeader) -> Result<(), RuntimeError>;
 }
 
 #[derive(Clone)]
@@ -157,7 +173,7 @@ pub struct Runtime {
 }
 
 impl Runtime {
-    pub(crate) fn resolve_args(&self, args: Vec<Arg>) -> Result<Vec<Vec<u8>>, RuntimeError> {
+    pub(crate) fn resolve_args(&self, args: &[Arg]) -> Result<Vec<tari_bor::Value>, RuntimeError> {
         let mut resolved = Vec::with_capacity(args.len());
         for arg in args {
             match arg {
@@ -167,7 +183,7 @@ impl Runtime {
                         .workspace_invoke(WorkspaceAction::Get, invoke_args![key].into())?;
                     resolved.push(value.decode()?);
                 },
-                Arg::Literal(v) => resolved.push(v),
+                Arg::Literal(v) => resolved.push(decode(v)?),
             }
         }
         Ok(resolved)
diff --git a/dan_layer/engine/src/runtime/module.rs b/dan_layer/engine/src/runtime/module.rs
index 030a3139c9..5b995315a3 100644
--- a/dan_layer/engine/src/runtime/module.rs
+++ b/dan_layer/engine/src/runtime/module.rs
@@ -3,27 +3,22 @@
 
 use std::collections::HashMap;
 
-use tari_dan_common_types::services::template_provider::TemplateProvider;
 use tari_engine_types::substate::{SubstateAddress, SubstateValue};
 
-use crate::{packager::LoadedTemplate, runtime::StateTracker};
+use crate::runtime::StateTracker;
 
-pub trait RuntimeModule<TTemplateProvider: TemplateProvider<Template = LoadedTemplate>>: Send + Sync {
-    fn on_initialize(&self, _track: &StateTracker<TTemplateProvider>) -> Result<(), RuntimeModuleError> {
+pub trait RuntimeModule: Send + Sync {
+    fn on_initialize(&self, _track: &StateTracker) -> Result<(), RuntimeModuleError> {
         Ok(())
     }
 
-    fn on_runtime_call(
-        &self,
-        _track: &StateTracker<TTemplateProvider>,
-        _call: &'static str,
-    ) -> Result<(), RuntimeModuleError> {
+    fn on_runtime_call(&self, _track: &StateTracker, _call: &'static str) -> Result<(), RuntimeModuleError> {
         Ok(())
     }
 
     fn on_before_finalize(
         &self,
-        _track: &StateTracker<TTemplateProvider>,
+        _track: &StateTracker,
         _changes: &HashMap<SubstateAddress, SubstateValue>,
     ) -> Result<(), RuntimeModuleError> {
         Ok(())
diff --git a/dan_layer/engine/src/runtime/tracker.rs b/dan_layer/engine/src/runtime/tracker.rs
index 824d01052b..1a8c600bdd 100644
--- a/dan_layer/engine/src/runtime/tracker.rs
+++ b/dan_layer/engine/src/runtime/tracker.rs
@@ -30,12 +30,7 @@ use std::{
 
 use log::debug;
 use tari_common_types::types::PublicKey;
-use tari_dan_common_types::{
-    optional::Optional,
-    services::template_provider::TemplateProvider,
-    Epoch,
-    NodeAddressable,
-};
+use tari_dan_common_types::{optional::Optional, Epoch, NodeAddressable};
 use tari_engine_types::{
     bucket::Bucket,
     commit_result::{RejectReason, TransactionResult},
@@ -44,9 +39,11 @@ use tari_engine_types::{
     events::Event,
     fee_claim::FeeClaimAddress,
     fees::{FeeReceipt, FeeSource},
+    indexed_value::IndexedValue,
     logs::LogEntry,
     non_fungible::NonFungibleContainer,
     non_fungible_index::NonFungibleIndex,
+    proof::{LockedResource, Proof},
     resource::Resource,
     resource_container::ResourceContainer,
     substate::{Substate, SubstateAddress, SubstateDiff, SubstateValue},
@@ -54,11 +51,11 @@ use tari_engine_types::{
     vault::Vault,
     TemplateAddress,
 };
-use tari_template_abi::TemplateDef;
 use tari_template_lib::{
     args::MintArg,
-    auth::AccessRules,
+    auth::{ComponentAccessRules, OwnerRule, ResourceAccessRules},
     constants::CONFIDENTIAL_TARI_RESOURCE_ADDRESS,
+    crypto::RistrettoPublicKeyBytes,
     models::{
         Amount,
         BucketId,
@@ -66,6 +63,7 @@ use tari_template_lib::{
         Metadata,
         NonFungibleAddress,
         NonFungibleIndexAddress,
+        ProofId,
         ResourceAddress,
         UnclaimedConfidentialOutputAddress,
         VaultId,
@@ -76,10 +74,12 @@ use tari_template_lib::{
 use tari_transaction::id_provider::IdProvider;
 
 use crate::{
-    packager::LoadedTemplate,
     runtime::{
         fee_state::FeeState,
+        tracker_auth::Authorization,
         working_state::WorkingState,
+        workspace::Workspace,
+        AuthorizationScope,
         RuntimeError,
         TransactionCommitError,
         VirtualSubstates,
@@ -97,11 +97,10 @@ pub struct FinalizeTracker {
 }
 
 #[derive(Debug, Clone)]
-pub struct StateTracker<TTemplateProvider: TemplateProvider<Template = LoadedTemplate>> {
+pub struct StateTracker {
     working_state: Arc<RwLock<WorkingState>>,
     fee_state: Arc<RwLock<FeeState>>,
     id_provider: IdProvider,
-    template_provider: Arc<TTemplateProvider>,
     fee_checkpoint: Arc<Mutex<Option<WorkingState>>>,
 }
 
@@ -109,23 +108,27 @@ pub struct StateTracker<TTemplateProvider: TemplateProvider<Template = LoadedTem
 pub struct RuntimeState {
     pub template_name: String,
     pub template_address: TemplateAddress,
+    pub transaction_signer_public_key: RistrettoPublicKeyBytes,
     pub component_address: Option<ComponentAddress>,
     pub recursion_depth: usize,
     pub max_recursion_depth: usize,
 }
 
-impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate>> StateTracker<TTemplateProvider> {
+impl StateTracker {
     pub fn new(
         state_store: MemoryStateStore,
         id_provider: IdProvider,
-        template_provider: Arc<TTemplateProvider>,
         virtual_substates: VirtualSubstates,
+        auth_scope: AuthorizationScope,
     ) -> Self {
         Self {
-            working_state: Arc::new(RwLock::new(WorkingState::new(state_store, virtual_substates))),
+            working_state: Arc::new(RwLock::new(WorkingState::new(
+                state_store,
+                virtual_substates,
+                auth_scope,
+            ))),
             fee_state: Arc::new(RwLock::new(FeeState::new())),
             id_provider,
-            template_provider,
             fee_checkpoint: Arc::new(Mutex::new(None)),
         }
     }
@@ -150,26 +153,6 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate>> StateTracke
         self.write_with(|state| mem::take(&mut state.logs))
     }
 
-    pub fn get_template_provider(&self) -> Arc<TTemplateProvider> {
-        self.template_provider.clone()
-    }
-
-    pub fn get_template_def(&self) -> Result<TemplateDef, RuntimeError> {
-        let runtime_state = self.runtime_state()?;
-        Ok(self
-            .template_provider
-            .get_template_module(&runtime_state.template_address)
-            .map_err(|e| RuntimeError::FailedToLoadTemplate {
-                address: runtime_state.template_address,
-                details: e.to_string(),
-            })?
-            .ok_or(RuntimeError::TemplateNotFound {
-                template_address: runtime_state.template_address,
-            })?
-            .template_def()
-            .clone())
-    }
-
     fn check_amount(&self, amount: Amount) -> Result<(), RuntimeError> {
         if amount.is_negative() {
             return Err(RuntimeError::InvalidAmount {
@@ -181,21 +164,34 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate>> StateTracke
     }
 
     pub fn get_template_address(&self) -> Result<TemplateAddress, RuntimeError> {
-        Ok(self.runtime_state()?.template_address)
+        self.with_runtime_state(|s| Ok(s.template_address))
     }
 
     pub fn new_resource(
         &self,
         resource_type: ResourceType,
+        owner_rule: OwnerRule,
+        access_rules: ResourceAccessRules,
         token_symbol: String,
         metadata: Metadata,
     ) -> Result<ResourceAddress, RuntimeError> {
-        let resource_address = self.id_provider.new_resource_address()?;
-        let resource = Resource::new(resource_type, token_symbol, metadata);
         self.write_with(|state| {
+            let runtime_state = state.runtime_state()?;
+            let resource_address = self.id_provider.new_resource_address()?;
+
+            let resource = Resource::new(
+                resource_type,
+                runtime_state.transaction_signer_public_key,
+                owner_rule,
+                access_rules,
+                token_symbol,
+                metadata,
+            );
+
             state.new_resources.insert(resource_address, resource);
-        });
-        Ok(resource_address)
+
+            Ok(resource_address)
+        })
     }
 
     pub fn mint_resource(
@@ -274,6 +270,13 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate>> StateTracke
         Ok(bucket)
     }
 
+    pub fn resource_exists(&self, resource_address: &ResourceAddress) -> Result<bool, RuntimeError> {
+        self.read_with(|state| {
+            Ok(state.new_resources.contains_key(resource_address) ||
+                state.substate_exists_in_state_store(*resource_address)?)
+        })
+    }
+
     pub fn get_resource(&self, address: &ResourceAddress) -> Result<Resource, RuntimeError> {
         self.read_with(|state| state.get_resource(address))
     }
@@ -296,11 +299,23 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate>> StateTracke
         })
     }
 
+    pub fn set_resource_access_rules(
+        &self,
+        address: &ResourceAddress,
+        access_rules: ResourceAccessRules,
+    ) -> Result<(), RuntimeError> {
+        self.write_with(|state| {
+            state.borrow_resource_mut(address, move |resource| {
+                resource.set_access_rules(access_rules);
+            })
+        })
+    }
+
     pub fn new_bucket(&self, resource: ResourceContainer) -> Result<BucketId, RuntimeError> {
         self.write_with(|state| {
             let bucket_id = self.id_provider.new_bucket_id();
             debug!(target: LOG_TARGET, "New bucket: {}", bucket_id);
-            let bucket = Bucket::new(resource);
+            let bucket = Bucket::new(bucket_id, resource);
             state.buckets.insert(bucket_id, bucket);
             Ok(bucket_id)
         })
@@ -322,7 +337,7 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate>> StateTracke
                 ResourceType::NonFungible => ResourceContainer::non_fungible(resource_address, BTreeSet::new()),
                 ResourceType::Confidential => ResourceContainer::confidential(resource_address, None, Amount::zero()),
             };
-            let bucket = Bucket::new(new_state);
+            let bucket = Bucket::new(bucket_id, new_state);
             state.buckets.insert(bucket_id, bucket);
             Ok(bucket_id)
         })
@@ -336,16 +351,20 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate>> StateTracke
         self.read_with(|state| state.buckets.keys().copied().collect())
     }
 
-    pub fn get_bucket(&self, bucket_id: BucketId) -> Result<Bucket, RuntimeError> {
+    pub fn borrow_bucket<F: FnOnce(&Bucket) -> R, R>(&self, bucket_id: BucketId, f: F) -> Result<R, RuntimeError> {
         self.read_with(|state| {
             state
                 .buckets
                 .get(&bucket_id)
-                .cloned()
                 .ok_or(RuntimeError::BucketNotFound { bucket_id })
+                .map(f)
         })
     }
 
+    pub fn bucket_exists(&self, bucket_id: &BucketId) -> bool {
+        self.read_with(|state| state.buckets.contains_key(bucket_id))
+    }
+
     pub fn with_bucket_mut<R, F: FnOnce(&mut Bucket) -> R>(
         &self,
         bucket_id: BucketId,
@@ -369,6 +388,8 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate>> StateTracke
             let resource_address = *bucket.resource_address();
             let burnt_amount = bucket.amount();
             let mut resource = state.get_resource(&resource_address)?;
+            // Burn Non-fungibles (if resource is nf). Fungibles are burnt by removing the bucket from the tracker state
+            // and not depositing it.
             for token_id in bucket.into_non_fungible_ids().into_iter().flatten() {
                 let address = NonFungibleAddress::new(resource_address, token_id);
                 let mut nft = state.get_non_fungible(&address)?;
@@ -391,6 +412,56 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate>> StateTracke
         })
     }
 
+    pub fn new_proof(&self, locked: LockedResource) -> Result<ProofId, RuntimeError> {
+        self.write_with(|state| {
+            let proof_id = self.id_provider.new_proof_id();
+            debug!(target: LOG_TARGET, "New proof: {}", proof_id);
+            state.proofs.insert(proof_id, Proof::new(locked));
+            Ok(proof_id)
+        })
+    }
+
+    pub fn proof_exists(&self, proof_id: &ProofId) -> bool {
+        self.read_with(|state| state.proofs.contains_key(proof_id))
+    }
+
+    pub fn drop_proof(&self, proof_id: ProofId) -> Result<(), RuntimeError> {
+        self.write_with(|state| {
+            debug!(target: LOG_TARGET, "Drop proof: {}", proof_id);
+            state.drop_proof(proof_id)
+        })
+    }
+
+    pub fn borrow_proof<F: FnOnce(&Proof) -> R, R>(&self, proof_id: &ProofId, f: F) -> Result<R, RuntimeError> {
+        self.read_with(|state| {
+            state
+                .proofs
+                .get(proof_id)
+                .ok_or(RuntimeError::ProofNotFound { proof_id: *proof_id })
+                .map(f)
+        })
+    }
+
+    pub fn add_proof_to_auth_scope(&self, proof_id: ProofId) -> Result<(), RuntimeError> {
+        self.write_with(|state| {
+            if !state.proofs.contains_key(&proof_id) {
+                return Err(RuntimeError::ProofNotFound { proof_id });
+            }
+            state.current_auth_scope.add_proof(proof_id);
+            Ok(())
+        })
+    }
+
+    pub fn remove_proof_from_auth_scope(&self, proof_id: &ProofId) -> Result<(), RuntimeError> {
+        self.write_with(|state| {
+            if !state.proofs.contains_key(proof_id) {
+                return Err(RuntimeError::ProofNotFound { proof_id: *proof_id });
+            }
+            state.current_auth_scope.remove_proof(proof_id);
+            Ok(())
+        })
+    }
+
     pub fn take_unclaimed_confidential_output(
         &self,
         address: UnclaimedConfidentialOutputAddress,
@@ -424,25 +495,30 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate>> StateTracke
     pub fn new_component(
         &self,
         state: Vec<u8>,
-        access_rules: AccessRules,
+        owner_rule: OwnerRule,
+        access_rules: ComponentAccessRules,
         component_id: Option<Hash>,
     ) -> Result<ComponentAddress, RuntimeError> {
-        let runtime_state = self.runtime_state()?;
-        let template_address = runtime_state.template_address;
-        let module_name = runtime_state.template_name;
-        let tx_hash = self.transaction_hash();
-        let component_address = self
-            .id_provider()
-            .new_component_address(template_address, component_id)?;
-
-        let component = ComponentBody { state };
-        let component = ComponentHeader {
-            template_address: runtime_state.template_address,
-            module_name: module_name.clone(),
-            access_rules,
-            state: component,
-        };
+        let (component_address, component) = self.with_runtime_state(move |runtime_state| {
+            let template_address = runtime_state.template_address;
+            let component_address = self
+                .id_provider()
+                .new_component_address(template_address, component_id)?;
+
+            let component = ComponentBody { state };
+            let component = ComponentHeader {
+                template_address: runtime_state.template_address,
+                module_name: runtime_state.template_name.clone(),
+                owner_key: runtime_state.transaction_signer_public_key,
+                access_rules,
+                owner_rule,
+                state: component,
+            };
+
+            Ok((component_address, component))
+        })?;
 
+        let tx_hash = self.transaction_hash();
         self.write_with(|state| {
             // The template address/component_id combination will not necessarily be unique so we need to check this.
             if state.get_component(&component_address).optional()?.is_some() {
@@ -451,6 +527,8 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate>> StateTracke
                 });
             }
 
+            let template_address = component.template_address;
+            let module_name = component.module_name.clone();
             state.new_components.insert(component_address, component);
 
             state.events.push(Event::new(
@@ -458,7 +536,7 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate>> StateTracke
                 template_address,
                 tx_hash,
                 "component-created".to_string(),
-                Metadata::from([("module_name".to_string(), module_name.to_string())]),
+                Metadata::from([("module_name".to_string(), module_name)]),
             ));
 
             Ok(())
@@ -472,6 +550,12 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate>> StateTracke
         self.read_with(|state| state.get_component(addr))
     }
 
+    pub fn component_exists(&self, addr: &ComponentAddress) -> Result<bool, RuntimeError> {
+        self.read_with(|state| {
+            Ok(state.new_components.contains_key(addr) || state.substate_exists_in_state_store(*addr)?)
+        })
+    }
+
     /// Set the component. This may be called many times during execution but always results in exactly one UP substate
     /// with an incremented version.
     pub fn set_component(
@@ -515,28 +599,44 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate>> StateTracke
     }
 
     pub fn borrow_vault_mut<R, F: FnOnce(&mut Vault) -> R>(&self, vault_id: VaultId, f: F) -> Result<R, RuntimeError> {
-        self.write_with(|state| state.borrow_vault_mut(vault_id, f))
+        self.write_with(|state| state.borrow_vault_mut(&vault_id, f))
     }
 
-    pub fn runtime_state(&self) -> Result<RuntimeState, RuntimeError> {
-        self.read_with(|state| state.runtime_state.clone().ok_or(RuntimeError::IllegalRuntimeState))
+    pub fn vault_exists(&self, vault_id: &VaultId) -> Result<bool, RuntimeError> {
+        self.read_with(|state| {
+            Ok(state.new_vaults.contains_key(vault_id) || state.substate_exists_in_state_store(*vault_id)?)
+        })
     }
 
-    pub fn runtime_state_component_address(&self) -> Result<Option<ComponentAddress>, RuntimeError> {
-        Ok(self.runtime_state()?.component_address)
+    pub fn clone_runtime_state(&self) -> Result<RuntimeState, RuntimeError> {
+        self.with_runtime_state(|state| Ok(state.clone()))
     }
 
-    pub fn set_last_instruction_output(&self, output: Option<Vec<u8>>) {
+    pub fn with_runtime_state<R, F: FnOnce(&RuntimeState) -> Result<R, RuntimeError>>(
+        &self,
+        f: F,
+    ) -> Result<R, RuntimeError> {
+        self.read_with(|state| {
+            let state = state.runtime_state()?;
+            f(state)
+        })
+    }
+
+    pub fn authorization(&self) -> Authorization<'_> {
+        Authorization::new(self)
+    }
+
+    pub fn set_last_instruction_output(&self, output: IndexedValue) {
         self.write_with(|state| {
-            state.last_instruction_output = output;
+            state.last_instruction_output = Some(output);
         });
     }
 
-    pub fn take_last_instruction_output(&self) -> Option<Vec<u8>> {
+    pub fn take_last_instruction_output(&self) -> Option<IndexedValue> {
         self.write_with(|state| state.last_instruction_output.take())
     }
 
-    pub fn get_from_workspace(&self, key: &[u8]) -> Result<Vec<u8>, RuntimeError> {
+    pub fn get_from_workspace(&self, key: &[u8]) -> Result<IndexedValue, RuntimeError> {
         self.read_with(|state| {
             state
                 .workspace
@@ -548,11 +648,12 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate>> StateTracke
         })
     }
 
-    pub fn put_in_workspace(&self, key: Vec<u8>, value: Vec<u8>) -> Result<(), RuntimeError> {
-        self.write_with(|state| {
-            state.workspace.insert(key.clone(), value)?;
-            Ok(())
-        })
+    pub fn with_workspace<F: FnOnce(&Workspace) -> R, R>(&self, f: F) -> R {
+        self.read_with(|state| f(&state.workspace))
+    }
+
+    pub fn with_workspace_mut<F: FnOnce(&mut Workspace) -> R, R>(&self, f: F) -> R {
+        self.write_with(|state| f(&mut state.workspace))
     }
 
     pub fn pay_fee(&self, resource: ResourceContainer, return_vault: VaultId) -> Result<(), RuntimeError> {
@@ -700,7 +801,7 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate>> StateTracke
 
         Ok(FeeReceipt {
             total_fee_payment,
-            fee_resource,
+            total_fees_paid: fee_resource.amount(),
             cost_breakdown: fee_state.fee_charges.drain(..).collect(),
         })
     }
@@ -709,7 +810,11 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate>> StateTracke
         self.write_with(|current_state| {
             mem::replace(
                 current_state,
-                WorkingState::new(current_state.state_store.clone(), Default::default()),
+                WorkingState::new(
+                    current_state.state_store.clone(),
+                    Default::default(),
+                    AuthorizationScope::new(vec![]),
+                ),
             )
         })
     }
@@ -789,7 +894,7 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate>> StateTracke
         Amount::try_from(tx.total_charges()).expect("fee overflowed i64::MAX")
     }
 
-    fn read_with<R, F: FnOnce(&WorkingState) -> R>(&self, f: F) -> R {
+    pub(super) fn read_with<R, F: FnOnce(&WorkingState) -> R>(&self, f: F) -> R {
         f(&self.working_state.read().unwrap())
     }
 
@@ -804,4 +909,19 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate>> StateTracke
     pub(crate) fn id_provider(&self) -> &IdProvider {
         &self.id_provider
     }
+
+    pub fn push_auth_scope(&self) {
+        self.write_with(|state| {
+            let prev_auth_scope = mem::replace(&mut state.current_auth_scope, AuthorizationScope::new(vec![]));
+            state.auth_scope_stack.push(prev_auth_scope);
+        });
+    }
+
+    pub fn pop_auth_scope(&self) -> Result<(), RuntimeError> {
+        self.write_with(|state| {
+            let prev_auth_scope = state.auth_scope_stack.pop().ok_or(RuntimeError::AuthScopeStackEmpty)?;
+            state.current_auth_scope = prev_auth_scope;
+            Ok(())
+        })
+    }
 }
diff --git a/dan_layer/engine/src/runtime/tracker_auth.rs b/dan_layer/engine/src/runtime/tracker_auth.rs
new file mode 100644
index 0000000000..26ebf390d6
--- /dev/null
+++ b/dan_layer/engine/src/runtime/tracker_auth.rs
@@ -0,0 +1,218 @@
+//   Copyright 2023 The Tari Project
+//   SPDX-License-Identifier: BSD-3-Clause
+
+use tari_engine_types::{component::ComponentHeader, resource::Resource};
+use tari_template_lib::auth::{
+    AccessRule,
+    OwnerRule,
+    Ownership,
+    RequireRule,
+    ResourceAuthAction,
+    ResourceOrNonFungibleAddress,
+    RestrictedAccessRule,
+};
+
+use crate::runtime::{ActionIdent, AuthorizationScope, RuntimeError, StateTracker};
+
+pub struct Authorization<'a> {
+    tracker: &'a StateTracker,
+}
+
+impl<'a> Authorization<'a> {
+    pub fn new(tracker: &'a StateTracker) -> Self {
+        Self { tracker }
+    }
+
+    pub fn check_component_access_rules(&self, method: &str, component: &ComponentHeader) -> Result<(), RuntimeError> {
+        self.tracker.read_with(|state| {
+            let scope = &state.current_auth_scope;
+            if check_ownership(self.tracker, scope, component.as_ownership())? {
+                // Owner can call any component method
+                return Ok(());
+            }
+
+            // Check access rules
+            match component.access_rules().get_method_access_rule(method) {
+                AccessRule::AllowAll => Ok(()),
+                AccessRule::DenyAll => Err(RuntimeError::AccessDenied {
+                    action_ident: ActionIdent::ComponentCallMethod {
+                        method: method.to_string(),
+                    },
+                }),
+                AccessRule::Restricted(rule) => {
+                    if !check_restricted_access_rule(self.tracker, scope, rule)? {
+                        return Err(RuntimeError::AccessDenied {
+                            action_ident: ActionIdent::ComponentCallMethod {
+                                method: method.to_string(),
+                            },
+                        });
+                    }
+
+                    Ok(())
+                },
+            }
+        })
+    }
+
+    pub fn check_resource_access_rules(
+        &self,
+        action: ResourceAuthAction,
+        resource: &Resource,
+    ) -> Result<(), RuntimeError> {
+        self.tracker.read_with(|state| {
+            let scope = &state.current_auth_scope;
+            if check_ownership(self.tracker, scope, resource.as_ownership())? {
+                // Owner can invoke any resource method
+                return Ok(());
+            }
+
+            let rule = resource.access_rules().get_access_rule(&action);
+            if !check_access_rule(self.tracker, scope, rule)? {
+                return Err(RuntimeError::AccessDenied {
+                    action_ident: action.into(),
+                });
+            }
+
+            Ok(())
+        })
+    }
+
+    pub fn require_ownership<A: Into<ActionIdent>>(
+        &self,
+        action: A,
+        ownership: Ownership<'_>,
+    ) -> Result<(), RuntimeError> {
+        self.tracker.read_with(|state| {
+            if !check_ownership(self.tracker, &state.current_auth_scope, ownership)? {
+                return Err(RuntimeError::AccessDeniedOwnerRequired { action: action.into() });
+            }
+            Ok(())
+        })
+    }
+}
+
+fn check_ownership(
+    tracker: &StateTracker,
+    scope: &AuthorizationScope,
+    ownership: Ownership<'_>,
+) -> Result<bool, RuntimeError> {
+    match ownership.owner_rule {
+        OwnerRule::OwnedBySigner => {
+            let owner_proof = ownership.owner_key.to_non_fungible_address();
+            Ok(scope.virtual_proofs().contains(&owner_proof))
+        },
+        OwnerRule::None => Ok(false),
+        OwnerRule::ByAccessRule(rule) => check_access_rule(tracker, scope, rule),
+    }
+}
+
+fn check_access_rule(
+    tracker: &StateTracker,
+    scope: &AuthorizationScope,
+    rule: &AccessRule,
+) -> Result<bool, RuntimeError> {
+    match rule {
+        AccessRule::AllowAll => Ok(true),
+        AccessRule::DenyAll => Ok(false),
+        AccessRule::Restricted(rule) => check_restricted_access_rule(tracker, scope, rule),
+    }
+}
+
+fn check_restricted_access_rule(
+    tracker: &StateTracker,
+    scope: &AuthorizationScope,
+    rule: &RestrictedAccessRule,
+) -> Result<bool, RuntimeError> {
+    match rule {
+        RestrictedAccessRule::Require(rule) => check_require_rule(tracker, scope, rule),
+        RestrictedAccessRule::AnyOf(rules) => {
+            for rule in rules {
+                if check_restricted_access_rule(tracker, scope, rule)? {
+                    return Ok(true);
+                }
+            }
+            Ok(false)
+        },
+        RestrictedAccessRule::AllOf(rules) => {
+            for rule in rules {
+                if !check_restricted_access_rule(tracker, scope, rule)? {
+                    return Ok(false);
+                }
+            }
+            Ok(true)
+        },
+    }
+}
+
+fn check_require_rule(
+    tracker: &StateTracker,
+    scope: &AuthorizationScope,
+    rule: &RequireRule,
+) -> Result<bool, RuntimeError> {
+    match rule {
+        RequireRule::Require(resx_or_addr) => check_resource_or_non_fungible(tracker, scope, resx_or_addr),
+        RequireRule::AnyOf(resx_or_addrs) => {
+            for resx_or_addr in resx_or_addrs {
+                if check_resource_or_non_fungible(tracker, scope, resx_or_addr)? {
+                    return Ok(true);
+                }
+            }
+
+            Ok(false)
+        },
+        RequireRule::AllOf(resx_or_addr) => {
+            for resx_or_addr in resx_or_addr {
+                if !check_resource_or_non_fungible(tracker, scope, resx_or_addr)? {
+                    return Ok(false);
+                }
+            }
+
+            Ok(true)
+        },
+    }
+}
+
+fn check_resource_or_non_fungible(
+    tracker: &StateTracker,
+    scope: &AuthorizationScope,
+    resx_or_addr: &ResourceOrNonFungibleAddress,
+) -> Result<bool, RuntimeError> {
+    match resx_or_addr {
+        ResourceOrNonFungibleAddress::Resource(resx) => {
+            if scope
+                .virtual_proofs()
+                .iter()
+                .any(|addr| addr.resource_address() == resx)
+            {
+                return Ok(true);
+            }
+
+            for proof_id in scope.proofs() {
+                let matches = tracker.borrow_proof(proof_id, |proof| resx == proof.resource_address())?;
+
+                if matches {
+                    return Ok(true);
+                }
+            }
+            Ok(false)
+        },
+        ResourceOrNonFungibleAddress::NonFungibleAddress(addr) => {
+            if scope.virtual_proofs().contains(addr) {
+                return Ok(true);
+            }
+
+            for proof_id in scope.proofs() {
+                let matches = tracker.borrow_proof(proof_id, |proof| {
+                    addr.resource_address() == proof.resource_address() &&
+                        proof.non_fungible_token_ids().contains(addr.id())
+                })?;
+
+                if matches {
+                    return Ok(true);
+                }
+            }
+
+            Ok(false)
+        },
+    }
+}
diff --git a/dan_layer/engine/src/runtime/working_state.rs b/dan_layer/engine/src/runtime/working_state.rs
index b4ce1ee002..65417931ee 100644
--- a/dan_layer/engine/src/runtime/working_state.rs
+++ b/dan_layer/engine/src/runtime/working_state.rs
@@ -11,9 +11,11 @@ use tari_engine_types::{
     confidential::UnclaimedConfidentialOutput,
     events::Event,
     fee_claim::{FeeClaim, FeeClaimAddress},
+    indexed_value::IndexedValue,
     logs::LogEntry,
     non_fungible::NonFungibleContainer,
     non_fungible_index::NonFungibleIndex,
+    proof::{ContainerRef, Proof},
     resource::Resource,
     substate::{Substate, SubstateAddress},
     vault::Vault,
@@ -24,6 +26,7 @@ use tari_template_lib::models::{
     ComponentAddress,
     NonFungibleAddress,
     NonFungibleIndexAddress,
+    ProofId,
     ResourceAddress,
     UnclaimedConfidentialOutputAddress,
     VaultId,
@@ -31,7 +34,7 @@ use tari_template_lib::models::{
 
 use super::workspace::Workspace;
 use crate::{
-    runtime::{RuntimeError, RuntimeState, TransactionCommitError, VirtualSubstates},
+    runtime::{AuthorizationScope, RuntimeError, RuntimeState, TransactionCommitError, VirtualSubstates},
     state_store::{memory::MemoryStateStore, AtomicDb, StateReader},
 };
 
@@ -40,6 +43,7 @@ pub(super) struct WorkingState {
     pub events: Vec<Event>,
     pub logs: Vec<LogEntry>,
     pub buckets: HashMap<BucketId, Bucket>,
+    pub proofs: HashMap<ProofId, Proof>,
     // These could be "new_substates"
     pub new_resources: HashMap<ResourceAddress, Resource>,
     pub new_components: HashMap<ComponentAddress, ComponentHeader>,
@@ -49,19 +53,26 @@ pub(super) struct WorkingState {
     pub claimed_confidential_outputs: Vec<UnclaimedConfidentialOutputAddress>,
     pub new_fee_claims: HashMap<FeeClaimAddress, FeeClaim>,
     pub virtual_substates: VirtualSubstates,
+    pub current_auth_scope: AuthorizationScope,
+    pub auth_scope_stack: Vec<AuthorizationScope>,
 
     pub runtime_state: Option<RuntimeState>,
-    pub last_instruction_output: Option<Vec<u8>>,
+    pub last_instruction_output: Option<IndexedValue>,
     pub workspace: Workspace,
     pub state_store: MemoryStateStore,
 }
 
 impl WorkingState {
-    pub fn new(state_store: MemoryStateStore, virtual_substates: VirtualSubstates) -> Self {
+    pub fn new(
+        state_store: MemoryStateStore,
+        virtual_substates: VirtualSubstates,
+        auth_scope: AuthorizationScope,
+    ) -> Self {
         Self {
             events: Vec::new(),
             logs: Vec::new(),
             buckets: HashMap::new(),
+            proofs: HashMap::new(),
             new_resources: HashMap::new(),
             new_components: HashMap::new(),
             new_vaults: HashMap::new(),
@@ -70,6 +81,8 @@ impl WorkingState {
             new_non_fungible_indexes: HashMap::new(),
             runtime_state: None,
             last_instruction_output: None,
+            current_auth_scope: auth_scope,
+            auth_scope_stack: Vec::new(),
             workspace: Workspace::default(),
             state_store,
             virtual_substates,
@@ -77,6 +90,11 @@ impl WorkingState {
         }
     }
 
+    pub fn substate_exists_in_state_store<T: Into<SubstateAddress>>(&self, address: T) -> Result<bool, RuntimeError> {
+        let tx = self.state_store.read_access()?;
+        Ok(tx.exists(&address.into())?)
+    }
+
     pub fn get_resource(&self, address: &ResourceAddress) -> Result<Resource, RuntimeError> {
         match self.new_resources.get(address).cloned() {
             Some(resource) => Ok(resource),
@@ -214,10 +232,10 @@ impl WorkingState {
 
     pub fn borrow_vault_mut<R, F: FnOnce(&mut Vault) -> R>(
         &mut self,
-        vault_id: VaultId,
+        vault_id: &VaultId,
         f: F,
     ) -> Result<R, RuntimeError> {
-        let vault_mut = self.new_vaults.get_mut(&vault_id);
+        let vault_mut = self.new_vaults.get_mut(vault_id);
         match vault_mut {
             Some(vault_mut) => Ok(f(vault_mut)),
             None => {
@@ -225,16 +243,16 @@ impl WorkingState {
                     .state_store
                     .read_access()
                     .unwrap()
-                    .get_state::<_, Substate>(&SubstateAddress::Vault(vault_id))
+                    .get_state::<_, Substate>(&SubstateAddress::Vault(*vault_id))
                     .optional()?
-                    .ok_or(RuntimeError::VaultNotFound { vault_id })?;
+                    .ok_or(RuntimeError::VaultNotFound { vault_id: *vault_id })?;
 
                 let mut vault = substate
                     .into_substate_value()
                     .into_vault()
                     .expect("Substate was not a vault type at vault address");
                 let ret = f(&mut vault);
-                self.new_vaults.insert(vault_id, vault);
+                self.new_vaults.insert(*vault_id, vault);
                 Ok(ret)
             },
         }
@@ -318,6 +336,53 @@ impl WorkingState {
             });
         }
 
+        if !self.proofs.is_empty() {
+            return Err(TransactionCommitError::DanglingProofs {
+                count: self.proofs.len(),
+            });
+        }
+
+        for vault in self.new_vaults.values() {
+            if !vault.locked_balance().is_zero() {
+                return Err(TransactionCommitError::DanglingLockedValueInVault {
+                    vault_id: *vault.vault_id(),
+                    locked_amount: vault.locked_balance(),
+                });
+            }
+        }
+
+        // TODO: Check for dangling vaults and resources
+        // This can happen when you create e.g a vault and don't store it in your component
+
+        Ok(())
+    }
+
+    pub fn runtime_state(&self) -> Result<&RuntimeState, RuntimeError> {
+        self.runtime_state.as_ref().ok_or(RuntimeError::IllegalRuntimeState)
+    }
+
+    pub fn drop_proof(&mut self, proof_id: ProofId) -> Result<(), RuntimeError> {
+        // Fetch the proof
+        let proof = self
+            .proofs
+            .remove(&proof_id)
+            .ok_or(RuntimeError::ProofNotFound { proof_id })?;
+        // Remove it from the auth scope if is in scope
+        self.current_auth_scope.remove_proof(&proof_id);
+
+        // Unlock funds
+        match *proof.container() {
+            ContainerRef::Bucket(bucket_id) => {
+                self.buckets
+                    .get_mut(&bucket_id)
+                    .ok_or(RuntimeError::BucketNotFound { bucket_id })?
+                    .unlock(proof)?;
+            },
+            ContainerRef::Vault(vault_id) => {
+                self.borrow_vault_mut(&vault_id, |vault| vault.unlock(proof))??;
+            },
+        }
+
         Ok(())
     }
 }
diff --git a/dan_layer/engine/src/runtime/workspace.rs b/dan_layer/engine/src/runtime/workspace.rs
index b49186fd1c..071ff45ec3 100644
--- a/dan_layer/engine/src/runtime/workspace.rs
+++ b/dan_layer/engine/src/runtime/workspace.rs
@@ -1,53 +1,70 @@
 //   Copyright 2023 The Tari Project
 //   SPDX-License-Identifier: BSD-3-Clause
 
-use std::collections::HashMap;
+use std::{
+    collections::{HashMap, HashSet},
+    mem,
+};
 
-use tari_bor::{decode, encode, BorError, Value};
+use tari_engine_types::indexed_value::{IndexedValue, IndexedValueError};
+use tari_template_lib::models::ProofId;
 
 #[derive(Debug, thiserror::Error)]
 pub enum WorkspaceError {
-    #[error("Value decoding error: {0}")]
-    ValueDecodingError(#[from] BorError),
+    // #[error("Value decoding error: {0}")]
+    // ValueDecodingError(#[from] BorError),
+    #[error("Indexed value error: {0}")]
+    IndexedValueError(#[from] IndexedValueError),
 }
 
 #[derive(Debug, Clone, Default)]
-pub(super) struct Workspace {
-    pub variables: HashMap<Vec<u8>, Vec<u8>>,
+pub struct Workspace {
+    variables: HashMap<Vec<u8>, IndexedValue>,
+    proofs: HashSet<ProofId>,
 }
 
 impl Workspace {
-    pub fn get(&self, key: &[u8]) -> Option<&Vec<u8>> {
+    pub fn get(&self, key: &[u8]) -> Option<&IndexedValue> {
         self.variables.get(key)
     }
 
-    pub fn insert(&mut self, key: Vec<u8>, value: Vec<u8>) -> Result<(), WorkspaceError> {
-        self.variables.insert(key.clone(), value.clone());
-
+    pub fn insert(&mut self, key: Vec<u8>, value: IndexedValue) -> Result<(), WorkspaceError> {
         // if the value is an array then we need to add entries for all items
-        let value: tari_bor::Value = decode(&value)?;
         // TODO: support for structs
-        if let Value::Array(items) = value {
+        if let tari_bor::Value::Array(items) = value.value() {
             let key_str = String::from_utf8_lossy(&key);
 
-            for (i, item) in items.iter().enumerate() {
-                let item_value = encode(item)?;
+            for (i, item) in items.clone().into_iter().enumerate() {
+                let item_value = IndexedValue::from_value(item)?;
 
                 // we do not have a way to differentiate tuples from arrays, so we support both
                 let item_tuple_key = format!("{}.{}", key_str, i);
                 let item_array_key = format!("{}[{}]", key_str, i);
-                self.variables.insert(item_tuple_key.into(), item_value.clone());
-                self.variables.insert(item_array_key.into(), item_value);
+                self.insert_internal(item_tuple_key.into(), item_value.clone());
+                self.insert_internal(item_array_key.into(), item_value);
             }
         }
 
+        self.insert_internal(key, value);
+
         Ok(())
     }
+
+    fn insert_internal(&mut self, key: Vec<u8>, value: IndexedValue) {
+        if !value.proof_ids().is_empty() {
+            self.proofs.extend(value.proof_ids().iter().copied());
+        }
+        self.variables.insert(key, value);
+    }
+
+    pub fn drain_all_proofs(&mut self) -> HashSet<ProofId> {
+        mem::take(&mut self.proofs)
+    }
 }
 
 #[cfg(test)]
 mod tests {
-    use tari_bor::encode;
+    use tari_engine_types::indexed_value::IndexedValue;
     use tari_utilities::ByteArray;
 
     use super::Workspace;
@@ -56,7 +73,7 @@ mod tests {
     fn tuples() {
         // create the tuple value
         let tuple = ("Foo", 32);
-        let encoded_tuple = encode(&tuple).unwrap();
+        let encoded_tuple = IndexedValue::from_type(&tuple).unwrap();
 
         // add the tuple to the workspace
         let mut workspace = Workspace::default();
@@ -68,11 +85,11 @@ mod tests {
 
         // each tuple item can be addresed individually
         // item 0
-        let expected = encode(&tuple.0).unwrap();
+        let expected = IndexedValue::from_type(&tuple.0).unwrap();
         let value = workspace.get(b"tuple.0").unwrap();
         assert_eq!(*value, expected);
         // item 1
-        let expected = encode(&tuple.1).unwrap();
+        let expected = IndexedValue::from_type(&tuple.1).unwrap();
         let value = workspace.get(b"tuple.1").unwrap();
         assert_eq!(*value, expected);
     }
diff --git a/dan_layer/engine/src/state_store/memory.rs b/dan_layer/engine/src/state_store/memory.rs
index 80bb40b318..0e1479377a 100644
--- a/dan_layer/engine/src/state_store/memory.rs
+++ b/dan_layer/engine/src/state_store/memory.rs
@@ -104,7 +104,7 @@ impl<'a> StateReader for MemoryTransaction<RwLockReadGuard<'a, InnerKvMap>> {
             })
     }
 
-    fn exists(&self, key: &[u8]) -> Result<bool, StateStoreError> {
+    fn exists_raw(&self, key: &[u8]) -> Result<bool, StateStoreError> {
         Ok(self.pending.contains_key(key) || self.guard.contains_key(key))
     }
 }
@@ -121,7 +121,7 @@ impl<'a> StateReader for MemoryTransaction<RwLockWriteGuard<'a, InnerKvMap>> {
             })
     }
 
-    fn exists(&self, key: &[u8]) -> Result<bool, StateStoreError> {
+    fn exists_raw(&self, key: &[u8]) -> Result<bool, StateStoreError> {
         Ok(self.pending.contains_key(key) || self.guard.contains_key(key))
     }
 }
diff --git a/dan_layer/engine/src/state_store/mod.rs b/dan_layer/engine/src/state_store/mod.rs
index 8f07733a2d..b289386b02 100644
--- a/dan_layer/engine/src/state_store/mod.rs
+++ b/dan_layer/engine/src/state_store/mod.rs
@@ -64,7 +64,10 @@ pub trait StateReader {
         Ok(value)
     }
 
-    fn exists(&self, key: &[u8]) -> Result<bool, StateStoreError>;
+    fn exists_raw(&self, key: &[u8]) -> Result<bool, StateStoreError>;
+    fn exists<K: Serialize + Debug>(&self, key: &K) -> Result<bool, StateStoreError> {
+        self.exists_raw(&encode(key)?)
+    }
 }
 
 pub trait StateWriter: StateReader {
diff --git a/dan_layer/engine/src/transaction/error.rs b/dan_layer/engine/src/transaction/error.rs
index 936024b072..4cd75831c8 100644
--- a/dan_layer/engine/src/transaction/error.rs
+++ b/dan_layer/engine/src/transaction/error.rs
@@ -20,7 +20,7 @@
 //  WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
 //  USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-use tari_engine_types::indexed_value::IndexedValueVisitorError;
+use tari_engine_types::indexed_value::IndexedValueError;
 use tari_template_lib::models::TemplateAddress;
 use tari_utilities::ByteArrayError;
 
@@ -45,5 +45,5 @@ pub enum TransactionError {
     #[error("BOR error: {0}")]
     BorError(#[from] tari_bor::BorError),
     #[error("Value visitor error: {0}")]
-    ValueVisitorError(#[from] IndexedValueVisitorError),
+    ValueVisitorError(#[from] IndexedValueError),
 }
diff --git a/dan_layer/engine/src/transaction/processor.rs b/dan_layer/engine/src/transaction/processor.rs
index 94af739985..d8ed62d010 100644
--- a/dan_layer/engine/src/transaction/processor.rs
+++ b/dan_layer/engine/src/transaction/processor.rs
@@ -24,7 +24,7 @@ use std::sync::Arc;
 
 use log::*;
 use tari_bor::encode;
-use tari_dan_common_types::{services::template_provider::TemplateProvider, Epoch};
+use tari_dan_common_types::{services::template_provider::TemplateProvider, Epoch, NodeAddressable};
 use tari_engine_types::{
     commit_result::{ExecuteResult, FinalizeResult, RejectReason},
     indexed_value::IndexedValue,
@@ -35,6 +35,7 @@ use tari_template_abi::Type;
 use tari_template_lib::{
     arg,
     args::{Arg, WorkspaceAction},
+    crypto::RistrettoPublicKeyBytes,
     invoke_args,
     models::ComponentAddress,
     prelude::TemplateAddress,
@@ -46,7 +47,6 @@ use crate::{
     runtime::{
         AuthParams,
         AuthorizationScope,
-        FunctionIdent,
         Runtime,
         RuntimeInterfaceImpl,
         RuntimeModule,
@@ -65,12 +65,11 @@ const LOG_TARGET: &str = "tari::dan::engine::instruction_processor";
 pub const MAX_CALL_DEPTH: usize = 10;
 
 pub struct TransactionProcessor<TTemplateProvider> {
-    // package: Package,
     template_provider: Arc<TTemplateProvider>,
     state_db: MemoryStateStore,
     auth_params: AuthParams,
     virtual_substates: VirtualSubstates,
-    modules: Vec<Arc<dyn RuntimeModule<TTemplateProvider>>>,
+    modules: Vec<Arc<dyn RuntimeModule>>,
 }
 
 impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate> + 'static> TransactionProcessor<TTemplateProvider> {
@@ -79,7 +78,7 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate> + 'static> T
         state_db: MemoryStateStore,
         auth_params: AuthParams,
         virtual_substates: VirtualSubstates,
-        modules: Vec<Arc<dyn RuntimeModule<TTemplateProvider>>>,
+        modules: Vec<Arc<dyn RuntimeModule>>,
     ) -> Self {
         Self {
             template_provider,
@@ -100,33 +99,29 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate> + 'static> T
             modules,
         } = self;
 
-        let tracker = StateTracker::new(state_db, id_provider, template_provider.clone(), virtual_substates);
-        let initial_proofs = auth_params.initial_ownership_proofs.clone();
-        let runtime_interface =
-            RuntimeInterfaceImpl::initialize(tracker, auth_params, transaction.signer_public_key().clone(), modules)?;
+        let auth_scope = AuthorizationScope::new(auth_params.initial_ownership_proofs);
+        let tracker = StateTracker::new(state_db, id_provider, virtual_substates, auth_scope);
+        let runtime_interface = RuntimeInterfaceImpl::initialize(
+            tracker,
+            template_provider.clone(),
+            transaction.signer_public_key().clone(),
+            modules,
+        )?;
 
-        let auth_scope = AuthorizationScope::new(Arc::new(initial_proofs));
         let runtime = Runtime::new(Arc::new(runtime_interface));
         let transaction_hash = transaction.hash();
 
         let (fee_instructions, instructions) = transaction.into_instructions();
 
-        let fee_exec_results = Self::process_instructions(
-            template_provider.clone(),
-            &runtime,
-            auth_scope.clone(),
-            fee_instructions,
-        );
+        let fee_exec_results = Self::process_instructions(&template_provider, &runtime, fee_instructions);
 
         let fee_exec_result = match fee_exec_results {
             Ok(execution_results) => {
                 // Checkpoint the tracker state after the fee instructions have been executed in case of transaction
                 // failure.
                 if let Err(err) = runtime.interface().fee_checkpoint() {
-                    let mut finalize = FinalizeResult::new_rejectted(
-                        transaction_hash,
-                        RejectReason::ExecutionFailure(err.to_string()),
-                    );
+                    let mut finalize =
+                        FinalizeResult::new_rejected(transaction_hash, RejectReason::ExecutionFailure(err.to_string()));
                     finalize.execution_results = execution_results;
                     return Ok(ExecuteResult {
                         fee_receipt: None,
@@ -139,7 +134,7 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate> + 'static> T
             Err(err) => {
                 return Ok(ExecuteResult {
                     fee_receipt: None,
-                    finalize: FinalizeResult::new_rejectted(
+                    finalize: FinalizeResult::new_rejected(
                         transaction_hash,
                         RejectReason::ExecutionFailure(err.to_string()),
                     ),
@@ -148,7 +143,7 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate> + 'static> T
             },
         };
 
-        let instruction_result = Self::process_instructions(template_provider, &runtime, auth_scope, instructions);
+        let instruction_result = Self::process_instructions(&*template_provider, &runtime, instructions);
 
         match instruction_result {
             Ok(execution_results) => {
@@ -198,29 +193,19 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate> + 'static> T
     }
 
     fn process_instructions(
-        template_provider: Arc<TTemplateProvider>,
+        template_provider: &TTemplateProvider,
         runtime: &Runtime,
-        auth_scope: AuthorizationScope,
         instructions: Vec<Instruction>,
     ) -> Result<Vec<InstructionResult>, TransactionError> {
         instructions
             .into_iter()
-            .map(|instruction| {
-                Self::process_instruction(
-                    template_provider.clone(),
-                    runtime,
-                    auth_scope.clone(),
-                    instruction,
-                    MAX_CALL_DEPTH,
-                )
-            })
+            .map(|instruction| Self::process_instruction(template_provider, runtime, instruction, MAX_CALL_DEPTH))
             .collect()
     }
 
     fn process_instruction(
-        template_provider: Arc<TTemplateProvider>,
+        template_provider: &TTemplateProvider,
         runtime: &Runtime,
-        auth_scope: AuthorizationScope,
         instruction: Instruction,
         max_recursion_depth: usize,
     ) -> Result<InstructionResult, TransactionError> {
@@ -233,7 +218,6 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate> + 'static> T
             } => Self::call_function(
                 template_provider,
                 runtime,
-                auth_scope,
                 &template_address,
                 &function,
                 args,
@@ -247,7 +231,6 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate> + 'static> T
             } => Self::call_method(
                 template_provider,
                 runtime,
-                auth_scope,
                 &component_address,
                 &method,
                 args,
@@ -260,6 +243,10 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate> + 'static> T
                 Self::put_output_on_workspace_with_name(runtime, key)?;
                 Ok(InstructionResult::empty())
             },
+            Instruction::DropAllProofsInWorkspace => {
+                Self::drop_all_proofs_in_workspace(runtime)?;
+                Ok(InstructionResult::empty())
+            },
             Instruction::EmitLog { level, message } => {
                 runtime.interface().emit_log(level, message)?;
                 Ok(InstructionResult::empty())
@@ -302,10 +289,16 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate> + 'static> T
         Ok(())
     }
 
+    pub fn drop_all_proofs_in_workspace(runtime: &Runtime) -> Result<(), TransactionError> {
+        runtime
+            .interface()
+            .workspace_invoke(WorkspaceAction::DropAllProofs, invoke_args![].into())?;
+        Ok(())
+    }
+
     pub fn call_function(
-        template_provider: Arc<TTemplateProvider>,
+        template_provider: &TTemplateProvider,
         runtime: &Runtime,
-        auth_scope: AuthorizationScope,
         template_address: &TemplateAddress,
         function: &str,
         args: Vec<Arg>,
@@ -321,63 +314,54 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate> + 'static> T
             .ok_or(TransactionError::TemplateNotFound {
                 address: *template_address,
             })?;
+        let transaction_signer_public_key =
+            RistrettoPublicKeyBytes::from_bytes(runtime.interface().get_transaction_signer_public_key()?.as_bytes())
+                .expect("RistrettoPublicKey::as_bytes did not return 32 bytes");
 
         runtime.interface().set_current_runtime_state(RuntimeState {
             template_name: template.template_name().to_string(),
             template_address: *template_address,
+            transaction_signer_public_key,
             component_address: None,
             recursion_depth,
             max_recursion_depth,
         })?;
 
-        let result = Self::invoke_template(
-            template,
-            template_provider,
-            runtime.clone(),
-            auth_scope,
-            function,
-            args,
-            0,
-            1,
-        )?;
+        let result = Self::invoke_template(template, template_provider, runtime.clone(), function, args, 0, 1)?;
         Ok(result)
     }
 
     pub fn call_method(
-        template_provider: Arc<TTemplateProvider>,
+        template_provider: &TTemplateProvider,
         runtime: &Runtime,
-        auth_scope: AuthorizationScope,
         component_address: &ComponentAddress,
         method: &str,
         args: Vec<Arg>,
         recursion_depth: usize,
         max_recursion_depth: usize,
     ) -> Result<InstructionResult, TransactionError> {
-        let component = runtime.interface().get_component(component_address)?;
-        // TODO: In this very basic auth system, you can only call on owned objects (because
-        // initial_ownership_proofs is       usually set to include the owner token).
-        auth_scope.check_access_rules(
-            &FunctionIdent::Template {
-                module_name: component.module_name.clone(),
-                function: method.to_string(),
-            },
-            &component.access_rules,
-        )?;
+        let header = runtime.interface().get_component(component_address)?;
+        runtime.interface().check_component_access_rules(method, &header)?;
 
         let template = template_provider
-            .get_template_module(&component.template_address)
+            .get_template_module(&header.template_address)
             .map_err(|e| TransactionError::FailedToLoadTemplate {
-                address: component.template_address,
+                address: header.template_address,
                 details: e.to_string(),
             })?
             .ok_or(TransactionError::TemplateNotFound {
-                address: component.template_address,
+                address: header.template_address,
             })?;
 
+        let transaction_signer_public_key =
+            RistrettoPublicKeyBytes::from_bytes(runtime.interface().get_transaction_signer_public_key()?.as_bytes())
+                .expect("RistrettoPublicKey::as_bytes did not return 32 bytes");
+
         runtime.interface().set_current_runtime_state(RuntimeState {
             template_name: template.template_name().to_string(),
-            template_address: component.template_address,
+            template_address: header.template_address,
             component_address: Some(*component_address),
+            transaction_signer_public_key,
             recursion_depth,
             max_recursion_depth,
         })?;
@@ -390,7 +374,6 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate> + 'static> T
             template,
             template_provider,
             runtime.clone(),
-            auth_scope,
             method,
             final_args,
             recursion_depth,
@@ -401,9 +384,8 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate> + 'static> T
 
     fn invoke_template(
         module: LoadedTemplate,
-        template_provider: Arc<TTemplateProvider>,
+        template_provider: &TTemplateProvider,
         runtime: Runtime,
-        auth_scope: AuthorizationScope,
         function: &str,
         args: Vec<Arg>,
         recursion_depth: usize,
@@ -418,9 +400,8 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate> + 'static> T
                 process.invoke_by_name(function, args)?
             },
             LoadedTemplate::Flow(flow_factory) => flow_factory.run_new_instance(
-                template_provider,
+                Arc::new(template_provider.clone()),
                 runtime,
-                auth_scope,
                 function,
                 args,
                 recursion_depth,
diff --git a/dan_layer/engine/src/wasm/error.rs b/dan_layer/engine/src/wasm/error.rs
index 279a63cc5d..2bd19e1822 100644
--- a/dan_layer/engine/src/wasm/error.rs
+++ b/dan_layer/engine/src/wasm/error.rs
@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: BSD-3-Clause
 
 use tari_bor::BorError;
-use tari_engine_types::indexed_value::IndexedValueVisitorError;
+use tari_engine_types::indexed_value::IndexedValueError;
 use thiserror::Error;
 use wasmer::{ExportError, HostEnvInitError, InstantiationError};
 
@@ -60,7 +60,7 @@ pub enum WasmExecutionError {
         runtime_error: wasmer::RuntimeError,
     },
     #[error("Value visitor error: {0}")]
-    ValueVisitorError(#[from] IndexedValueVisitorError),
+    ValueVisitorError(#[from] IndexedValueError),
 }
 impl From<wasmer::InstantiationError> for WasmExecutionError {
     fn from(value: InstantiationError) -> Self {
diff --git a/dan_layer/engine/src/wasm/process.rs b/dan_layer/engine/src/wasm/process.rs
index 1a723b9a61..228be9b355 100644
--- a/dan_layer/engine/src/wasm/process.rs
+++ b/dan_layer/engine/src/wasm/process.rs
@@ -37,6 +37,7 @@ use tari_template_lib::{
         GenerateRandomInvokeArg,
         LogLevel,
         NonFungibleInvokeArg,
+        ProofInvokeArg,
         ResourceInvokeArg,
         VaultInvokeArg,
         WorkspaceInvokeArg,
@@ -155,6 +156,11 @@ impl WasmProcess {
             EngineOp::CallInvoke => Self::handle(env, arg, |env, arg: CallInvokeArg| {
                 env.state().interface().call_invoke(arg.action, arg.args.into())
             }),
+            EngineOp::ProofInvoke => Self::handle(env, arg, |env, arg: ProofInvokeArg| {
+                env.state()
+                    .interface()
+                    .proof_invoke(arg.proof_ref, arg.action, arg.args.into())
+            }),
         };
 
         result.unwrap_or_else(|err| {
@@ -208,7 +214,7 @@ impl Invokable for WasmProcess {
             .find_func_by_name(name)
             .ok_or_else(|| WasmExecutionError::FunctionNotFound { name: name.into() })?;
 
-        let args = self.env.state().resolve_args(args)?;
+        let args = self.env.state().resolve_args(&args)?;
 
         let call_info = CallInfo {
             abi_context: self.encoded_abi_context(),
@@ -246,17 +252,13 @@ impl Invokable for WasmProcess {
         // Read response from memory
         let raw = self.env.read_memory_with_embedded_len(ptr as u32)?;
 
-        if raw.is_empty() {
-            self.env.state().interface().set_last_instruction_output(None)?;
-        } else {
-            self.env
-                .state()
-                .interface()
-                .set_last_instruction_output(Some(raw.clone()))?;
-        }
-
         let value = IndexedValue::from_raw(&raw)?;
 
+        self.env
+            .state()
+            .interface()
+            .set_last_instruction_output(value.clone())?;
+
         Ok(InstructionResult {
             raw,
             value,
diff --git a/dan_layer/engine/tests/access_rules.rs b/dan_layer/engine/tests/access_rules.rs
new file mode 100644
index 0000000000..7361e020f2
--- /dev/null
+++ b/dan_layer/engine/tests/access_rules.rs
@@ -0,0 +1,619 @@
+//   Copyright 2023 The Tari Project
+//   SPDX-License-Identifier: BSD-3-Clause
+
+//   Copyright 2023 The Tari Project
+//   SPDX-License-Identifier: BSD-3-Clause
+
+mod support;
+
+use support::access_rules::assert_access_denied_for_action;
+use tari_dan_engine::runtime::ActionIdent;
+use tari_template_lib::{
+    args,
+    args::ComponentAction,
+    auth::{
+        AccessRule,
+        ComponentAccessRules,
+        OwnerRule,
+        RequireRule,
+        ResourceAccessRules,
+        ResourceAuthAction,
+        RestrictedAccessRule,
+    },
+    models::{Amount, ComponentAddress, NonFungibleId},
+};
+use tari_template_test_tooling::TemplateTest;
+use tari_transaction::Transaction;
+
+use crate::support::access_rules::assert_insufficient_funds_for_action;
+
+mod component_access_rules {
+
+    use super::*;
+
+    #[test]
+    fn it_restricts_component_methods() {
+        let mut test = TemplateTest::new(["tests/templates/access_rules"]);
+
+        // Create sender and receiver accounts
+        let (owner1_proof, owner1_key) = test.create_owner_proof();
+        let (owner2_proof, owner2_key) = test.create_owner_proof();
+
+        let access_rules_template = test.get_template_address("AccessRulesTest");
+
+        let owner_rule = AccessRule::Restricted(
+            RestrictedAccessRule::Require(RequireRule::Require(owner1_proof.clone().into())).or(
+                RestrictedAccessRule::Require(RequireRule::Require(owner2_proof.clone().into())),
+            ),
+        );
+
+        let component_rules = ComponentAccessRules::new()
+            .add_method_rule("set_value", owner_rule.clone())
+            .default(AccessRule::DenyAll);
+
+        let result = test.execute_expect_success(
+            Transaction::builder()
+                .call_function(access_rules_template, "with_configured_rules", args![
+                    // Owner
+                    OwnerRule::ByAccessRule(owner_rule),
+                    // Component
+                    component_rules,
+                    // Resource
+                    ResourceAccessRules::deny_all()
+                ])
+                .sign(&owner1_key)
+                .build(),
+            // Because we deny_all on deposits, we need to supply the owner proof to be able to deposit the initial
+            // tokens into the new vaults
+            vec![owner1_proof.clone()],
+        );
+
+        let component_address = result.finalize.execution_results[0]
+            .decode::<ComponentAddress>()
+            .unwrap();
+
+        test.execute_expect_success(
+            Transaction::builder()
+                .call_method(component_address, "set_value", args![1])
+                .sign(&owner2_key)
+                .build(),
+            vec![owner2_proof],
+        );
+
+        let (unauth_proof, unauth_key) = test.create_owner_proof();
+
+        let reason = test.execute_expect_failure(
+            Transaction::builder()
+                .call_method(component_address, "set_value", args![1])
+                .sign(&unauth_key)
+                .build(),
+            vec![unauth_proof],
+        );
+
+        assert_access_denied_for_action(reason, ActionIdent::ComponentCallMethod {
+            method: "set_value".to_string(),
+        });
+    }
+
+    #[test]
+    fn it_allows_owner_to_update_component_access_rules() {
+        let mut test = TemplateTest::new(["tests/templates/access_rules"]);
+
+        // Create sender and receiver accounts
+        let (owner_proof, owner_key) = test.create_owner_proof();
+        let (user_proof, user_key) = test.create_owner_proof();
+
+        let access_rules_template = test.get_template_address("AccessRulesTest");
+
+        let result = test.execute_expect_success(
+            Transaction::builder()
+                .call_function(access_rules_template, "with_configured_rules", args![
+                    // Owner
+                    OwnerRule::OwnedBySigner,
+                    // Component
+                    ComponentAccessRules::new().default(AccessRule::DenyAll),
+                    // Resource
+                    ResourceAccessRules::deny_all(),
+                ])
+                .sign(&owner_key)
+                .build(),
+            vec![owner_proof.clone()],
+        );
+
+        let component_address = result.finalize.execution_results[0]
+            .decode::<ComponentAddress>()
+            .unwrap();
+
+        // Access Denied
+        let reason = test.execute_expect_failure(
+            Transaction::builder()
+                .call_method(component_address, "set_value", args![1])
+                .sign(&user_key)
+                .build(),
+            vec![user_proof.clone()],
+        );
+
+        assert_access_denied_for_action(reason, ActionIdent::ComponentCallMethod {
+            method: "set_value".to_string(),
+        });
+
+        // Allow user to call set_value
+        test.execute_expect_success(
+            Transaction::builder()
+                .call_method(component_address, "set_component_access_rules", args![
+                    ComponentAccessRules::new()
+                        .add_method_rule(
+                            "set_value",
+                            AccessRule::Restricted(RestrictedAccessRule::Require(RequireRule::Require(
+                                user_proof.clone().into()
+                            )))
+                        )
+                        .default(AccessRule::DenyAll)
+                ])
+                .sign(&owner_key)
+                .build(),
+            vec![owner_proof],
+        );
+
+        test.execute_expect_success(
+            Transaction::builder()
+                .call_method(component_address, "set_value", args![1])
+                .sign(&user_key)
+                .build(),
+            vec![user_proof.clone()],
+        );
+
+        test.execute_expect_failure(
+            Transaction::builder()
+                .call_method(component_address, "set_component_access_rules", args![
+                    ComponentAccessRules::new().default(AccessRule::AllowAll)
+                ])
+                .sign(&user_key)
+                .build(),
+            vec![user_proof],
+        );
+    }
+
+    #[test]
+    fn it_prevents_access_rule_modification_if_owner_is_none() {
+        let mut test = TemplateTest::new(["tests/templates/access_rules"]);
+
+        // Create sender and receiver accounts
+        let (owner_proof, owner_key) = test.create_owner_proof();
+
+        let access_rules_template = test.get_template_address("AccessRulesTest");
+
+        let result = test.execute_expect_success(
+            Transaction::builder()
+                .call_function(access_rules_template, "with_configured_rules", args![
+                    // Owner
+                    OwnerRule::None,
+                    // Component
+                    ComponentAccessRules::new().default(AccessRule::AllowAll),
+                    // Resource
+                    ResourceAccessRules::new()
+                ])
+                .sign(&owner_key)
+                .build(),
+            vec![owner_proof.clone()],
+        );
+
+        let component_address = result.finalize.execution_results[0]
+            .decode::<ComponentAddress>()
+            .unwrap();
+
+        // Owner cannot set access rules
+        let reason = test.execute_expect_failure(
+            Transaction::builder()
+                .call_method(component_address, "set_component_access_rules", args![
+                    ComponentAccessRules::new().default(AccessRule::AllowAll)
+                ])
+                .sign(&owner_key)
+                .build(),
+            vec![owner_proof],
+        );
+
+        assert_access_denied_for_action(reason, ComponentAction::SetAccessRules);
+    }
+}
+
+mod resource_access_rules {
+
+    use super::*;
+
+    #[test]
+    fn it_denies_actions_on_resource() {
+        let mut test = TemplateTest::new(["tests/templates/access_rules"]);
+
+        // Create sender and receiver accounts
+        let (owner_account, owner_proof, owner_key) = test.create_empty_account();
+        let (user_proof, user_key) = test.create_owner_proof();
+
+        let access_rules_template = test.get_template_address("AccessRulesTest");
+
+        let result = test.execute_expect_success(
+            Transaction::builder()
+                .call_function(access_rules_template, "with_configured_rules", args![
+                    // Owner
+                    OwnerRule::OwnedBySigner,
+                    // Component
+                    ComponentAccessRules::new().default(AccessRule::AllowAll),
+                    // Resource
+                    ResourceAccessRules::new().withdrawable(AccessRule::DenyAll)
+                ])
+                .sign(&owner_key)
+                .build(),
+            vec![owner_proof.clone()],
+        );
+
+        let component_address = result.finalize.execution_results[0]
+            .decode::<ComponentAddress>()
+            .unwrap();
+
+        // User cannot get tokens
+        let reason = test.execute_expect_failure(
+            Transaction::builder()
+                .call_method(component_address, "take_tokens", args![Amount(10)])
+                .put_last_instruction_output_on_workspace("tokens")
+                .call_method(owner_account, "deposit", args![Workspace("tokens")])
+                .sign(&user_key)
+                .build(),
+            vec![user_proof.clone()],
+        );
+
+        assert_access_denied_for_action(reason, ResourceAuthAction::Withdraw);
+
+        // Owner can get tokens
+        test.execute_expect_success(
+            Transaction::builder()
+                .call_method(component_address, "take_tokens", args![Amount(10)])
+                .put_last_instruction_output_on_workspace("tokens")
+                .call_method(owner_account, "deposit", args![Workspace("tokens")])
+                .sign(&owner_key)
+                .build(),
+            vec![owner_proof.clone()],
+        );
+
+        // Owner gives user permission to withdraw tokens
+        test.execute_expect_success(
+            Transaction::builder()
+                .call_method(component_address, "set_tokens_access_rules", args![
+                    ResourceAccessRules::new().withdrawable(AccessRule::Restricted(RestrictedAccessRule::Require(
+                        RequireRule::Require(user_proof.clone().into())
+                    )))
+                ])
+                .sign(&owner_key)
+                .build(),
+            vec![owner_proof],
+        );
+
+        // User can get tokens, and deposit them in the owners account (deposit is default allow)
+        test.execute_expect_success(
+            Transaction::builder()
+                .call_method(component_address, "take_tokens", args![Amount(10)])
+                .put_last_instruction_output_on_workspace("tokens")
+                .call_method(owner_account, "deposit", args![Workspace("tokens")])
+                .sign(&user_key)
+                .build(),
+            vec![user_proof],
+        );
+    }
+
+    #[test]
+    fn it_allows_resource_access_with_badge() {
+        let mut test = TemplateTest::new(["tests/templates/access_rules"]);
+
+        // Create sender and receiver accounts
+        let (owner_proof, owner_key) = test.create_owner_proof();
+        let (user_account, user_proof, user_key) = test.create_empty_account();
+
+        let access_rules_template = test.get_template_address("AccessRulesTest");
+
+        let result = test.execute_expect_success(
+            Transaction::builder()
+                .call_function(access_rules_template, "using_badge_rules", args![])
+                .sign(&owner_key)
+                .build(),
+            vec![owner_proof.clone()],
+        );
+
+        let component_address = result.finalize.execution_results[0]
+            .decode::<ComponentAddress>()
+            .unwrap();
+        // Find the resource address for the badge from the output substates
+        let badge_resource = result
+            .finalize
+            .result
+            .accept()
+            .unwrap()
+            .up_iter()
+            .filter_map(|(addr, s)| s.substate_value().as_resource().map(|r| (addr, r)))
+            .filter(|(_, r)| r.resource_type().is_non_fungible())
+            .map(|(addr, _)| addr.as_resource_address().unwrap())
+            .next()
+            .unwrap();
+
+        // User cannot get the tokens
+        let reason = test.execute_expect_failure(
+            Transaction::builder()
+                .call_method(component_address, "take_tokens", args![Amount(10)])
+                .put_last_instruction_output_on_workspace("tokens")
+                .call_method(user_account, "deposit", args![Workspace("tokens")])
+                .sign(&user_key)
+                .build(),
+            vec![user_proof.clone()],
+        );
+
+        assert_access_denied_for_action(reason, ResourceAuthAction::Withdraw);
+
+        // Give the user a withdraw and deposit badge
+        test.execute_expect_success(
+            Transaction::builder()
+                .call_method(component_address, "take_badge_by_name", args!["withdraw"])
+                .put_last_instruction_output_on_workspace("withdraw_perm")
+                .call_method(component_address, "take_badge_by_name", args!["deposit"])
+                .put_last_instruction_output_on_workspace("deposit_perm")
+                .call_method(user_account, "deposit", args![Workspace("withdraw_perm")])
+                .call_method(user_account, "deposit", args![Workspace("deposit_perm")])
+                .sign(&owner_key)
+                .build(),
+            vec![owner_proof.clone()],
+        );
+
+        // User can take tokens
+        test.execute_expect_success(
+            Transaction::builder()
+                .call_method(user_account, "create_proof_by_non_fungible_ids", args![
+                    badge_resource,
+                    vec![
+                        NonFungibleId::from_string("withdraw"),
+                        NonFungibleId::from_string("deposit")
+                    ]
+                ])
+                .put_last_instruction_output_on_workspace("proof")
+                .call_method(component_address, "take_tokens_using_proof", args![
+                    Workspace("proof"),
+                    Amount(10)
+                ])
+                .put_last_instruction_output_on_workspace("tokens")
+                .call_method(user_account, "deposit", args![Workspace("tokens")])
+                .drop_all_proofs_in_workspace()
+                .sign(&user_key)
+                .build(),
+            vec![user_proof],
+        );
+    }
+
+    #[test]
+    fn it_allows_access_for_proofs_by_amount() {
+        let mut test = TemplateTest::new(["tests/templates/access_rules"]);
+
+        // Create sender and receiver accounts
+        let (owner_proof, owner_key) = test.create_owner_proof();
+        let (user_account, user_proof, user_key) = test.create_empty_account();
+
+        let access_rules_template = test.get_template_address("AccessRulesTest");
+
+        let result = test.execute_expect_success(
+            Transaction::builder()
+                .call_function(access_rules_template, "using_resource_rules", args![])
+                .sign(&owner_key)
+                .build(),
+            vec![owner_proof.clone()],
+        );
+
+        let component_address = result.finalize.execution_results[0]
+            .decode::<ComponentAddress>()
+            .unwrap();
+        // Find the resource address for the badge from the output substates
+        let badge_resource = result
+            .finalize
+            .result
+            .accept()
+            .unwrap()
+            .up_iter()
+            .filter_map(|(addr, s)| s.substate_value().as_resource().map(|r| (addr, r)))
+            .filter(|(_, r)| r.resource_type().is_non_fungible())
+            .map(|(addr, _)| addr.as_resource_address().unwrap())
+            .next()
+            .unwrap();
+
+        // User cannot get the tokens
+        let reason = test.execute_expect_failure(
+            Transaction::builder()
+                .call_method(component_address, "take_tokens", args![Amount(10)])
+                .put_last_instruction_output_on_workspace("tokens")
+                .call_method(user_account, "deposit", args![Workspace("tokens")])
+                .sign(&user_key)
+                .build(),
+            vec![user_proof.clone()],
+        );
+
+        assert_access_denied_for_action(reason, ResourceAuthAction::Withdraw);
+
+        // Give the user a withdraw and deposit badge
+        test.execute_expect_success(
+            Transaction::builder()
+                .call_method(component_address, "mint_new_badge", args![])
+                .put_last_instruction_output_on_workspace("permission")
+                .call_method(user_account, "deposit", args![Workspace("permission")])
+                .sign(&owner_key)
+                .build(),
+            vec![owner_proof.clone()],
+        );
+
+        // User can take tokens
+        test.execute_expect_success(
+            Transaction::builder()
+                .call_method(user_account, "create_proof_by_amount", args![badge_resource, Amount(1)])
+                .put_last_instruction_output_on_workspace("proof")
+                .call_method(component_address, "take_tokens_using_proof", args![
+                    Workspace("proof"),
+                    Amount(10)
+                ])
+                .put_last_instruction_output_on_workspace("tokens")
+                .call_method(user_account, "deposit", args![Workspace("tokens")])
+                .drop_all_proofs_in_workspace()
+                .sign(&user_key)
+                .build(),
+            vec![user_proof],
+        );
+    }
+
+    #[test]
+    fn it_locks_resources_used_in_proofs() {
+        let mut test = TemplateTest::new(["tests/templates/access_rules"]);
+
+        // Create sender and receiver accounts
+        let (owner_account, owner_proof, owner_key) = test.create_empty_account();
+
+        let access_rules_template = test.get_template_address("AccessRulesTest");
+
+        let result = test.execute_expect_success(
+            Transaction::builder()
+                .call_function(access_rules_template, "with_configured_rules", args![
+                    // Owner
+                    OwnerRule::OwnedBySigner,
+                    // Component
+                    ComponentAccessRules::new(),
+                    // Resource
+                    ResourceAccessRules::new(),
+                ])
+                .sign(&owner_key)
+                .build(),
+            vec![owner_proof.clone()],
+        );
+
+        let component_address = result.finalize.execution_results[0]
+            .decode::<ComponentAddress>()
+            .unwrap();
+        // Find the resource address for the tokens from the output substates
+        let token_resource = result
+            .finalize
+            .result
+            .accept()
+            .unwrap()
+            .up_iter()
+            .filter_map(|(addr, s)| s.substate_value().as_resource().map(|r| (addr, r)))
+            .filter(|(_, r)| r.resource_type().is_fungible())
+            .map(|(addr, _)| addr.as_resource_address().unwrap())
+            .next()
+            .unwrap();
+
+        // Take some tokens, generate a proof from the bucket (locking them up), and then try withdrawing them
+        let reason = test.execute_expect_failure(
+            Transaction::builder()
+                .call_method(component_address, "take_tokens", args![Amount(1000)])
+                .put_last_instruction_output_on_workspace("tokens")
+                .call_method(owner_account, "deposit", args![Workspace("tokens")])
+                .call_method(owner_account, "create_proof_by_amount", args![
+                    token_resource,
+                    Amount(1000)
+                ])
+                .put_last_instruction_output_on_workspace("proof")
+                .call_method(owner_account, "withdraw", args![token_resource, Amount(1000)])
+                .put_last_instruction_output_on_workspace("tokens")
+                .call_method(owner_account, "deposit", args![Workspace("tokens")])
+                .sign(&owner_key)
+                .build(),
+            vec![owner_proof.clone()],
+        );
+
+        assert_insufficient_funds_for_action(reason);
+
+        // Drop the proof before withdraw/deposit
+        test.execute_expect_success(
+            Transaction::builder()
+                .call_method(component_address, "take_tokens", args![Amount(1000)])
+                .put_last_instruction_output_on_workspace("tokens")
+                .call_method(owner_account, "deposit", args![Workspace("tokens")])
+                .call_method(owner_account, "create_proof_by_amount", args![
+                    token_resource,
+                    Amount(1000)
+                ])
+                .put_last_instruction_output_on_workspace("proof")
+                .drop_all_proofs_in_workspace()
+                .call_method(owner_account, "withdraw", args![token_resource, Amount(1000)])
+                .put_last_instruction_output_on_workspace("tokens")
+                .call_method(owner_account, "deposit", args![Workspace("tokens")])
+                .sign(&owner_key)
+                .build(),
+            vec![owner_proof.clone()],
+        );
+    }
+
+    #[test]
+    fn it_permits_cross_template_calls_using_proofs() {
+        let mut test = TemplateTest::new(["tests/templates/access_rules", "tests/templates/composability"]);
+
+        // Create sender and receiver accounts
+        let (owner_account, owner_proof, owner_key) = test.create_empty_account();
+
+        let access_rules_template = test.get_template_address("AccessRulesTest");
+
+        let result = test.execute_expect_success(
+            Transaction::builder()
+                .call_function(access_rules_template, "using_resource_rules", args![])
+                .sign(&owner_key)
+                .build(),
+            vec![owner_proof.clone()],
+        );
+
+        let component_address = result.finalize.execution_results[0]
+            .decode::<ComponentAddress>()
+            .unwrap();
+        // Find the resource address for the tokens from the output substates
+        let badge_resource = result
+            .finalize
+            .result
+            .accept()
+            .unwrap()
+            .up_iter()
+            .filter_map(|(addr, s)| s.substate_value().as_resource().map(|r| (addr, r)))
+            .filter(|(_, r)| r.resource_type().is_non_fungible())
+            .map(|(addr, _)| addr.as_resource_address().unwrap())
+            .next()
+            .unwrap();
+
+        let cross_call_template = test.get_template_address("Composability");
+        // Try to take tokens without proof. Even though I'm the owner of the resource, the scope does not carry over
+        // when cross-template calls are made.
+        let reason = test.execute_expect_failure(
+            Transaction::builder()
+                .call_function(cross_call_template, "call_component_with_args", args![
+                    component_address,
+                    "take_tokens",
+                    args![Amount(10)],
+                ])
+                .put_last_instruction_output_on_workspace("tokens")
+                .call_method(owner_account, "deposit", args![Workspace("tokens")])
+                .drop_all_proofs_in_workspace()
+                .sign(&owner_key)
+                .build(),
+            vec![owner_proof.clone()],
+        );
+
+        assert_access_denied_for_action(reason, ResourceAuthAction::Withdraw);
+
+        // Do a cross template call using a proof
+        test.execute_expect_success(
+            Transaction::builder()
+                .call_method(component_address, "mint_new_badge", args![])
+                .put_last_instruction_output_on_workspace("badge")
+                .call_method(owner_account, "deposit", args![Workspace("badge")])
+                .call_method(owner_account, "create_proof_for_resource", args![badge_resource])
+                .put_last_instruction_output_on_workspace("proof")
+                .call_function(cross_call_template, "call_component_with_args", args![
+                    component_address,
+                    "take_tokens_using_proof",
+                    args![Workspace("proof"), Amount(10)],
+                ])
+                .put_last_instruction_output_on_workspace("tokens")
+                .call_method(owner_account, "deposit", args![Workspace("tokens")])
+                .drop_all_proofs_in_workspace()
+                .sign(&owner_key)
+                .build(),
+            vec![owner_proof.clone()],
+        );
+    }
+}
diff --git a/dan_layer/engine/tests/account.rs b/dan_layer/engine/tests/account.rs
index 121001032c..5d6f49eaed 100644
--- a/dan_layer/engine/tests/account.rs
+++ b/dan_layer/engine/tests/account.rs
@@ -1,6 +1,9 @@
 //   Copyright 2023 The Tari Project
 //   SPDX-License-Identifier: BSD-3-Clause
 
+mod support;
+
+use tari_dan_engine::runtime::ActionIdent;
 use tari_engine_types::instruction::Instruction;
 use tari_template_lib::{
     args,
@@ -9,6 +12,8 @@ use tari_template_lib::{
 use tari_template_test_tooling::TemplateTest;
 use tari_transaction::Transaction;
 
+use crate::support::access_rules::assert_access_denied_for_action;
+
 #[test]
 fn basic_faucet_transfer() {
     let mut template_test = TemplateTest::new(vec!["tests/templates/faucet"]);
@@ -23,7 +28,7 @@ fn basic_faucet_transfer() {
                 function: "mint".to_string(),
                 args: args![initial_supply],
             }],
-            vec![],
+            vec![template_test.get_test_proof()],
         )
         .unwrap();
     let faucet_component: ComponentAddress = result.finalize.execution_results[0].decode().unwrap();
@@ -56,7 +61,7 @@ fn basic_faucet_transfer() {
                     args: args![Variable("free_coins")],
                 },
             ],
-            vec![],
+            vec![template_test.get_test_proof()],
         )
         .unwrap();
 
@@ -110,7 +115,7 @@ fn withdraw_from_account_prevented() {
                 function: "mint".to_string(),
                 args: args![initial_supply],
             }],
-            vec![],
+            vec![template_test.get_test_proof()],
         )
         .unwrap();
     let faucet_component: ComponentAddress = result.finalize.execution_results[0].decode().unwrap();
@@ -142,28 +147,22 @@ fn withdraw_from_account_prevented() {
         )
         .unwrap();
 
-    let (dest_address, non_owning_token, _) = template_test.create_owned_account();
-
-    let err = template_test
-        .execute_and_commit_manifest(
-            r#"
-                let source_account = var!["source_account"];
-                let dest_account = var!["dest_account"];
-                let resource = var!["resource"];
-                let stolen_coins = source_account.withdraw(resource, 100);
-                dest_account.deposit(stolen_coins);
-            "#,
-            [
-                ("source_account", source_account.into()),
-                ("dest_account", dest_address.into()),
-                ("resource", faucet_resource.into()),
-            ],
-            // VNs provide the token that signed the transaction, which in this case is the non_owning_token
-            vec![non_owning_token],
-        )
-        .unwrap_err();
+    let (dest_address, non_owning_token, non_owning_key) = template_test.create_owned_account();
+
+    let reason = template_test.execute_expect_failure(
+        Transaction::builder()
+            .call_method(source_account, "withdraw", args![faucet_resource, Amount(100)])
+            .put_last_instruction_output_on_workspace("stolen_coins")
+            .call_method(source_account, "deposit", args![Workspace("stolen_coins")])
+            .sign(&non_owning_key)
+            .build(),
+        // VNs provide the token that signed the transaction, which in this case is the non_owning_token
+        vec![non_owning_token],
+    );
 
-    assert!(err.to_string().contains("Access Denied: template.Account.withdraw"));
+    assert_access_denied_for_action(reason, ActionIdent::ComponentCallMethod {
+        method: "withdraw".to_string(),
+    });
 
     let result = template_test
         .execute_and_commit_manifest(
@@ -194,9 +193,8 @@ fn attempt_to_overwrite_account() {
     let (source_account, source_account_proof, source_account_sk) = template_test.create_owned_account();
 
     template_test.enable_fees();
-    let overwriting_tx = template_test
-        .try_execute_and_commit(
-            Transaction::builder()
+    let overwriting_tx = template_test.execute_expect_commit(
+        Transaction::builder()
                 .fee_transaction_pay_from_component(source_account, Amount(1000))
                 .call_function(template_test.get_template_address("Account"), "create", args![
                     &source_account_proof
@@ -204,23 +202,19 @@ fn attempt_to_overwrite_account() {
                 // Signed by source account so that it can pay the fees for the new account creation
                 .sign(&source_account_sk)
                 .build(),
-            vec![source_account_proof],
-        )
-        .unwrap();
+        vec![source_account_proof],
+    );
 
     template_test.disable_fees();
 
-    let result = template_test
-        .try_execute_and_commit(
-            Transaction::builder()
-                .call_method(source_account, "get_balances", args![])
-                .sign(&source_account_sk)
-                .build(),
-            vec![],
-        )
-        .unwrap();
+    let result = template_test.execute_expect_success(
+        Transaction::builder()
+            .call_method(source_account, "get_balances", args![])
+            .sign(&source_account_sk)
+            .build(),
+        vec![],
+    );
 
-    result.expect_success();
     let balances = result.finalize.execution_results[0]
         .decode::<Vec<(ResourceAddress, Amount)>>()
         .unwrap();
diff --git a/dan_layer/engine/tests/airdrop.rs b/dan_layer/engine/tests/airdrop.rs
index eb85c77af6..3093d1b844 100644
--- a/dan_layer/engine/tests/airdrop.rs
+++ b/dan_layer/engine/tests/airdrop.rs
@@ -24,7 +24,8 @@ fn setup() -> (TemplateTest, ComponentAddress, SubstateAddress) {
 fn airdrop() {
     let (mut template_test, airdrop, airdrop_resx) = setup();
 
-    let total_supply: Amount = template_test.call_method(airdrop, "total_supply", args![], vec![]);
+    let total_supply: Amount =
+        template_test.call_method(airdrop, "total_supply", args![], vec![template_test.get_test_proof()]);
     assert_eq!(total_supply, Amount(100));
 
     // Create 100 accounts
@@ -38,7 +39,7 @@ fn airdrop() {
             })
             .take(100)
             .collect(),
-            vec![],
+            vec![template_test.get_test_proof()],
         )
         .unwrap();
 
@@ -49,7 +50,7 @@ fn airdrop() {
         .map(|r| r.decode::<ComponentAddress>().unwrap())
         .collect::<Vec<_>>();
 
-    template_test.call_method::<()>(airdrop, "open_airdrop", args![], vec![]);
+    template_test.call_method::<()>(airdrop, "open_airdrop", args![], vec![template_test.get_test_proof()]);
 
     template_test
         .execute_and_commit(
@@ -63,7 +64,7 @@ fn airdrop() {
                     }]
                 })
                 .collect(),
-            vec![],
+            vec![template_test.get_test_proof()],
         )
         .unwrap();
 
@@ -92,7 +93,9 @@ fn airdrop() {
             ]
         })
         .collect();
-    let result = template_test.execute_and_commit(instructions, vec![]).unwrap();
+    let result = template_test
+        .execute_and_commit(instructions, vec![template_test.get_test_proof()])
+        .unwrap();
 
     for i in 0..100 {
         assert_eq!(
diff --git a/dan_layer/engine/tests/composability.rs b/dan_layer/engine/tests/composability.rs
index bc0aeda3eb..f28067bbc2 100644
--- a/dan_layer/engine/tests/composability.rs
+++ b/dan_layer/engine/tests/composability.rs
@@ -1,7 +1,9 @@
 //   Copyright 2023 The Tari Project
 //   SPDX-License-Identifier: BSD-3-Clause
 
-use tari_dan_engine::transaction::MAX_CALL_DEPTH;
+mod support;
+
+use tari_dan_engine::{runtime::ActionIdent, transaction::MAX_CALL_DEPTH};
 use tari_engine_types::{
     commit_result::{ExecuteResult, RejectReason},
     instruction::Instruction,
@@ -14,6 +16,8 @@ use tari_template_lib::{
 use tari_template_test_tooling::TemplateTest;
 use tari_transaction::Transaction;
 
+use crate::support::access_rules::assert_access_denied_for_action;
+
 struct ComposabilityTest {
     template_test: TemplateTest,
     composability_template: TemplateAddress,
@@ -251,7 +255,7 @@ fn it_fails_on_invalid_calls() {
     // the "invalid_state_call" method tries to call a non-existent method in the inner state component
     let result = test
         .template_test
-        .try_execute_and_commit(
+        .try_execute(
             Transaction::builder()
                 .call_method(components.composability_component, "invalid_state_call", args![])
                 .sign(&private_key)
@@ -269,34 +273,41 @@ fn it_fails_on_invalid_calls() {
 #[test]
 fn it_does_not_propagate_permissions() {
     let mut test = setup();
+
+    // Create a component owned by the test identity
     let components = initialize_composability(&mut test);
-    let (account, owner_proof, private_key) = test.template_test.create_owned_account();
+
+    let (attacker_proof, attacker_key) = test.template_test.get_test_proof_and_secret_key();
+    let (victim_account, victim_proof, _) = test.template_test.create_empty_account();
 
     // create_resource_and_fund_account
-    let fungible_resource = create_resource_and_fund_account(&mut test.template_test, account);
+    let fungible_resource = create_resource_and_fund_account(&mut test.template_test, victim_account);
 
-    // try to to an account withdraw inside the composability template, it should fail as the owner proof should not be
-    // propagated
+    // The attacker owns the composability component and so attempts to call another account's withdraw method
+    // hoping that ownership is preserved.
     let result = test
         .template_test
-        .try_execute_and_commit(
+        .try_execute(
             Transaction::builder()
                 .call_method(components.composability_component, "malicious_withdraw", args![
-                    account,
+                    victim_account,
                     fungible_resource,
-                    100
+                    Amount(100)
                 ])
-                .sign(&private_key)
+                .sign(&attacker_key)
                 .build(),
-            // note that we are actually passing a valid proof
-            vec![owner_proof],
+            // note that we are actually passing a valid proof of ownership for the victim. In reality, the engine only
+            // passes the transaction signer proof but we are assuming the attacker was able to somehow
+            // inject into the auth scope so that we can assert that proofs are not propagated in cross-template calls.
+            vec![attacker_proof, victim_proof],
         )
         .unwrap();
     let reason = result.expect_transaction_failure();
 
-    // TODO: inner errors are not properly propagated up, they all end up being "Engine call returned null for op
-    // CallInvoke" we should be able to assert a more specific error cause
-    assert!(matches!(reason, RejectReason::ExecutionFailure(_)));
+    // We expect the component call to withdraw to fail with AccessDenied.
+    assert_access_denied_for_action(reason, ActionIdent::ComponentCallMethod {
+        method: "withdraw".to_string(),
+    });
 }
 
 #[test]
@@ -350,7 +361,7 @@ fn it_fails_when_surpassing_recursion_limit() {
     // se when we do a call that goes from the outermost to the innermost, it must fail
     let result = test
         .template_test
-        .try_execute_and_commit(
+        .try_execute(
             Transaction::builder()
                 .call_method(last_composability_component, "get_nested_value", args![])
                 .sign(&private_key)
diff --git a/dan_layer/engine/tests/fees.rs b/dan_layer/engine/tests/fees.rs
index a30a5f17db..70f753a31c 100644
--- a/dan_layer/engine/tests/fees.rs
+++ b/dan_layer/engine/tests/fees.rs
@@ -21,18 +21,15 @@ fn deducts_fees_from_payments_and_refunds_the_rest() {
 
     test.enable_fees();
 
-    let result = test
-        .try_execute_and_commit(
-            Transaction::builder()
-                .fee_transaction_pay_from_component(account, Amount(1000))
-                .call_function(test.get_template_address("State"), "new", args![])
-                .sign(&private_key)
-                .build(),
-            vec![owner_token],
-        )
-        .unwrap();
+    let result = test.execute_expect_success(
+        Transaction::builder()
+            .fee_transaction_pay_from_component(account, Amount(1000))
+            .call_function(test.get_template_address("State"), "new", args![])
+            .sign(&private_key)
+            .build(),
+        vec![owner_token],
+    );
 
-    result.expect_success();
     test.disable_fees();
 
     // Check difference was refunded
@@ -52,16 +49,14 @@ fn deducts_fees_when_transaction_fails() {
 
     test.enable_fees();
 
-    let result = test
-        .try_execute_and_commit(
-            Transaction::builder()
-                .fee_transaction_pay_from_component(account, Amount(1000))
-                .call_function(test.get_template_address("State"), "this_doesnt_exist", args![])
-                .sign(&private_key)
-                .build(),
-            vec![owner_token],
-        )
-        .unwrap();
+    let result = test.execute_and_commit_on_success(
+        Transaction::builder()
+            .fee_transaction_pay_from_component(account, Amount(1000))
+            .call_function(test.get_template_address("State"), "this_doesnt_exist", args![])
+            .sign(&private_key)
+            .build(),
+        vec![owner_token],
+    );
 
     let reason = result.expect_transaction_failure();
     result.expect_finalization_success();
@@ -71,7 +66,8 @@ fn deducts_fees_when_transaction_fails() {
     // Check the fee was still paid
     let payment = result.fee_receipt.unwrap();
     let new_balance: Amount = test.call_method(account, "balance", args![CONFIDENTIAL_TARI_RESOURCE_ADDRESS], vec![]);
-    assert_eq!(orig_balance - new_balance, payment.total_fees_charged());
+    assert!(!payment.total_fees_paid().is_zero());
+    assert_eq!(orig_balance - new_balance, payment.total_fees_paid());
 }
 
 #[test]
@@ -81,37 +77,34 @@ fn deposit_from_faucet_then_pay() {
     let (account, owner_token, private_key) = test.create_empty_account();
 
     test.enable_fees();
-    let result = test
-        .try_execute_and_commit(
-            Transaction::builder()
-                .with_fee_instructions(vec![
-                    Instruction::CallMethod {
-                        component_address: test_faucet_component(),
-                        method: "take_free_coins".to_string(),
-                        args: args![],
-                    },
-                    Instruction::PutLastInstructionOutputOnWorkspace {
-                        key: b"bucket".to_vec(),
-                    },
-                    Instruction::CallMethod {
-                        component_address: account,
-                        method: "deposit".to_string(),
-                        args: args![Workspace("bucket")],
-                    },
-                    Instruction::CallMethod {
-                        component_address: account,
-                        method: "pay_fee".to_string(),
-                        args: args![Amount(1000)],
-                    },
-                ])
-                .call_function(test.get_template_address("State"), "new", args![])
-                .sign(&private_key)
-                .build(),
-            vec![owner_token],
-        )
-        .unwrap();
+    let result = test.execute_expect_success(
+        Transaction::builder()
+            .with_fee_instructions(vec![
+                Instruction::CallMethod {
+                    component_address: test_faucet_component(),
+                    method: "take_free_coins".to_string(),
+                    args: args![],
+                },
+                Instruction::PutLastInstructionOutputOnWorkspace {
+                    key: b"bucket".to_vec(),
+                },
+                Instruction::CallMethod {
+                    component_address: account,
+                    method: "deposit".to_string(),
+                    args: args![Workspace("bucket")],
+                },
+                Instruction::CallMethod {
+                    component_address: account,
+                    method: "pay_fee".to_string(),
+                    args: args![Amount(1000)],
+                },
+            ])
+            .call_function(test.get_template_address("State"), "new", args![])
+            .sign(&private_key)
+            .build(),
+        vec![owner_token],
+    );
 
-    result.expect_success();
     test.disable_fees();
 
     let payment = result.fee_receipt.unwrap();
@@ -137,9 +130,8 @@ fn another_account_pays_partially_for_fees() {
 
     test.enable_fees();
 
-    let result = test
-        .try_execute_and_commit(
-            Transaction::builder()
+    let result = test.execute_expect_success(
+        Transaction::builder()
                 // Faucet pays a little
                 .fee_transaction_pay_from_component(test_faucet_component(), Amount(200))
                 // Account pays the rest
@@ -149,11 +141,9 @@ fn another_account_pays_partially_for_fees() {
                 .call_method(account, "deposit", args![Workspace("bucket")])
                 .sign(&private_key)
                 .build(),
-            vec![owner_token_fee, owner_token],
-        )
-        .unwrap();
+        vec![owner_token_fee, owner_token],
+    );
 
-    result.expect_success();
     test.disable_fees();
 
     // Check difference was refunded
@@ -183,7 +173,7 @@ fn failed_fee_transaction() {
 
     test.enable_fees();
     let result = test
-        .try_execute_and_commit(
+        .try_execute(
             Transaction::builder()
                 .with_fee_instructions(vec![Instruction::CallMethod {
                     component_address: account,
@@ -218,9 +208,8 @@ fn fail_partial_paid_fees() {
 
     test.enable_fees();
 
-    let result = test
-        .try_execute_and_commit(
-            Transaction::builder()
+    let result = test.execute_expect_commit(
+        Transaction::builder()
                 // Pay less fees than the cost of the main transaction
                 .fee_transaction_pay_from_component(account, Amount(10))
                 // These instructions should not be applied
@@ -232,13 +221,11 @@ fn fail_partial_paid_fees() {
                 .call_method(account, "deposit", args![Workspace("bucket")])
                 .sign(&private_key)
                 .build(),
-            vec![owner_token, owner_token2],
-        )
-        .unwrap();
+        vec![owner_token, owner_token2],
+    );
 
     test.disable_fees();
 
-    result.expect_finalization_success();
     let reason = result.expect_transaction_failure();
     assert!(matches!(reason, RejectReason::FeesNotPaid(_)));
 
@@ -261,7 +248,7 @@ fn fail_pay_less_fees_than_fee_transaction() {
     test.enable_fees();
 
     let result = test
-        .try_execute_and_commit(
+        .try_execute(
             Transaction::builder()
                 .with_fee_instructions(
                     // Run up a bill to push it up over the loan
@@ -320,7 +307,7 @@ fn fail_pay_too_little_no_fee_instruction() {
     test.enable_fees();
 
     let result = test
-        .try_execute_and_commit(
+        .try_execute(
             Transaction::builder()
                 // These instructions should not be applied
                 .call_method(account2, "withdraw", args![
@@ -356,26 +343,22 @@ fn success_pay_fee_in_main_instructions() {
 
     test.enable_fees();
 
-    let result = test
-        .try_execute_and_commit(
-            Transaction::builder()
-                .call_method(account2, "withdraw", args![
-                    CONFIDENTIAL_TARI_RESOURCE_ADDRESS,
-                    Amount(500)
-                ])
-                .put_last_instruction_output_on_workspace("bucket")
-                .call_method(account, "deposit", args![Workspace("bucket")])
-                .call_method(account, "pay_fee", args![Amount(1000)])
-                .sign(&private_key)
-                .build(),
-            vec![owner_token, owner_token2],
-        )
-        .unwrap();
+    let result = test.execute_expect_success(
+        Transaction::builder()
+            .call_method(account2, "withdraw", args![
+                CONFIDENTIAL_TARI_RESOURCE_ADDRESS,
+                Amount(500)
+            ])
+            .put_last_instruction_output_on_workspace("bucket")
+            .call_method(account, "deposit", args![Workspace("bucket")])
+            .call_method(account, "pay_fee", args![Amount(1000)])
+            .sign(&private_key)
+            .build(),
+        vec![owner_token, owner_token2],
+    );
 
     test.disable_fees();
 
-    result.expect_success();
-
     let fees = result.expect_fees_paid_in_full();
 
     // Fee was deducted
diff --git a/dan_layer/engine/tests/support/access_rules.rs b/dan_layer/engine/tests/support/access_rules.rs
new file mode 100644
index 0000000000..dfe87b8b08
--- /dev/null
+++ b/dan_layer/engine/tests/support/access_rules.rs
@@ -0,0 +1,43 @@
+//   Copyright 2023 The Tari Project
+//   SPDX-License-Identifier: BSD-3-Clause
+
+use std::borrow::Borrow;
+
+use tari_dan_engine::runtime::{ActionIdent, RuntimeError};
+use tari_engine_types::{commit_result::RejectReason, resource_container::ResourceError};
+
+#[allow(dead_code)]
+pub fn assert_access_denied_for_action<B: Borrow<RejectReason>, A: Into<ActionIdent>>(reason: B, action_ident: A) {
+    match reason.borrow() {
+        // TODO: Would be great if we could enumerate specific reasons from within the engine rather than simply
+        //       turning RuntimeError into a string
+        RejectReason::ExecutionFailure(s) => assert!(
+            s.contains(
+                &RuntimeError::AccessDenied {
+                    action_ident: action_ident.into()
+                }
+                .to_string()
+            ),
+            "Unexpected reject reason \"{}\"",
+            s,
+        ),
+        r => panic!("Unexpected reject reason {}", r),
+    }
+}
+
+#[allow(dead_code)]
+pub fn assert_insufficient_funds_for_action<B: Borrow<RejectReason>>(reason: B) {
+    match reason.borrow() {
+        RejectReason::ExecutionFailure(s) => assert!(
+            s.contains(
+                &RuntimeError::ResourceError(ResourceError::InsufficientBalance {
+                    details: "Bucket contained insufficient funds".to_string()
+                })
+                .to_string()
+            ),
+            "Unexpected reject reason \"{}\"",
+            s,
+        ),
+        r => panic!("Unexpected reject reason {}", r),
+    }
+}
diff --git a/dan_layer/engine/tests/support/mod.rs b/dan_layer/engine/tests/support/mod.rs
new file mode 100644
index 0000000000..dab9e8a028
--- /dev/null
+++ b/dan_layer/engine/tests/support/mod.rs
@@ -0,0 +1,4 @@
+//   Copyright 2023 The Tari Project
+//   SPDX-License-Identifier: BSD-3-Clause
+
+pub mod access_rules;
diff --git a/dan_layer/engine/tests/tariswap.rs b/dan_layer/engine/tests/tariswap.rs
index c632e605a5..1e1fcc5de6 100644
--- a/dan_layer/engine/tests/tariswap.rs
+++ b/dan_layer/engine/tests/tariswap.rs
@@ -190,8 +190,9 @@ fn add_liquidity(test: &mut TariSwapTest, a_amount: Amount, b_amount: Amount) {
                     args: args![Variable("lp_bucket")],
                 },
             ],
-            // proof needed to withdraw
-            vec![test.account_proof.clone()],
+            // proof needed to withdraw (from account) and mint (the lp_resource owned by the test identity)
+            // respectively
+            vec![test.account_proof.clone(), test.template_test.get_test_proof()],
         )
         .unwrap();
 }
@@ -227,8 +228,9 @@ fn remove_liquidity(test: &mut TariSwapTest, lp_amount: Amount) {
                     args: args![Variable("pool_buckets.1"),],
                 },
             ],
-            // proof needed to withdraw
-            vec![test.account_proof.clone()],
+            // proof needed to withdraw (from account) and burn (the lp_resource owned by the test identity)
+            // respectively
+            vec![test.account_proof.clone(), test.template_test.get_test_proof()],
         )
         .unwrap();
 }
@@ -338,7 +340,7 @@ fn tariswap() {
     let fee = 50; // 5% market fee
     let mut test = setup(fee);
 
-    // save the resource addreses to keep the compiler happy
+    // copy the resource addresses to keep the borrow checker happy
     let a_resource = test.a_resource;
     let b_resource = test.b_resource;
 
diff --git a/dan_layer/engine/tests/templates/access_rules/Cargo.toml b/dan_layer/engine/tests/templates/access_rules/Cargo.toml
new file mode 100644
index 0000000000..4619077e7d
--- /dev/null
+++ b/dan_layer/engine/tests/templates/access_rules/Cargo.toml
@@ -0,0 +1,13 @@
+[workspace]
+[package]
+name = "access_rules"
+version = "0.1.0"
+edition = "2021"
+
+# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+
+[dependencies]
+tari_template_lib = { path = "../../../../template_lib" }
+
+[lib]
+crate-type = ["cdylib", "lib"]
diff --git a/dan_layer/engine/tests/templates/access_rules/src/lib.rs b/dan_layer/engine/tests/templates/access_rules/src/lib.rs
new file mode 100644
index 0000000000..08945a0c0b
--- /dev/null
+++ b/dan_layer/engine/tests/templates/access_rules/src/lib.rs
@@ -0,0 +1,170 @@
+//   Copyright 2023 The Tari Project
+//   SPDX-License-Identifier: BSD-3-Clause
+
+use tari_template_lib::prelude::*;
+
+pub fn create_badge_resource() -> Bucket {
+    ResourceBuilder::non_fungible("badge")
+        .with_non_fungible(NonFungibleId::from_string("mint"), &(), &())
+        .with_non_fungible(NonFungibleId::from_string("burn"), &(), &())
+        .with_non_fungible(NonFungibleId::from_string("withdraw"), &(), &())
+        .with_non_fungible(NonFungibleId::from_string("deposit"), &(), &())
+        .build_bucket()
+}
+
+#[template]
+mod access_rules_template {
+    use super::*;
+
+    pub struct AccessRulesTest {
+        value: u32,
+        tokens: Vault,
+        badges: Vault,
+    }
+
+    impl AccessRulesTest {
+        pub fn with_configured_rules(
+            owner_rule: OwnerRule,
+            component_access_rule: ComponentAccessRules,
+            resource_rules: ResourceAccessRules,
+        ) -> Component<AccessRulesTest> {
+            let tokens = ResourceBuilder::fungible("tokens")
+                .with_owner_rule(owner_rule.clone())
+                .with_access_rules(resource_rules)
+                .initial_supply(1000)
+                .build_bucket();
+
+            let badges = create_badge_resource();
+
+            Component::new(Self {
+                value: 0,
+                tokens: Vault::from_bucket(tokens),
+                badges: Vault::from_bucket(badges),
+            })
+            .with_owner_rule(owner_rule)
+            .with_access_rules(component_access_rule)
+            .create()
+        }
+
+        pub fn default_rules() -> Component<AccessRulesTest> {
+            let badges = create_badge_resource();
+
+            let tokens = ResourceBuilder::fungible("tokens").initial_supply(1000).build_bucket();
+
+            Component::create(Self {
+                value: 0,
+                tokens: Vault::from_bucket(tokens),
+                badges: Vault::from_bucket(badges),
+            })
+        }
+
+        pub fn using_badge_rules() -> Component<AccessRulesTest> {
+            let badges = create_badge_resource();
+
+            let badge_resource = badges.resource_address();
+            let tokens = ResourceBuilder::fungible("tokens")
+                .initial_supply(1000)
+                .mintable(AccessRule::Restricted(RestrictedAccessRule::Require(
+                    RequireRule::Require(
+                        NonFungibleAddress::new(badge_resource, NonFungibleId::from_string("mint")).into(),
+                    ),
+                )))
+                .burnable(AccessRule::Restricted(RestrictedAccessRule::Require(
+                    RequireRule::Require(
+                        NonFungibleAddress::new(badge_resource, NonFungibleId::from_string("burn")).into(),
+                    ),
+                )))
+                .withdrawable(AccessRule::Restricted(RestrictedAccessRule::Require(
+                    RequireRule::Require(
+                        NonFungibleAddress::new(badge_resource, NonFungibleId::from_string("withdraw")).into(),
+                    ),
+                )))
+                .depositable(AccessRule::Restricted(RestrictedAccessRule::Require(
+                    RequireRule::Require(
+                        NonFungibleAddress::new(badge_resource, NonFungibleId::from_string("deposit")).into(),
+                    ),
+                )))
+                .build_bucket();
+
+            Component::new(Self {
+                value: 0,
+                tokens: Vault::from_bucket(tokens),
+                badges: Vault::from_bucket(badges),
+            })
+            .with_access_rules(ComponentAccessRules::new().default(AccessRule::AllowAll))
+            .create()
+        }
+
+        pub fn using_resource_rules() -> Component<AccessRulesTest> {
+            let badges = create_badge_resource();
+
+            let badge_resource = badges.resource_address();
+            let tokens = ResourceBuilder::fungible("tokens")
+                .initial_supply(1000)
+                .mintable(AccessRule::Restricted(RestrictedAccessRule::Require(
+                    RequireRule::Require(badge_resource.into()),
+                )))
+                .burnable(AccessRule::Restricted(RestrictedAccessRule::Require(
+                    RequireRule::Require(badge_resource.into()),
+                )))
+                .withdrawable(AccessRule::Restricted(RestrictedAccessRule::Require(
+                    RequireRule::Require(badge_resource.into()),
+                )))
+                .depositable(AccessRule::Restricted(RestrictedAccessRule::Require(
+                    RequireRule::Require(badge_resource.into()),
+                )))
+                .build_bucket();
+
+            Component::new(Self {
+                value: 0,
+                tokens: Vault::from_bucket(tokens),
+                badges: Vault::from_bucket(badges),
+            })
+            .with_access_rules(ComponentAccessRules::new().default(AccessRule::AllowAll))
+            .create()
+        }
+
+        pub fn take_badge_by_name(&mut self, name: String) -> Bucket {
+            self.badges.withdraw_non_fungible(NonFungibleId::from_string(&name))
+        }
+
+        pub fn mint_new_badge(&mut self) -> Bucket {
+            ResourceManager::get(self.badges.resource_address()).mint_non_fungible(NonFungibleId::random(), &(), &())
+        }
+
+        pub fn take_tokens(&mut self, amount: Amount) -> Bucket {
+            self.tokens.withdraw(amount)
+        }
+
+        pub fn take_tokens_using_proof(&mut self, proof: Proof, amount: Amount) -> Bucket {
+            // let _access = proof.authorize(); is better if you want to panic immediately
+            // try_authorize can be used to determine if access is permitted and still run some other code branch if
+            // not.
+            match proof.try_authorize() {
+                Ok(_access) => self.tokens.withdraw(amount),
+                Err(_) => {
+                    debug!("Sorry, not allowed to take tokens");
+                    panic!("Access denied");
+                },
+            }
+        }
+
+        pub fn set_value(&mut self, value: u32) {
+            debug!("Changing value from {} to {}", self.value, value);
+            self.value = value;
+        }
+
+        pub fn get_value(&self) -> u32 {
+            self.value
+        }
+
+        pub fn set_component_access_rules(&mut self, access_rules: ComponentAccessRules) {
+            let component_addr = CallerContext::current_component_address();
+            ComponentManager::get(component_addr).set_access_rules(access_rules);
+        }
+
+        pub fn set_tokens_access_rules(&mut self, access_rules: ResourceAccessRules) {
+            ResourceManager::get(self.tokens.resource_address()).set_access_rules(access_rules);
+        }
+    }
+}
diff --git a/dan_layer/engine/tests/templates/caller_context/src/lib.rs b/dan_layer/engine/tests/templates/caller_context/src/lib.rs
index 0a21bdb54c..5bf5d7a332 100644
--- a/dan_layer/engine/tests/templates/caller_context/src/lib.rs
+++ b/dan_layer/engine/tests/templates/caller_context/src/lib.rs
@@ -31,9 +31,11 @@ mod caller_context_template {
     }
 
     impl CallerContextTest {
-        pub fn create() -> Self {
-            let caller_pub_key = CallerContext::caller();
-            Self { caller_pub_key }
+        pub fn create() -> Component<Self> {
+            let caller_pub_key = CallerContext::transaction_signer_public_key();
+            Component::new(Self { caller_pub_key })
+                .with_access_rules(AccessRules::allow_all())
+                .create()
         }
 
         pub fn caller_pub_key(&self) -> RistrettoPublicKeyBytes {
diff --git a/dan_layer/engine/tests/templates/composability/Cargo.toml b/dan_layer/engine/tests/templates/composability/Cargo.toml
index ba69959b5a..b73a27e565 100644
--- a/dan_layer/engine/tests/templates/composability/Cargo.toml
+++ b/dan_layer/engine/tests/templates/composability/Cargo.toml
@@ -4,12 +4,9 @@ name = "composability"
 version = "0.1.0"
 edition = "2021"
 
-# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
-
 [dependencies]
 tari_template_lib = { path = "../../../../template_lib" }
-
-
+tari_bor = { path = "../../../../tari_bor" }
 
 [lib]
 crate-type = ["cdylib", "lib"]
diff --git a/dan_layer/engine/tests/templates/composability/src/lib.rs b/dan_layer/engine/tests/templates/composability/src/lib.rs
index 6f077dd087..ea2544eb37 100644
--- a/dan_layer/engine/tests/templates/composability/src/lib.rs
+++ b/dan_layer/engine/tests/templates/composability/src/lib.rs
@@ -37,18 +37,27 @@ mod composability {
     impl Composability {
         // function-to-function call
         // both "composability" and "state" components are created
-        pub fn new(state_template_address: TemplateAddress) -> Self {
-            let state_component_address = TemplateManager::get(state_template_address)
-                .call("new".to_string(), vec![]);
-            Self { state_component_address, nested_composability: None }
+        pub fn new(state_template_address: TemplateAddress) -> Component<Self> {
+            let state_component_address = TemplateManager::get(state_template_address).call("new".to_string(), args![]);
+            Component::new(Self {
+                state_component_address,
+                nested_composability: None,
+            })
+            .with_access_rules(AccessRules::allow_all())
+            .create()
         }
 
         // function-to-component call
         // the argument is a "Composability" component, we get the "State" component address from it
-        pub fn new_from_component(other_composability_component_address: ComponentAddress) -> Self {
+        pub fn new_from_component(other_composability_component_address: ComponentAddress) -> Component<Self> {
             let state_component_address = ComponentManager::get(other_composability_component_address)
-                .call("get_state_component_address".to_string(), vec![]);
-            Self { state_component_address, nested_composability: None }
+                .call("get_state_component_address".to_string(), args![]);
+            Component::new(Self {
+                state_component_address,
+                nested_composability: None,
+            })
+            .with_access_rules(AccessRules::allow_all())
+            .create()
         }
 
         pub fn get_state_component_address(&self) -> ComponentAddress {
@@ -64,36 +73,39 @@ mod composability {
             let component = ComponentManager::get(self.state_component_address);
 
             // read operation, to get the current value of the inner "State" component
-            let value: u32 = component
-                .call("get".to_string(), vec![]);
+            let value: u32 = component.call("get".to_string(), args![]);
 
             // write operation, to update the value of the inner "State" component
-            component.call::<()>("set".to_string(), invoke_args![value+1]);
+            component.call::<()>("set".to_string(), args![value + 1]);
         }
 
         // function-to-component call
         pub fn replace_state_component(&mut self, state_template_address: TemplateAddress) {
-            self.state_component_address = TemplateManager::get(state_template_address)
-                .call::<ComponentAddress>("new".to_string(), vec![]);
+            self.state_component_address =
+                TemplateManager::get(state_template_address).call::<ComponentAddress>("new".to_string(), args![]);
         }
 
         // invalid call (target method does not exists)
         pub fn invalid_state_call(&self) {
-            ComponentManager::get(self.state_component_address)
-                .call::<()>("invalid_method".to_string(), vec![]);
+            ComponentManager::get(self.state_component_address).call::<()>("invalid_method".to_string(), args![]);
         }
 
         // malicious method, that tries to withdraw from caller's account
-        // the engine should fail any call to this method 
-        pub fn malicious_withdraw(&self, victim_account_address: ComponentAddress, resource_address: ResourceAddress, amount: Amount) {
+        // the engine should fail any call to this method
+        pub fn malicious_withdraw(
+            &self,
+            victim_account_address: ComponentAddress,
+            resource_address: ResourceAddress,
+            amount: Amount,
+        ) {
             let account = ComponentManager::get(victim_account_address);
-            
+
             // we try to withdraw the funds, this operation SHOULD fail due to insufficient permissions
-            let bucket: Bucket = account.call("withdraw".to_string(), invoke_args![resource_address, amount]);
+            let bucket: Bucket = account.call("withdraw".to_string(), args![resource_address, amount]);
 
             // we are going to return back the funds so the call does not fail for "dangling buckets" reason
             // but if the previous operation does execute, this means we could have sent the funds to any other account
-            account.call::<()>("deposit".to_string(), invoke_args![bucket]);
+            account.call::<()>("deposit".to_string(), args![bucket]);
         }
 
         // recursive function used to test recursion depth limits
@@ -101,15 +113,21 @@ mod composability {
             match self.nested_composability {
                 Some(addr) => {
                     // recursive call to the nested composability component
-                    ComponentManager::get(addr)
-                        .call("get_nested_value".to_string(), vec![])
+                    ComponentManager::get(addr).call("get_nested_value".to_string(), args![])
                 },
                 None => {
                     // base case that will end a recursive call chain
-                    ComponentManager::get(self.state_component_address)
-                        .call("get".to_string(), vec![])
-                }
+                    ComponentManager::get(self.state_component_address).call("get".to_string(), args![])
+                },
             }
         }
+
+        pub fn call_component_with_args(
+            component_address: ComponentAddress,
+            method_name: String,
+            args: Vec<tari_template_lib::args::Arg>,
+        ) -> tari_bor::Value {
+            ComponentManager::get(component_address).call(method_name, args)
+        }
     }
 }
diff --git a/dan_layer/engine/tests/templates/confidential/faucet/src/lib.rs b/dan_layer/engine/tests/templates/confidential/faucet/src/lib.rs
index 56c63aa615..3805b751bb 100644
--- a/dan_layer/engine/tests/templates/confidential/faucet/src/lib.rs
+++ b/dan_layer/engine/tests/templates/confidential/faucet/src/lib.rs
@@ -31,14 +31,16 @@ mod faucet_template {
     }
 
     impl ConfidentialFaucet {
-        pub fn mint(confidential_proof: ConfidentialOutputProof) -> Self {
+        pub fn mint(confidential_proof: ConfidentialOutputProof) -> Component<Self> {
             let coins = ResourceBuilder::confidential("testconf")
                 .initial_supply(confidential_proof)
                 .build_bucket();
 
-            Self {
+            Component::new(Self {
                 vault: Vault::from_bucket(coins),
-            }
+            })
+            .with_access_rules(AccessRules::allow_all())
+            .create()
         }
 
         pub fn take_free_coins(&mut self, proof: ConfidentialWithdrawProof) -> Bucket {
diff --git a/dan_layer/engine/tests/templates/faucet/src/lib.rs b/dan_layer/engine/tests/templates/faucet/src/lib.rs
index 364ea8ea82..851162594a 100644
--- a/dan_layer/engine/tests/templates/faucet/src/lib.rs
+++ b/dan_layer/engine/tests/templates/faucet/src/lib.rs
@@ -31,26 +31,27 @@ mod faucet_template {
     }
 
     impl TestFaucet {
-        pub fn mint(initial_supply: Amount) -> Self {
+        pub fn mint(initial_supply: Amount) -> Component<Self> {
             Self::mint_with_symbol(initial_supply, "faucets".to_string())
         }
 
-        pub fn mint_with_symbol(initial_supply: Amount, symbol: String) -> Self {
+        pub fn mint_with_symbol(initial_supply: Amount, symbol: String) -> Component<Self> {
             let coins = ResourceBuilder::fungible(symbol)
                 .initial_supply(initial_supply)
                 .build_bucket();
 
-            Self {
+            Component::new(Self {
                 vault: Vault::from_bucket(coins),
-            }
+            })
+            .with_access_rules(AccessRules::allow_all())
+            .create()
         }
 
         pub fn take_free_coins(&mut self) -> Bucket {
-            debug("Withdrawing 1000 coins from faucet");
+            debug!("Withdrawing 1000 coins from faucet");
             self.vault.withdraw(Amount(1000))
         }
 
-        // TODO: we can make a fungible utility template with these common operations
         pub fn burn_coins(&mut self, amount: Amount) {
             let mut bucket = self.vault.withdraw(amount);
             bucket.burn();
diff --git a/dan_layer/engine/tests/templates/hello_world/src/lib.rs b/dan_layer/engine/tests/templates/hello_world/src/lib.rs
index dd7fd1ae57..09d03ce1ce 100644
--- a/dan_layer/engine/tests/templates/hello_world/src/lib.rs
+++ b/dan_layer/engine/tests/templates/hello_world/src/lib.rs
@@ -21,9 +21,9 @@
 //  USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 use tari_template_lib::prelude::*;
-
 #[template]
 mod hello_world {
+    use super::*;
     pub struct HelloWorld {
         greeting: String,
     }
@@ -33,8 +33,10 @@ mod hello_world {
             "Hello World!".to_string()
         }
 
-        pub fn new(greeting: String) -> Self {
-            Self { greeting }
+        pub fn new(greeting: String) -> Component<Self> {
+            Component::new(Self { greeting })
+                .with_access_rules(AccessRules::allow_all())
+                .create()
         }
 
         pub fn custom_greeting(&self, name: String) -> String {
diff --git a/dan_layer/engine/tests/templates/nft/airdrop/src/lib.rs b/dan_layer/engine/tests/templates/nft/airdrop/src/lib.rs
index 9a2c6aa36b..3fe72d3933 100644
--- a/dan_layer/engine/tests/templates/nft/airdrop/src/lib.rs
+++ b/dan_layer/engine/tests/templates/nft/airdrop/src/lib.rs
@@ -34,17 +34,19 @@ mod airdrop_template {
     }
 
     impl Airdrop {
-        pub fn new() -> Self {
+        pub fn new() -> Component<Self> {
             let bucket = ResourceBuilder::non_fungible("AIR")
                 .mint_many_with(1..=100, |n| (NonFungibleId::from_u32(n), (Vec::new(), Vec::new())))
                 .build_bucket();
 
-            Self {
+            Component::new(Self {
                 allow_list: HashSet::new(),
                 is_airdrop_open: false,
                 claimed_count: 0,
                 vault: Vault::from_bucket(bucket),
-            }
+            })
+            .with_access_rules(AccessRules::allow_all())
+            .create()
         }
 
         pub fn add_recipient(&mut self, address: ComponentAddress) {
diff --git a/dan_layer/engine/tests/templates/nft/basic_nft/src/lib.rs b/dan_layer/engine/tests/templates/nft/basic_nft/src/lib.rs
index c959b508f4..5872c9ecd1 100644
--- a/dan_layer/engine/tests/templates/nft/basic_nft/src/lib.rs
+++ b/dan_layer/engine/tests/templates/nft/basic_nft/src/lib.rs
@@ -36,7 +36,7 @@ mod sparkle_nft_template {
     }
 
     impl SparkleNft {
-        pub fn new() -> Self {
+        pub fn new() -> Component<Self> {
             // Create the non-fungible resource with 1 token (optional)
             let tokens = [
                 (NonFungibleId::from_u32(1), (&(), &())),
@@ -46,12 +46,17 @@ mod sparkle_nft_template {
             ];
             let bucket = ResourceBuilder::non_fungible("SPKL")
                 .with_non_fungibles(tokens)
+                // Allow minting and burning for tests
+                .mintable(AccessRule::AllowAll)
+                .burnable(AccessRule::AllowAll)
                 .build_bucket();
 
-            Self {
+            Component::new(Self {
                 address: bucket.resource_address(),
                 vault: Vault::from_bucket(bucket),
-            }
+            })
+            .with_access_rules(AccessRules::allow_all())
+            .create()
         }
 
         pub fn mint(&mut self) -> Bucket {
@@ -61,7 +66,7 @@ mod sparkle_nft_template {
         }
 
         pub fn mint_specific(&mut self, id: NonFungibleId) -> Bucket {
-            debug(format!("Minting {}", id));
+            debug!("Minting {}", id);
             // These are characteristic of the NFT and are immutable
             let mut immutable_data = Metadata::new();
             immutable_data
@@ -77,14 +82,14 @@ mod sparkle_nft_template {
         }
 
         pub fn inc_brightness(&mut self, id: NonFungibleId, brightness: u32) {
-            debug(format!("Increase brightness on {} by {}", id, brightness));
+            debug!("Increase brightness on {} by {}", id, brightness);
             self.with_sparkle_mut(id, |data| {
                 data.brightness = data.brightness.checked_add(brightness).expect("Brightness overflow");
             });
         }
 
         pub fn dec_brightness(&mut self, id: NonFungibleId, brightness: u32) {
-            debug(format!("Decrease brightness on {} by {}", id, brightness));
+            debug!("Decrease brightness on {} by {}", id, brightness);
             self.with_sparkle_mut(id, |data| {
                 data.brightness = data
                     .brightness
diff --git a/dan_layer/engine/tests/templates/nft/emoji_id/src/lib.rs b/dan_layer/engine/tests/templates/nft/emoji_id/src/lib.rs
index 0e2b7f8267..9d34081bb1 100644
--- a/dan_layer/engine/tests/templates/nft/emoji_id/src/lib.rs
+++ b/dan_layer/engine/tests/templates/nft/emoji_id/src/lib.rs
@@ -72,16 +72,24 @@ mod emoji_id {
     impl EmojiIdMinter {
         // TODO: in this example we need to specify the payment resource, but there should be native support for Thaums
         // TODO: decoding fails if "max_emoji_id_len" is usize instead of u64, we may need to add support for it
-        pub fn new(payment_resource_address: ResourceAddress, max_emoji_id_len: u64, mint_price: Amount) -> Self {
+        pub fn new(
+            payment_resource_address: ResourceAddress,
+            max_emoji_id_len: u64,
+            mint_price: Amount,
+        ) -> Component<Self> {
             // Create the non-fungible resource with empty initial supply
-            let resource_address = ResourceBuilder::non_fungible("emo").build();
+            let resource_address = ResourceBuilder::non_fungible("emo")
+                .mintable(AccessRule::AllowAll)
+                .build();
             let earnings = Vault::new_empty(payment_resource_address);
-            Self {
+            Component::new(Self {
                 max_emoji_id_len,
                 mint_price,
                 resource_address,
                 earnings,
-            }
+            })
+            .with_access_rules(AccessRules::allow_all())
+            .create()
         }
 
         // TODO: return change (or check bucket.value() == required_amount)
diff --git a/dan_layer/engine/tests/templates/nft/nft_list/src/lib.rs b/dan_layer/engine/tests/templates/nft/nft_list/src/lib.rs
index 83a619f526..db387d2f55 100644
--- a/dan_layer/engine/tests/templates/nft/nft_list/src/lib.rs
+++ b/dan_layer/engine/tests/templates/nft/nft_list/src/lib.rs
@@ -29,16 +29,19 @@ pub struct Sparkle {
 #[template]
 mod sparkle_nft_template {
     use super::*;
-
     pub struct SparkleNft {
         resource_address: ResourceAddress,
     }
 
     impl SparkleNft {
-        pub fn new() -> Self {
-            let resource_address = ResourceBuilder::non_fungible("sparkle").build();
-
-            Self { resource_address }
+        pub fn new() -> Component<Self> {
+            let resource_address = ResourceBuilder::non_fungible("sparkle")
+                .mintable(AccessRule::AllowAll)
+                .build();
+
+            Component::new(Self { resource_address })
+                .with_access_rules(AccessRules::allow_all())
+                .create()
         }
 
         pub fn mint(&mut self) -> Bucket {
diff --git a/dan_layer/engine/tests/templates/nft/tickets/src/lib.rs b/dan_layer/engine/tests/templates/nft/tickets/src/lib.rs
index 3287066b65..80f9c0905f 100644
--- a/dan_layer/engine/tests/templates/nft/tickets/src/lib.rs
+++ b/dan_layer/engine/tests/templates/nft/tickets/src/lib.rs
@@ -47,12 +47,13 @@ mod tickets {
             initial_supply: usize,
             price: Amount,
             event_description: String,
-        ) -> Self {
+        ) -> Component<Self> {
+            let owner = CallerContext::transaction_signer_public_key().to_non_fungible_address();
             // Create the non-fungible resource
-            // TODO: restrict minting to only the owner
             let resource_address = ResourceBuilder::non_fungible("tix")
                 // The event description is common for all tickets
                 .add_metadata("event", event_description)
+                .mintable(AccessRule::Restricted(RestrictedAccessRule::Require(RequireRule::Require(owner.into()))))
                 .build();
 
             // Mint the initial tickets
@@ -65,12 +66,14 @@ mod tickets {
 
             let earnings = Vault::new_empty(payment_resource_address);
 
-            Self {
+            Component::new(Self {
                 resource_address,
                 tickets,
                 price,
                 earnings,
-            }
+            })
+            .with_access_rules(AccessRules::allow_all())
+            .create()
         }
 
         // TODO: this method should only be allowed for the owner, when they want to increase attendance of the event
diff --git a/dan_layer/engine/tests/templates/private_function/src/lib.rs b/dan_layer/engine/tests/templates/private_function/src/lib.rs
index 8486ebee97..024e6d66f6 100644
--- a/dan_layer/engine/tests/templates/private_function/src/lib.rs
+++ b/dan_layer/engine/tests/templates/private_function/src/lib.rs
@@ -21,16 +21,18 @@
 //  USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 use tari_template_lib::prelude::*;
-
 #[template]
 mod private_function {
+    use super::*;
     pub struct PrivateCounter {
         pub value: u32,
     }
 
     impl PrivateCounter {
-        pub fn new() -> Self {
-            Self { value: 0 }
+        pub fn new() -> Component<Self> {
+            Component::new(Self { value: 0 })
+                .with_access_rules(AccessRules::allow_all())
+                .create()
         }
 
         pub fn get(&self) -> u32 {
diff --git a/dan_layer/engine/tests/templates/random/src/lib.rs b/dan_layer/engine/tests/templates/random/src/lib.rs
index 2b8b415ffe..780acbc9f6 100644
--- a/dan_layer/engine/tests/templates/random/src/lib.rs
+++ b/dan_layer/engine/tests/templates/random/src/lib.rs
@@ -33,15 +33,17 @@ mod random_template {
     }
 
     impl RandomTest {
-        pub fn create() -> Self {
+        pub fn create() -> Component<Self> {
             let random: u32 = rand::random_u32();
             let random_bytes = rand::random_bytes(32);
             let random_long_bytes = rand::random_bytes(300);
-            Self {
+            Component::new(Self {
                 random,
                 random_bytes,
                 random_long_bytes,
-            }
+            })
+            .with_access_rules(AccessRules::allow_all())
+            .create()
         }
 
         pub fn get_random(&self) -> u32 {
diff --git a/dan_layer/engine/tests/templates/state/src/lib.rs b/dan_layer/engine/tests/templates/state/src/lib.rs
index a44277e6fa..46f3969a29 100644
--- a/dan_layer/engine/tests/templates/state/src/lib.rs
+++ b/dan_layer/engine/tests/templates/state/src/lib.rs
@@ -24,17 +24,21 @@ use tari_template_lib::prelude::*;
 
 #[template]
 mod state_template {
+    use super::*;
+
     pub struct State {
         value: u32,
     }
 
     impl State {
-        pub fn new() -> Self {
-            Self { value: 0 }
+        pub fn new() -> Component<Self> {
+            Component::new(Self { value: 0 })
+                .with_access_rules(AccessRules::allow_all())
+                .create()
         }
 
         pub fn set(&mut self, value: u32) {
-            debug(format!("Changing value from {} to {}", self.value, value));
+            debug!("Changing value from {} to {}", self.value, value);
             self.value = value;
         }
 
diff --git a/dan_layer/engine/tests/templates/tariswap/src/lib.rs b/dan_layer/engine/tests/templates/tariswap/src/lib.rs
index d75ff93046..76fe6bf33f 100644
--- a/dan_layer/engine/tests/templates/tariswap/src/lib.rs
+++ b/dan_layer/engine/tests/templates/tariswap/src/lib.rs
@@ -35,10 +35,9 @@ mod tariswap {
     }
 
     impl TariSwapPool {
-
         // Initialises a new pool component for for the pool A - B
         // the fees is represented as a per-mil quantity (e.g. "1" represents "0.1%")
-        pub fn new(a_addr: ResourceAddress, b_addr: ResourceAddress, fee: u16) -> Self {
+        pub fn new(a_addr: ResourceAddress, b_addr: ResourceAddress, fee: u16) -> Component<Self> {
             // check that the the resource pair is correct
             assert!(a_addr != b_addr, "The resources of the pair must be different");
             Self::check_resource_is_fungible(a_addr);
@@ -57,11 +56,14 @@ mod tariswap {
             // TODO: add lp resource minting/burning security, only this component should be allowed
             let lp_resource = ResourceBuilder::fungible("LP").build();
 
-            Self {
+            Component::new(Self {
                 pools,
                 lp_resource,
                 fee,
-            }
+            })
+            // TODO: proper access rules
+            .with_access_rules(AccessRules::allow_all())
+            .create()
         }
 
         // swap A tokens for B tokens or viceversa
@@ -75,8 +77,16 @@ mod tariswap {
             let output_pool_balance = self.get_pool_balance(output_resource);
 
             // check that the pools are not empty, to prevent division by 0 errors later
-            assert!(!input_pool_balance.is_zero(), "The pool for resource '{}' is empty", input_resource);
-            assert!(!output_pool_balance.is_zero(), "The pool for resource '{}' is empty", output_resource);
+            assert!(
+                !input_pool_balance.is_zero(),
+                "The pool for resource '{}' is empty",
+                input_resource
+            );
+            assert!(
+                !output_pool_balance.is_zero(),
+                "The pool for resource '{}' is empty",
+                output_resource
+            );
 
             // apply the fee to the input bucket
             // so the user will get a lesser amout of tokens than the theoritical (for the gain of the LP holders)
@@ -93,10 +103,13 @@ mod tariswap {
 
             // calculate the amount of output tokens to return to the user
             let output_bucket_amount = output_pool_balance - new_output_pool_balance;
-            
+
             // perform the swap
             self.pools.get_mut(&input_resource).unwrap().deposit(input_bucket);
-            self.pools.get_mut(&output_resource).unwrap().withdraw(output_bucket_amount)
+            self.pools
+                .get_mut(&output_resource)
+                .unwrap()
+                .withdraw(output_bucket_amount)
         }
 
         pub fn add_liquidity(&mut self, a_bucket: Bucket, b_bucket: Bucket) -> Bucket {
@@ -164,9 +177,11 @@ mod tariswap {
 
             balances
         }
-        
+
         pub fn get_pool_balance(&self, resource_address: ResourceAddress) -> Amount {
-            let vault = self.pools.get(&resource_address)
+            let vault = self
+                .pools
+                .get(&resource_address)
                 .unwrap_or_else(|| panic!("Resource {} is not in the pool", resource_address));
             vault.balance()
         }
@@ -180,7 +195,7 @@ mod tariswap {
                 amount / balance
             }
         }
-         
+
         pub fn lp_resource(&self) -> ResourceAddress {
             self.lp_resource
         }
@@ -195,14 +210,23 @@ mod tariswap {
 
         fn check_pool_resources(&self, a_resource: ResourceAddress, b_resource: ResourceAddress) {
             assert!(a_resource != b_resource, "The resource addresses are the same");
-            assert!(self.pools.contains_key(&a_resource), "The resource {} is not in the pool", a_resource);
-            assert!(self.pools.contains_key(&b_resource), "The resource {} is not in the pool", b_resource);
+            assert!(
+                self.pools.contains_key(&a_resource),
+                "The resource {} is not in the pool",
+                a_resource
+            );
+            assert!(
+                self.pools.contains_key(&b_resource),
+                "The resource {} is not in the pool",
+                b_resource
+            );
         }
 
         fn check_resource_is_fungible(resource: ResourceAddress) {
             assert!(
                 ResourceManager::get(resource).resource_type() == ResourceType::Fungible,
-                "Resource {} is not fungible", resource
+                "Resource {} is not fungible",
+                resource
             );
         }
     }
diff --git a/dan_layer/engine/tests/templates/tuples/src/lib.rs b/dan_layer/engine/tests/templates/tuples/src/lib.rs
index b21fe02c7e..e2e31073e4 100644
--- a/dan_layer/engine/tests/templates/tuples/src/lib.rs
+++ b/dan_layer/engine/tests/templates/tuples/src/lib.rs
@@ -24,13 +24,20 @@ use tari_template_lib::prelude::*;
 
 #[template]
 mod tuple_template {
+    use super::*;
+
     pub struct Tuple {
         pub value: u32,
     }
 
     impl Tuple {
-        pub fn new() -> (Self, String) {
-            (Self { value: 0 }, "Hello World!".to_string())
+        pub fn new() -> (Component<Self>, String) {
+            (
+                Component::new(Self { value: 0 })
+                    .with_access_rules(AccessRules::allow_all())
+                    .create(),
+                "Hello World!".to_string(),
+            )
         }
 
         pub fn tuple_output() -> (String, u32) {
diff --git a/dan_layer/engine/tests/test.rs b/dan_layer/engine/tests/test.rs
index da6c93ac8d..d3e45d6fa6 100644
--- a/dan_layer/engine/tests/test.rs
+++ b/dan_layer/engine/tests/test.rs
@@ -360,6 +360,7 @@ mod fungible {
 
         assert_eq!(total_supply, initial_supply);
 
+        let owner_proof = template_test.get_test_proof();
         let result = template_test
             .execute_and_commit(
                 vec![
@@ -374,7 +375,7 @@ mod fungible {
                         args: args![],
                     },
                 ],
-                vec![],
+                vec![owner_proof.clone()],
             )
             .unwrap();
 
@@ -397,7 +398,7 @@ mod fungible {
                         args: args![],
                     },
                 ],
-                vec![],
+                vec![owner_proof],
             )
             .unwrap();
 
@@ -443,7 +444,7 @@ mod basic_nft {
 
     #[test]
     fn create_resource_mint_and_deposit() {
-        let (mut template_test, (account_address, _), nft_component, nft_resx) = setup();
+        let (mut template_test, (account_address, account_owner), nft_component, nft_resx) = setup();
 
         let vars = vec![
             ("account", account_address.into()),
@@ -464,7 +465,7 @@ mod basic_nft {
             account.deposit(nft_bucket);
         "#,
                 vars.clone(),
-                vec![],
+                vec![account_owner],
             )
             .unwrap();
 
@@ -527,7 +528,7 @@ mod basic_nft {
 
     #[test]
     fn change_nft_mutable_data() {
-        let (mut template_test, (account_address, _), nft_component, _nft_resx) = setup();
+        let (mut template_test, (account_address, account_owner), nft_component, _nft_resx) = setup();
 
         let total_supply: Amount = template_test.call_method(nft_component, "total_supply", args![], vec![]);
         assert_eq!(total_supply, Amount(4));
@@ -544,7 +545,7 @@ mod basic_nft {
             account.deposit(nft_bucket);
         "#,
                 vars,
-                vec![],
+                vec![account_owner],
             )
             .unwrap();
 
@@ -628,7 +629,7 @@ mod basic_nft {
 
     #[test]
     fn mint_specific_id() {
-        let (mut template_test, (account_address, _), nft_component, nft_resx) = setup();
+        let (mut template_test, (account_address, account_owner), nft_component, nft_resx) = setup();
 
         let vars = vec![
             ("account", account_address.into()),
@@ -660,7 +661,7 @@ mod basic_nft {
             sparkle_nft.total_supply();
         "#,
                 vars.clone(),
-                vec![],
+                vec![account_owner],
             )
             .unwrap();
 
@@ -734,7 +735,7 @@ mod basic_nft {
             account.deposit(nft_bucket);
         "#,
                 vars.clone(),
-                vec![],
+                vec![account_owner.clone()],
             )
             .unwrap();
 
@@ -994,22 +995,19 @@ mod tickets {
         let mut template_test = TemplateTest::new(vec!["tests/templates/faucet", "tests/templates/nft/tickets"]);
 
         // create an account
-        let (account_address, owner_proof, _) = template_test.create_owned_account();
+        let (account_address, owner_proof, secret) = template_test.create_owned_account();
 
         // create a fungible token faucet, we are going to use those tokens as payments
         // TODO: use Thaums instead when they're implemented
         let faucet_template = template_test.get_template_address("TestFaucet");
         let initial_supply = Amount(1_000_000_000_000);
-        let result = template_test
-            .execute_and_commit(
-                vec![Instruction::CallFunction {
-                    template_address: faucet_template,
-                    function: "mint".to_string(),
-                    args: args![initial_supply],
-                }],
-                vec![],
-            )
-            .unwrap();
+        let result = template_test.execute_expect_success(
+            Transaction::builder()
+                .call_function(faucet_template, "mint", args![initial_supply])
+                .sign(&secret)
+                .build(),
+            vec![],
+        );
         let faucet_component: ComponentAddress = result.finalize.execution_results[0].decode().unwrap();
         let faucet_resource = result
             .finalize
@@ -1024,16 +1022,18 @@ mod tickets {
         let initial_supply: usize = 10;
         let price = Amount(20);
         let event_description = "My music festival".to_string();
-        let result = template_test
-            .execute_and_commit(
-                vec![Instruction::CallFunction {
-                    template_address: ticket_template,
-                    function: "new".to_string(),
-                    args: args![faucet_resource, initial_supply, price, event_description],
-                }],
-                vec![],
-            )
-            .unwrap();
+        let result = template_test.execute_expect_success(
+            Transaction::builder()
+                .call_function(ticket_template, "new", args![
+                    faucet_resource,
+                    initial_supply,
+                    price,
+                    event_description
+                ])
+                .sign(&secret)
+                .build(),
+            vec![owner_proof.clone()],
+        );
         let ticket_seller: ComponentAddress = result.finalize.execution_results[0].decode().unwrap();
         let ticket_resource = result
             .finalize
@@ -1048,42 +1048,28 @@ mod tickets {
         assert_eq!(total_supply, Amount(initial_supply as i64));
 
         // get some funds into the account
-        let vars = vec![
-            ("account", account_address.into()),
-            ("faucet", faucet_component.into()),
-            ("faucet_resource", faucet_resource.into()),
-            ("ticket_seller", ticket_seller.into()),
-        ];
-        template_test
-            .execute_and_commit_manifest(
-                r#"
-            let account = var!["account"];
-            let faucet = var!["faucet"];
-
-            let coins = faucet.take_free_coins();
-            account.deposit(coins);
-        "#,
-                vars.clone(),
-                vec![],
-            )
-            .unwrap();
+        template_test.execute_expect_success(
+            Transaction::builder()
+                .call_method(faucet_component, "take_free_coins", args![])
+                .put_last_instruction_output_on_workspace("coins")
+                .call_method(account_address, "deposit", args![Workspace("coins")])
+                .sign(&secret)
+                .build(),
+            vec![],
+        );
 
         // buy a ticket
-        template_test
-            .execute_and_commit_manifest(
-                r#"
-            let account = var!["account"];
-            let faucet_resource = var!["faucet_resource"];
-            let ticket_seller = var!["ticket_seller"];
-
-            let payment = account.withdraw(faucet_resource, Amount(20));
-            let nft_bucket = ticket_seller.buy_ticket(payment);
-            account.deposit(nft_bucket);
-        "#,
-                vars.clone(),
-                vec![owner_proof],
-            )
-            .unwrap();
+        template_test.execute_expect_success(
+            Transaction::builder()
+                .call_method(account_address, "withdraw", args![faucet_resource, Amount(20)])
+                .put_last_instruction_output_on_workspace("payment")
+                .call_method(ticket_seller, "buy_ticket", args![Workspace("payment")])
+                .put_last_instruction_output_on_workspace("nft_bucket")
+                .call_method(account_address, "deposit", args![Workspace("nft_bucket")])
+                .sign(&secret)
+                .build(),
+            vec![owner_proof],
+        );
 
         // redeem a ticket
         let ticket_ids: Vec<NonFungibleId> =
@@ -1160,7 +1146,7 @@ mod nft_indexes {
 
     #[test]
     fn new_nft_index() {
-        let (mut template_test, (account_address, _), nft_component, nft_resx) = setup();
+        let (mut template_test, (account_address, owner_proof), nft_component, nft_resx) = setup();
 
         let vars = vec![
             ("account", account_address.into()),
@@ -1168,7 +1154,8 @@ mod nft_indexes {
             ("nft_resx", nft_resx.clone().into()),
         ];
 
-        let total_supply: Amount = template_test.call_method(nft_component, "total_supply", args![], vec![]);
+        let total_supply: Amount =
+            template_test.call_method(nft_component, "total_supply", args![], vec![owner_proof.clone()]);
         assert_eq!(total_supply, Amount(0));
 
         let result = template_test
@@ -1181,7 +1168,7 @@ mod nft_indexes {
             account.deposit(nft_bucket);
         "#,
                 vars.clone(),
-                vec![],
+                vec![owner_proof.clone()],
             )
             .unwrap();
 
@@ -1238,7 +1225,7 @@ mod nft_indexes {
         assert_eq!(nft_addr.to_address_string(), referenced_address.to_string());
 
         // The total supply of the resource is increased
-        let total_supply: Amount = template_test.call_method(nft_component, "total_supply", args![], vec![]);
+        let total_supply: Amount = template_test.call_method(nft_component, "total_supply", args![], vec![owner_proof]);
         assert_eq!(total_supply, Amount(1));
     }
 }
diff --git a/dan_layer/engine_types/src/bucket.rs b/dan_layer/engine_types/src/bucket.rs
index cc47941cb2..8cf79d069b 100644
--- a/dan_layer/engine_types/src/bucket.rs
+++ b/dan_layer/engine_types/src/bucket.rs
@@ -24,54 +24,89 @@ use std::collections::BTreeSet;
 
 use serde::{Deserialize, Serialize};
 use tari_template_lib::{
-    models::{Amount, ConfidentialWithdrawProof, NonFungibleId, ResourceAddress},
+    models::{Amount, BucketId, ConfidentialWithdrawProof, NonFungibleId, ResourceAddress},
     prelude::ResourceType,
 };
 
-use crate::resource_container::{ResourceContainer, ResourceError};
+use crate::{
+    proof::{ContainerRef, LockedResource, Proof},
+    resource_container::{ResourceContainer, ResourceError},
+};
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct Bucket {
-    resource: ResourceContainer,
+    bucket_id: BucketId,
+    resource_container: ResourceContainer,
 }
 
 impl Bucket {
-    pub fn new(resource: ResourceContainer) -> Self {
-        Self { resource }
+    pub fn new(bucket_id: BucketId, resource: ResourceContainer) -> Self {
+        Self {
+            bucket_id,
+            resource_container: resource,
+        }
     }
 
     pub fn amount(&self) -> Amount {
-        self.resource.amount()
+        self.resource_container.amount()
     }
 
     pub fn resource_address(&self) -> &ResourceAddress {
-        self.resource.resource_address()
+        self.resource_container.resource_address()
     }
 
     pub fn resource_type(&self) -> ResourceType {
-        self.resource.resource_type()
+        self.resource_container.resource_type()
     }
 
     pub(crate) fn into_resource(self) -> ResourceContainer {
-        self.resource
+        self.resource_container
     }
 
     pub fn into_non_fungible_ids(self) -> Option<BTreeSet<NonFungibleId>> {
-        self.resource.into_non_fungible_ids()
+        self.resource_container.into_non_fungible_ids()
     }
 
     pub fn take(&mut self, amount: Amount) -> Result<ResourceContainer, ResourceError> {
-        self.resource.withdraw(amount)
+        self.resource_container.withdraw(amount)
     }
 
     pub fn take_confidential(&mut self, proof: ConfidentialWithdrawProof) -> Result<ResourceContainer, ResourceError> {
-        self.resource.withdraw_confidential(proof)
+        self.resource_container.withdraw_confidential(proof)
     }
 
     pub fn reveal_confidential(
         &mut self,
         proof: ConfidentialWithdrawProof,
     ) -> Result<ResourceContainer, ResourceError> {
-        self.resource.reveal_confidential(proof)
+        self.resource_container.reveal_confidential(proof)
+    }
+
+    pub fn lock_all(&mut self) -> Result<LockedResource, ResourceError> {
+        let locked_resource = self.resource_container.lock_all()?;
+        Ok(LockedResource::new(
+            ContainerRef::Bucket(self.bucket_id),
+            locked_resource,
+        ))
+    }
+
+    pub fn lock_by_non_fungible_ids(&mut self, ids: BTreeSet<NonFungibleId>) -> Result<LockedResource, ResourceError> {
+        let locked_resource = self.resource_container.lock_by_non_fungible_ids(ids)?;
+        Ok(LockedResource::new(
+            ContainerRef::Bucket(self.bucket_id),
+            locked_resource,
+        ))
+    }
+
+    pub fn lock_by_amount(&mut self, amount: Amount) -> Result<LockedResource, ResourceError> {
+        let locked_resource = self.resource_container.lock_by_amount(amount)?;
+        Ok(LockedResource::new(
+            ContainerRef::Bucket(self.bucket_id),
+            locked_resource,
+        ))
+    }
+
+    pub fn unlock(&mut self, proof: Proof) -> Result<(), ResourceError> {
+        self.resource_container.unlock(proof.into_resource_container())
     }
 }
diff --git a/dan_layer/engine_types/src/commit_result.rs b/dan_layer/engine_types/src/commit_result.rs
index 17dc400e26..2212b46c91 100644
--- a/dan_layer/engine_types/src/commit_result.rs
+++ b/dan_layer/engine_types/src/commit_result.rs
@@ -66,7 +66,7 @@ impl ExecuteResult {
         if let Some(ref reason) = self.transaction_failure {
             reason
         } else {
-            panic!("Transaction succeeded");
+            panic!("Transaction succeeded but it was expected to fail");
         }
     }
 
@@ -113,7 +113,7 @@ impl FinalizeResult {
         }
     }
 
-    pub fn new_rejectted(transaction_hash: Hash, reason: RejectReason) -> Self {
+    pub fn new_rejected(transaction_hash: Hash, reason: RejectReason) -> Self {
         Self {
             transaction_hash,
             logs: vec![],
diff --git a/dan_layer/engine_types/src/component.rs b/dan_layer/engine_types/src/component.rs
index 5e95526102..a4d1c94888 100644
--- a/dan_layer/engine_types/src/component.rs
+++ b/dan_layer/engine_types/src/component.rs
@@ -21,7 +21,13 @@
 //   USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 use serde::{Deserialize, Serialize};
-use tari_template_lib::{auth::AccessRules, models::TemplateAddress, prelude::ComponentAddress, Hash};
+use tari_template_lib::{
+    auth::{ComponentAccessRules, OwnerRule, Ownership},
+    crypto::RistrettoPublicKeyBytes,
+    models::TemplateAddress,
+    prelude::ComponentAddress,
+    Hash,
+};
 
 use crate::{
     hashing::{hasher, EngineHashDomainLabel},
@@ -41,8 +47,9 @@ pub struct ComponentHeader {
     #[serde(with = "serde_with::hex")]
     pub template_address: TemplateAddress,
     pub module_name: String,
-    // TODO: Access rules should be a separate substate?
-    pub access_rules: AccessRules,
+    pub owner_key: RistrettoPublicKeyBytes,
+    pub owner_rule: OwnerRule,
+    pub access_rules: ComponentAccessRules,
     // TODO: Split the state from the header
     pub state: ComponentBody,
 }
@@ -55,6 +62,17 @@ impl ComponentHeader {
     pub fn state(&self) -> &[u8] {
         &self.state.state
     }
+
+    pub fn as_ownership(&self) -> Ownership<'_> {
+        Ownership {
+            owner_key: &self.owner_key,
+            owner_rule: &self.owner_rule,
+        }
+    }
+
+    pub fn access_rules(&self) -> &ComponentAccessRules {
+        &self.access_rules
+    }
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
diff --git a/dan_layer/engine_types/src/fees.rs b/dan_layer/engine_types/src/fees.rs
index 31cb3f64b9..facf92c28f 100644
--- a/dan_layer/engine_types/src/fees.rs
+++ b/dan_layer/engine_types/src/fees.rs
@@ -12,8 +12,8 @@ use crate::resource_container::ResourceContainer;
 pub struct FeeReceipt {
     /// The total amount of the fee payment(s)
     pub total_fee_payment: Amount,
-    /// The resource containing the fees deducted excluding refunds
-    pub fee_resource: ResourceContainer,
+    /// Total fees paid after refunds
+    pub total_fees_paid: Amount,
     /// Breakdown of fee costs
     pub cost_breakdown: Vec<(FeeSource, u64)>,
 }
@@ -26,6 +26,7 @@ impl FeeReceipt {
         }
     }
 
+    /// The total amount of fees charged. This may be more than total_fees_paid if the user paid an insufficient amount.
     pub fn total_fees_charged(&self) -> Amount {
         Amount::try_from(self.cost_breakdown.iter().map(|(_, c)| *c).sum::<u64>()).unwrap()
     }
@@ -36,14 +37,14 @@ impl FeeReceipt {
             .unwrap_or_default()
     }
 
-    /// The total amount of fees allocated to the transaction
+    /// The total amount of fees allocated to the transaction, before refunds
     pub fn total_allocated_fee_payments(&self) -> Amount {
         self.total_fee_payment
     }
 
     /// The total amount of fees paid after refunds
     pub fn total_fees_paid(&self) -> Amount {
-        self.fee_resource.amount()
+        self.total_fees_paid
     }
 
     /// The amount of unpaid fees
@@ -72,7 +73,7 @@ pub struct FeeCostBreakdown {
     pub breakdown: Vec<(FeeSource, u64)>,
 }
 
-#[derive(Debug, Clone)]
+#[derive(Debug)]
 pub struct FeePayment {
     pub resource: ResourceContainer,
     pub breakdown: HashMap<VaultId, Amount>,
diff --git a/dan_layer/engine_types/src/indexed_value.rs b/dan_layer/engine_types/src/indexed_value.rs
index 4c68dac4db..e0c9883ee4 100644
--- a/dan_layer/engine_types/src/indexed_value.rs
+++ b/dan_layer/engine_types/src/indexed_value.rs
@@ -6,7 +6,7 @@ use std::collections::BTreeMap;
 use serde::{Deserialize, Serialize};
 use tari_bor::{decode, BorError, FromTagAndValue, ValueVisitor};
 use tari_template_lib::{
-    models::{BinaryTag, BucketId, NonFungibleAddressContents, ResourceAddress, VaultId},
+    models::{BinaryTag, BucketId, NonFungibleAddressContents, ProofId, ResourceAddress, VaultId},
     prelude::{ComponentAddress, Metadata, NonFungibleAddress},
     Hash,
 };
@@ -18,9 +18,10 @@ use crate::{
     transaction_receipt::TransactionReceiptAddress,
 };
 
-#[derive(Debug, Clone, Default, Serialize, Deserialize, PartialEq)]
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
 pub struct IndexedValue {
-    buckets: Vec<BucketId>,
+    bucket_ids: Vec<BucketId>,
+    proof_ids: Vec<ProofId>,
     #[serde(with = "serde_with::hex::vec")]
     component_addresses: Vec<ComponentAddress>,
     #[serde(with = "serde_with::hex::vec")]
@@ -31,22 +32,37 @@ pub struct IndexedValue {
     #[serde(with = "serde_with::hex::vec")]
     vault_ids: Vec<VaultId>,
     metadata: Vec<Metadata>,
+    value: tari_bor::Value,
 }
 
 impl IndexedValue {
-    pub fn from_raw(bytes: &[u8]) -> Result<Self, IndexedValueVisitorError> {
-        let mut visitor = IndexedValueVisitor::new();
+    pub fn from_type<T: Serialize + ?Sized>(v: &T) -> Result<Self, IndexedValueError> {
+        let value = tari_bor::to_value(v)?;
+        Self::from_value(value)
+    }
+
+    pub fn from_raw(bytes: &[u8]) -> Result<Self, IndexedValueError> {
+        if bytes.is_empty() {
+            return Ok(Self::default());
+        }
         let value: tari_bor::Value = decode(bytes)?;
+        Self::from_value(value)
+    }
+
+    pub fn from_value(value: tari_bor::Value) -> Result<Self, IndexedValueError> {
+        let mut visitor = IndexedValueVisitor::new();
         tari_bor::walk_all(&value, &mut visitor)?;
 
         Ok(Self {
-            buckets: visitor.buckets,
+            bucket_ids: visitor.buckets,
+            proof_ids: visitor.proofs,
             resource_addresses: visitor.resource_addresses,
             component_addresses: visitor.component_addresses,
             transaction_receipt_addresses: visitor.transaction_receipt_addresses,
             non_fungible_addresses: visitor.non_fungible_addresses,
             vault_ids: visitor.vault_ids,
             metadata: visitor.metadata,
+            value,
         })
     }
 
@@ -73,8 +89,12 @@ impl IndexedValue {
             .chain(self.vault_ids.iter().map(|a| (*a).into()))
     }
 
-    pub fn buckets(&self) -> &[BucketId] {
-        &self.buckets
+    pub fn bucket_ids(&self) -> &[BucketId] {
+        &self.bucket_ids
+    }
+
+    pub fn proof_ids(&self) -> &[ProofId] {
+        &self.proof_ids
     }
 
     pub fn component_addresses(&self) -> &[ComponentAddress] {
@@ -96,6 +116,26 @@ impl IndexedValue {
     pub fn metadata(&self) -> &[Metadata] {
         &self.metadata
     }
+
+    pub fn value(&self) -> &tari_bor::Value {
+        &self.value
+    }
+}
+
+impl Default for IndexedValue {
+    fn default() -> Self {
+        Self {
+            bucket_ids: vec![],
+            proof_ids: vec![],
+            component_addresses: vec![],
+            resource_addresses: vec![],
+            transaction_receipt_addresses: vec![],
+            non_fungible_addresses: vec![],
+            vault_ids: vec![],
+            metadata: vec![],
+            value: tari_bor::Value::Null,
+        }
+    }
 }
 
 pub enum TariValue {
@@ -107,14 +147,15 @@ pub enum TariValue {
     Metadata(Metadata),
     VaultId(VaultId),
     FeeClaim(FeeClaimAddress),
+    ProofId(ProofId),
 }
 
 impl FromTagAndValue for TariValue {
-    type Error = IndexedValueVisitorError;
+    type Error = IndexedValueError;
 
     fn try_from_tag_and_value(tag: u64, value: &tari_bor::Value) -> Result<Self, Self::Error>
     where Self: Sized {
-        let tag = BinaryTag::from_u64(tag).ok_or(IndexedValueVisitorError::InvalidTag(tag))?;
+        let tag = BinaryTag::from_u64(tag).ok_or(IndexedValueError::InvalidTag(tag))?;
         match tag {
             BinaryTag::ComponentAddress => {
                 let component_address: Hash = value.deserialized().map_err(BorError::from)?;
@@ -148,6 +189,10 @@ impl FromTagAndValue for TariValue {
                 let value: Hash = value.deserialized().map_err(BorError::from)?;
                 Ok(Self::FeeClaim(value.into()))
             },
+            BinaryTag::ProofId => {
+                let value: u32 = value.deserialized().map_err(BorError::from)?;
+                Ok(Self::ProofId(value.into()))
+            },
         }
     }
 }
@@ -155,6 +200,7 @@ impl FromTagAndValue for TariValue {
 #[derive(Debug, Clone, Default)]
 pub struct IndexedValueVisitor {
     buckets: Vec<BucketId>,
+    proofs: Vec<ProofId>,
     component_addresses: Vec<ComponentAddress>,
     resource_addresses: Vec<ResourceAddress>,
     transaction_receipt_addresses: Vec<TransactionReceiptAddress>,
@@ -167,6 +213,7 @@ impl IndexedValueVisitor {
     pub fn new() -> Self {
         Self {
             buckets: vec![],
+            proofs: vec![],
             component_addresses: vec![],
             resource_addresses: vec![],
             transaction_receipt_addresses: vec![],
@@ -178,7 +225,7 @@ impl IndexedValueVisitor {
 }
 
 impl ValueVisitor<TariValue> for IndexedValueVisitor {
-    type Error = IndexedValueVisitorError;
+    type Error = IndexedValueError;
 
     fn visit(&mut self, value: TariValue) -> Result<(), Self::Error> {
         match value {
@@ -206,13 +253,16 @@ impl ValueVisitor<TariValue> for IndexedValueVisitor {
             TariValue::FeeClaim(_) => {
                 // Do nothing
             },
+            TariValue::ProofId(proof_id) => {
+                self.proofs.push(proof_id);
+            },
         }
         Ok(())
     }
 }
 
 #[derive(Debug, thiserror::Error)]
-pub enum IndexedValueVisitorError {
+pub enum IndexedValueError {
     #[error("Bor error: {0}")]
     BorError(#[from] tari_bor::BorError),
     #[error("Invalid tag: {0}")]
@@ -253,6 +303,12 @@ mod tests {
         metadata: Metadata,
     }
 
+    #[test]
+    fn it_returns_empty_indexed_value_for_empty_bytes() {
+        let value = IndexedValue::from_raw(&[]).unwrap();
+        assert_eq!(value, IndexedValue::default());
+    }
+
     #[test]
     fn it_extracts_known_types_from_binary_data() {
         let addrs: [ComponentAddress; 3] = [new_hash().into(), new_hash().into(), new_hash().into()];
@@ -296,8 +352,8 @@ mod tests {
         assert_eq!(indexed.vault_ids.len(), 1);
         assert_eq!(indexed.metadata.len(), 1);
 
-        assert!(indexed.buckets.contains(&1.into()));
-        assert!(indexed.buckets.contains(&2.into()));
-        assert_eq!(indexed.buckets.len(), 6);
+        assert!(indexed.bucket_ids.contains(&1.into()));
+        assert!(indexed.bucket_ids.contains(&2.into()));
+        assert_eq!(indexed.bucket_ids.len(), 6);
     }
 }
diff --git a/dan_layer/engine_types/src/instruction.rs b/dan_layer/engine_types/src/instruction.rs
index d0d39d2c45..9cfeaef812 100644
--- a/dan_layer/engine_types/src/instruction.rs
+++ b/dan_layer/engine_types/src/instruction.rs
@@ -46,6 +46,7 @@ pub enum Instruction {
         epoch: u64,
         validator_public_key: PublicKey,
     },
+    DropAllProofsInWorkspace,
     #[cfg(feature = "debugging")]
     CreateFreeTestCoins {
         revealed_amount: Amount,
@@ -103,6 +104,9 @@ impl Display for Instruction {
             Self::CreateFreeTestCoins { .. } => {
                 write!(f, "CreateFreeTestCoins")
             },
+            Self::DropAllProofsInWorkspace => {
+                write!(f, "DropAllProofsInWorkspace")
+            },
         }
     }
 }
diff --git a/dan_layer/engine_types/src/lib.rs b/dan_layer/engine_types/src/lib.rs
index 4a0213491f..7f11683fb9 100644
--- a/dan_layer/engine_types/src/lib.rs
+++ b/dan_layer/engine_types/src/lib.rs
@@ -1,7 +1,6 @@
 //  Copyright 2022 The Tari Project
 //  SPDX-License-Identifier: BSD-3-Clause
 
-mod argument_parser;
 pub mod base_layer_hashing;
 pub mod bucket;
 pub mod commit_result;
@@ -17,6 +16,7 @@ pub mod instruction_result;
 pub mod logs;
 pub mod non_fungible;
 pub mod non_fungible_index;
+pub mod proof;
 pub mod resource;
 pub mod resource_container;
 pub mod serde_with;
@@ -26,5 +26,7 @@ pub mod vault;
 pub mod virtual_substate;
 
 mod template;
-pub use argument_parser::parse_arg;
 pub use template::{calculate_template_binary_hash, parse_template_address, TemplateAddress};
+
+mod argument_parser;
+pub use argument_parser::parse_arg;
diff --git a/dan_layer/engine_types/src/proof.rs b/dan_layer/engine_types/src/proof.rs
new file mode 100644
index 0000000000..e4f5522a19
--- /dev/null
+++ b/dan_layer/engine_types/src/proof.rs
@@ -0,0 +1,107 @@
+//   Copyright 2022. The Tari Project
+//
+//   Redistribution and use in source and binary forms, with or without modification, are permitted provided that the
+//   following conditions are met:
+//
+//   1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following
+//   disclaimer.
+//
+//   2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the
+//   following disclaimer in the documentation and/or other materials provided with the distribution.
+//
+//   3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote
+//   products derived from this software without specific prior written permission.
+//
+//   THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES,
+//   INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+//   DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+//   SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+//   SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+//   WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
+//   USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+use std::collections::BTreeSet;
+
+use tari_template_lib::{
+    models::{Amount, BucketId, NonFungibleId, ResourceAddress, VaultId},
+    prelude::ResourceType,
+};
+
+use crate::resource_container::ResourceContainer;
+
+#[derive(Debug, Clone)]
+pub struct Proof {
+    locked: LockedResource,
+}
+
+impl Proof {
+    pub fn new(locked: LockedResource) -> Self {
+        Self { locked }
+    }
+
+    pub fn amount(&self) -> Amount {
+        self.locked.amount()
+    }
+
+    pub fn resource_address(&self) -> &ResourceAddress {
+        self.locked.resource_address()
+    }
+
+    pub fn non_fungible_token_ids(&self) -> &BTreeSet<NonFungibleId> {
+        self.locked.non_fungible_token_ids()
+    }
+
+    pub fn resource_type(&self) -> ResourceType {
+        self.locked.resource_type()
+    }
+
+    pub fn container(&self) -> &ContainerRef {
+        &self.locked.container
+    }
+
+    pub fn into_resource_container(self) -> ResourceContainer {
+        self.locked.into_resource_container()
+    }
+}
+
+#[derive(Debug, Clone, Copy)]
+pub enum ContainerRef {
+    Bucket(BucketId),
+    Vault(VaultId),
+}
+
+#[derive(Debug, Clone)]
+pub struct LockedResource {
+    container: ContainerRef,
+    locked: ResourceContainer,
+}
+
+impl LockedResource {
+    pub fn new(container: ContainerRef, locked: ResourceContainer) -> Self {
+        Self { container, locked }
+    }
+
+    pub fn amount(&self) -> Amount {
+        self.locked.amount()
+    }
+
+    pub fn resource_address(&self) -> &ResourceAddress {
+        self.locked.resource_address()
+    }
+
+    pub fn non_fungible_token_ids(&self) -> &BTreeSet<NonFungibleId> {
+        self.locked.non_fungible_token_ids()
+    }
+
+    pub fn resource_type(&self) -> ResourceType {
+        self.locked.resource_type()
+    }
+
+    pub fn container(&self) -> &ContainerRef {
+        &self.container
+    }
+
+    pub fn into_resource_container(self) -> ResourceContainer {
+        self.locked
+    }
+}
diff --git a/dan_layer/engine_types/src/resource.rs b/dan_layer/engine_types/src/resource.rs
index 0c9e0cfb4c..104795fa57 100644
--- a/dan_layer/engine_types/src/resource.rs
+++ b/dan_layer/engine_types/src/resource.rs
@@ -22,22 +22,37 @@
 
 use serde::{Deserialize, Serialize};
 use tari_template_lib::{
+    auth::{OwnerRule, Ownership, ResourceAccessRules},
+    crypto::RistrettoPublicKeyBytes,
     models::{Amount, Metadata},
     resource::ResourceType,
 };
 
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+#[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct Resource {
     resource_type: ResourceType,
+    owner_rule: OwnerRule,
+    owner_key: RistrettoPublicKeyBytes,
+    access_rules: ResourceAccessRules,
     token_symbol: String,
     metadata: Metadata,
     total_supply: Amount,
 }
 
 impl Resource {
-    pub fn new(resource_type: ResourceType, token_symbol: String, metadata: Metadata) -> Self {
+    pub fn new(
+        resource_type: ResourceType,
+        owner_key: RistrettoPublicKeyBytes,
+        owner_rule: OwnerRule,
+        access_rules: ResourceAccessRules,
+        token_symbol: String,
+        metadata: Metadata,
+    ) -> Self {
         Self {
             resource_type,
+            owner_rule,
+            owner_key,
+            access_rules,
             metadata,
             token_symbol,
             total_supply: 0.into(),
@@ -48,6 +63,29 @@ impl Resource {
         self.resource_type
     }
 
+    pub fn owner_rule(&self) -> &OwnerRule {
+        &self.owner_rule
+    }
+
+    pub fn owner_key(&self) -> &RistrettoPublicKeyBytes {
+        &self.owner_key
+    }
+
+    pub fn as_ownership(&self) -> Ownership<'_> {
+        Ownership {
+            owner_key: &self.owner_key,
+            owner_rule: &self.owner_rule,
+        }
+    }
+
+    pub fn access_rules(&self) -> &ResourceAccessRules {
+        &self.access_rules
+    }
+
+    pub fn set_access_rules(&mut self, access_rules: ResourceAccessRules) {
+        self.access_rules = access_rules;
+    }
+
     pub fn increase_total_supply(&mut self, amount: Amount) {
         assert!(
             amount.is_positive(),
diff --git a/dan_layer/engine_types/src/resource_container.rs b/dan_layer/engine_types/src/resource_container.rs
index 0530eac8b4..ad56d21b57 100644
--- a/dan_layer/engine_types/src/resource_container.rs
+++ b/dan_layer/engine_types/src/resource_container.rs
@@ -5,7 +5,7 @@
 // there is no way to actually mutate the compressed value once it is lazily initialized.
 #![allow(clippy::mutable_key_type)]
 
-use std::{collections::BTreeMap, iter};
+use std::{collections::BTreeMap, iter, mem};
 
 use serde::{Deserialize, Serialize};
 use tari_common_types::types::PublicKey;
@@ -28,38 +28,52 @@ pub enum ResourceContainer {
         #[serde(with = "serde_with::string")]
         address: ResourceAddress,
         amount: Amount,
+        locked_amount: Amount,
     },
     NonFungible {
         #[serde(with = "serde_with::string")]
         address: ResourceAddress,
         token_ids: BTreeSet<NonFungibleId>,
+        locked_token_ids: BTreeSet<NonFungibleId>,
     },
     Confidential {
         #[serde(with = "serde_with::string")]
         address: ResourceAddress,
         commitments: BTreeMap<PublicKey, ConfidentialOutput>,
         revealed_amount: Amount,
+        locked_commitments: BTreeMap<PublicKey, ConfidentialOutput>,
+        locked_revealed_amount: Amount,
     },
 }
 
 impl ResourceContainer {
     pub fn fungible(address: ResourceAddress, amount: Amount) -> ResourceContainer {
-        ResourceContainer::Fungible { address, amount }
+        ResourceContainer::Fungible {
+            address,
+            amount,
+            locked_amount: Amount::zero(),
+        }
     }
 
     pub fn non_fungible(address: ResourceAddress, token_ids: BTreeSet<NonFungibleId>) -> ResourceContainer {
-        ResourceContainer::NonFungible { address, token_ids }
+        ResourceContainer::NonFungible {
+            address,
+            token_ids,
+            locked_token_ids: BTreeSet::new(),
+        }
     }
 
-    pub fn confidential(
+    pub fn confidential<I: IntoIterator<Item = (PublicKey, ConfidentialOutput)>>(
         address: ResourceAddress,
-        commitment: Option<(PublicKey, ConfidentialOutput)>,
+        commitment: I,
         revealed_amount: Amount,
     ) -> ResourceContainer {
         ResourceContainer::Confidential {
             address,
             commitments: commitment.into_iter().collect(),
             revealed_amount,
+            locked_commitments: BTreeMap::new(),
+            locked_revealed_amount: Amount::zero(),
         }
     }
 
@@ -83,6 +97,8 @@ impl ResourceContainer {
             ))
             .collect(),
             revealed_amount: Amount::zero(),
+            locked_commitments: BTreeMap::new(),
+            locked_revealed_amount: Amount::zero(),
         })
     }
 
@@ -94,6 +110,16 @@ impl ResourceContainer {
         }
     }
 
+    pub fn locked_amount(&self) -> Amount {
+        match self {
+            ResourceContainer::Fungible { locked_amount, .. } => *locked_amount,
+            ResourceContainer::NonFungible { locked_token_ids, .. } => locked_token_ids.len().into(),
+            ResourceContainer::Confidential {
+                locked_revealed_amount, ..
+            } => *locked_revealed_amount,
+        }
+    }
+
     pub fn get_commitment_count(&self) -> u32 {
         match self {
             ResourceContainer::Fungible { .. } => 0,
@@ -118,10 +144,11 @@ impl ResourceContainer {
         }
     }
 
-    pub fn non_fungible_token_ids(&self) -> Option<&BTreeSet<NonFungibleId>> {
+    pub fn non_fungible_token_ids(&self) -> &BTreeSet<NonFungibleId> {
+        static EMPTY_BTREE_SET: BTreeSet<NonFungibleId> = BTreeSet::new();
         match self {
-            ResourceContainer::NonFungible { token_ids, .. } => Some(token_ids),
-            _ => None,
+            ResourceContainer::NonFungible { token_ids, .. } => token_ids,
+            _ => &EMPTY_BTREE_SET,
         }
     }
 
@@ -337,11 +364,275 @@ impl ResourceContainer {
         self.withdraw_confidential(proof)
     }
 
-    /// Returns all confidential outputs. If the resource is not confidential, None is returned.
-    pub fn get_confidential_outputs(&self) -> Option<Vec<&ConfidentialOutput>> {
+    /// Returns all confidential commitments. If the resource is not confidential, None is returned.
+    pub fn get_confidential_commitments(&self) -> Option<&BTreeMap<PublicKey, ConfidentialOutput>> {
         match self {
             ResourceContainer::Fungible { .. } | ResourceContainer::NonFungible { .. } => None,
-            ResourceContainer::Confidential { commitments, .. } => Some(commitments.values().collect()),
+            ResourceContainer::Confidential { commitments, .. } => Some(commitments),
+        }
+    }
+
+    pub fn into_confidential_commitments(self) -> Option<BTreeMap<PublicKey, ConfidentialOutput>> {
+        match self {
+            ResourceContainer::Fungible { .. } | ResourceContainer::NonFungible { .. } => None,
+            ResourceContainer::Confidential { commitments, .. } => Some(commitments),
+        }
+    }
+
+    pub fn lock_all(&mut self) -> Result<ResourceContainer, ResourceError> {
+        let resource_address = *self.resource_address();
+        match self {
+            ResourceContainer::Fungible {
+                amount, locked_amount, ..
+            } => {
+                if *amount == 0 {
+                    return Err(ResourceError::InsufficientBalance {
+                        details: "lock_all: resource container contained no funds".to_string(),
+                    });
+                }
+                let newly_locked_amount = mem::take(amount);
+                *locked_amount += newly_locked_amount;
+                Ok(ResourceContainer::fungible(resource_address, newly_locked_amount))
+            },
+            ResourceContainer::NonFungible {
+                token_ids,
+                locked_token_ids,
+                ..
+            } => {
+                if token_ids.is_empty() {
+                    return Err(ResourceError::InsufficientBalance {
+                        details: "lock_all: resource container contained no tokens".to_string(),
+                    });
+                }
+                let newly_locked_token_ids = mem::take(token_ids);
+                locked_token_ids.extend(newly_locked_token_ids.iter().cloned());
+
+                Ok(ResourceContainer::non_fungible(
+                    resource_address,
+                    newly_locked_token_ids,
+                ))
+            },
+            ResourceContainer::Confidential {
+                commitments,
+                revealed_amount,
+                locked_commitments,
+                locked_revealed_amount,
+                ..
+            } => {
+                if commitments.is_empty() {
+                    return Err(ResourceError::InsufficientBalance {
+                        details: "lock_all: resource container contained no commitments".to_string(),
+                    });
+                }
+                let newly_locked_commitments = mem::take(commitments);
+                let newly_locked_revealed_amount = *revealed_amount;
+                locked_commitments.extend(newly_locked_commitments.iter().map(|(c, o)| (c.clone(), o.clone())));
+                *locked_revealed_amount += newly_locked_revealed_amount;
+
+                Ok(ResourceContainer::confidential(
+                    resource_address,
+                    newly_locked_commitments,
+                    newly_locked_revealed_amount,
+                ))
+            },
+        }
+    }
+
+    pub fn unlock(&mut self, container: ResourceContainer) -> Result<(), ResourceError> {
+        if self.resource_type() != container.resource_type() {
+            return Err(ResourceError::ResourceTypeMismatch);
+        }
+        if self.resource_address() != container.resource_address() {
+            return Err(ResourceError::ResourceAddressMismatch {
+                expected: *self.resource_address(),
+                actual: *container.resource_address(),
+            });
+        }
+
+        match self {
+            ResourceContainer::Fungible {
+                amount, locked_amount, ..
+            } => {
+                if *locked_amount < container.amount() {
+                    return Err(ResourceError::InsufficientBalance {
+                        details: format!(
+                            "unlock: resource container did not contain enough locked funds. Required: {}, Available: \
+                             {}",
+                            container.amount(),
+                            locked_amount
+                        ),
+                    });
+                }
+                *amount += container.amount();
+                *locked_amount -= container.amount();
+            },
+            ResourceContainer::NonFungible {
+                token_ids,
+                locked_token_ids,
+                ..
+            } => {
+                if locked_token_ids.len() < container.non_fungible_token_ids().len() {
+                    return Err(ResourceError::InsufficientBalance {
+                        details: format!(
+                            "unlock: resource container did not contain enough locked tokens. Required: {}, \
+                             Available: {}",
+                            container.non_fungible_token_ids().len(),
+                            locked_token_ids.len()
+                        ),
+                    });
+                }
+                for token in container.non_fungible_token_ids() {
+                    let token = locked_token_ids.take(token).ok_or_else(|| {
+                        ResourceError::InvariantError(format!(
+                            "unlock: tried to unlock token {token} that was not locked",
+                        ))
+                    })?;
+                    token_ids.insert(token);
+                }
+            },
+            ResourceContainer::Confidential {
+                commitments,
+                locked_commitments,
+                revealed_amount,
+                locked_revealed_amount,
+                ..
+            } => {
+                if locked_commitments.len() < container.get_commitment_count() as usize {
+                    return Err(ResourceError::InsufficientBalance {
+                        details: format!(
+                            "unlock: resource container did not contain enough locked commitments. Required: {}, \
+                             Available: {}",
+                            container.get_commitment_count(),
+                            locked_commitments.len()
+                        ),
+                    });
+                }
+
+                if *locked_revealed_amount < container.amount() {
+                    return Err(ResourceError::InvariantError(format!(
+                        "unlock: resource container did not contain enough locked revealed amount. Required: {}, \
+                         Available: {}",
+                        container.amount(),
+                        locked_revealed_amount
+                    )));
+                }
+
+                for (commitment, _) in container.get_confidential_commitments().into_iter().flatten() {
+                    let (commitment, output) = locked_commitments.remove_entry(commitment).ok_or_else(|| {
+                        ResourceError::InvariantError(
+                            "unlock: tried to unlock commitment that was not locked".to_string(),
+                        )
+                    })?;
+                    if commitments.insert(commitment, output).is_some() {
+                        return Err(ResourceError::InvariantError(
+                            "unlock: container contained duplicate commitment".to_string(),
+                        ));
+                    }
+                }
+                *revealed_amount += container.amount();
+                *locked_revealed_amount -= container.amount();
+            },
+        }
+
+        Ok(())
+    }
+
+    pub fn lock_by_non_fungible_ids(&mut self, ids: BTreeSet<NonFungibleId>) -> Result<Self, ResourceError> {
+        match self {
+            ResourceContainer::Fungible { .. } => Err(ResourceError::OperationNotAllowed(
+                "Cannot lock by NFT token id from a fungible resource".to_string(),
+            )),
+            ResourceContainer::NonFungible {
+                token_ids,
+                locked_token_ids,
+                ..
+            } => {
+                let mut newly_locked = BTreeSet::new();
+                for id in ids {
+                    if let Some(token) = token_ids.take(&id) {
+                        newly_locked.insert(token.clone());
+                        locked_token_ids.insert(token);
+                    } else {
+                        return Err(ResourceError::NonFungibleTokenIdNotFound { token: id });
+                    }
+                }
+                Ok(ResourceContainer::non_fungible(*self.resource_address(), newly_locked))
+            },
+            ResourceContainer::Confidential { .. } => Err(ResourceError::OperationNotAllowed(
+                "Cannot lock by NFT token id from a confidential resource".to_string(),
+            )),
+        }
+    }
+
+    pub fn lock_by_amount(&mut self, amount: Amount) -> Result<Self, ResourceError> {
+        match self {
+            ResourceContainer::Fungible {
+                amount: available_amount,
+                locked_amount,
+                ..
+            } => {
+                if amount > *available_amount {
+                    return Err(ResourceError::InsufficientBalance {
+                        details: format!(
+                            "lock_by_amount: resource container did not contain enough funds. Required: {}, \
+                             Available: {}",
+                            amount, available_amount
+                        ),
+                    });
+                }
+                *available_amount -= amount;
+                *locked_amount += amount;
+                Ok(ResourceContainer::fungible(*self.resource_address(), amount))
+            },
+            ResourceContainer::NonFungible {
+                token_ids,
+                locked_token_ids,
+                ..
+            } => {
+                if amount > token_ids.len().into() {
+                    return Err(ResourceError::InsufficientBalance {
+                        details: format!(
+                            "lock_by_amount: resource container did not contain enough tokens. Required: {}, \
+                             Available: {}",
+                            amount,
+                            token_ids.len()
+                        ),
+                    });
+                }
+                let num_to_take = usize::try_from(amount.value())
+                    .map_err(|_| ResourceError::OperationNotAllowed(format!("Amount {} too large to lock", amount)))?;
+                let newly_locked_token_ids = (0..num_to_take)
+                    .map(|_| {
+                        token_ids
+                            .pop_first()
+                            .expect("Invariant violation: tokens.len() < amount")
+                    })
+                    .collect::<BTreeSet<_>>();
+                locked_token_ids.extend(newly_locked_token_ids.iter().cloned());
+
+                Ok(ResourceContainer::non_fungible(
+                    *self.resource_address(),
+                    newly_locked_token_ids,
+                ))
+            },
+            ResourceContainer::Confidential {
+                revealed_amount,
+                locked_revealed_amount,
+                ..
+            } => {
+                if amount > *revealed_amount {
+                    return Err(ResourceError::InsufficientBalance {
+                        details: format!(
+                            "lock_by_amount: resource container did not contain enough revealed funds. Required: {}, \
+                             Available: {}",
+                            amount, revealed_amount
+                        ),
+                    });
+                }
+                *revealed_amount -= amount;
+                *locked_revealed_amount += amount;
+                Ok(ResourceContainer::confidential(*self.resource_address(), None, amount))
+            },
         }
     }
 }
diff --git a/dan_layer/engine_types/src/substate.rs b/dan_layer/engine_types/src/substate.rs
index 433806384e..5b0a60bd56 100644
--- a/dan_layer/engine_types/src/substate.rs
+++ b/dan_layer/engine_types/src/substate.rs
@@ -459,6 +459,13 @@ impl SubstateValue {
         }
     }
 
+    pub fn as_resource(&self) -> Option<&Resource> {
+        match self {
+            SubstateValue::Resource(resource) => Some(resource),
+            _ => None,
+        }
+    }
+
     pub fn to_bytes(&self) -> Vec<u8> {
         encode(self).unwrap()
     }
diff --git a/dan_layer/engine_types/src/vault.rs b/dan_layer/engine_types/src/vault.rs
index 2fa02ba6ba..22ebb2e2c9 100644
--- a/dan_layer/engine_types/src/vault.rs
+++ b/dan_layer/engine_types/src/vault.rs
@@ -20,9 +20,10 @@
 //   WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
 //   USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-use std::collections::BTreeSet;
+use std::collections::{BTreeMap, BTreeSet};
 
 use serde::{Deserialize, Serialize};
+use tari_common_types::types::PublicKey;
 use tari_template_lib::{
     models::{Amount, ConfidentialWithdrawProof, NonFungibleId, ResourceAddress, VaultId},
     prelude::ResourceType,
@@ -31,6 +32,7 @@ use tari_template_lib::{
 use crate::{
     bucket::Bucket,
     confidential::ConfidentialOutput,
+    proof::{ContainerRef, LockedResource, Proof},
     resource_container::{ResourceContainer, ResourceError},
     serde_with,
 };
@@ -85,12 +87,16 @@ impl Vault {
         self.resource_container.amount()
     }
 
+    pub fn locked_balance(&self) -> Amount {
+        self.resource_container.locked_amount()
+    }
+
     pub fn get_commitment_count(&self) -> u32 {
         self.resource_container.get_commitment_count()
     }
 
-    pub fn get_confidential_outputs(&self) -> Option<Vec<&ConfidentialOutput>> {
-        self.resource_container.get_confidential_outputs()
+    pub fn get_confidential_commitments(&self) -> Option<&BTreeMap<PublicKey, ConfidentialOutput>> {
+        self.resource_container.get_confidential_commitments()
     }
 
     pub fn resource_address(&self) -> &ResourceAddress {
@@ -101,7 +107,7 @@ impl Vault {
         self.resource_container.resource_type()
     }
 
-    pub fn get_non_fungible_ids(&self) -> Option<&BTreeSet<NonFungibleId>> {
+    pub fn get_non_fungible_ids(&self) -> &BTreeSet<NonFungibleId> {
         self.resource_container.non_fungible_token_ids()
     }
 
@@ -115,4 +121,23 @@ impl Vault {
     pub fn resource_container_mut(&mut self) -> &mut ResourceContainer {
         &mut self.resource_container
     }
+
+    pub fn lock_all(&mut self) -> Result<LockedResource, ResourceError> {
+        let locked_resource = self.resource_container.lock_all()?;
+        Ok(LockedResource::new(ContainerRef::Vault(self.vault_id), locked_resource))
+    }
+
+    pub fn lock_by_non_fungible_ids(&mut self, ids: BTreeSet<NonFungibleId>) -> Result<LockedResource, ResourceError> {
+        let locked_resource = self.resource_container.lock_by_non_fungible_ids(ids)?;
+        Ok(LockedResource::new(ContainerRef::Vault(self.vault_id), locked_resource))
+    }
+
+    pub fn lock_by_amount(&mut self, amount: Amount) -> Result<LockedResource, ResourceError> {
+        let locked_resource = self.resource_container.lock_by_amount(amount)?;
+        Ok(LockedResource::new(ContainerRef::Vault(self.vault_id), locked_resource))
+    }
+
+    pub fn unlock(&mut self, proof: Proof) -> Result<(), ResourceError> {
+        self.resource_container.unlock(proof.into_resource_container())
+    }
 }
diff --git a/dan_layer/indexer_lib/src/substate_decoder.rs b/dan_layer/indexer_lib/src/substate_decoder.rs
index 413fe4d86e..6884b94d0b 100644
--- a/dan_layer/indexer_lib/src/substate_decoder.rs
+++ b/dan_layer/indexer_lib/src/substate_decoder.rs
@@ -24,14 +24,14 @@ use std::collections::HashSet;
 
 use log::*;
 use tari_engine_types::{
-    indexed_value::{IndexedValue, IndexedValueVisitorError},
+    indexed_value::{IndexedValue, IndexedValueError},
     substate::{Substate, SubstateAddress, SubstateValue},
 };
 
 const LOG_TARGET: &str = "tari::dan::initializer::substate_decoder";
 
 /// Recursively scan a substate for references to other substates
-pub fn find_related_substates(substate: &Substate) -> Result<Vec<SubstateAddress>, IndexedValueVisitorError> {
+pub fn find_related_substates(substate: &Substate) -> Result<Vec<SubstateAddress>, IndexedValueError> {
     match substate.substate_value() {
         SubstateValue::Component(header) => {
             // Look inside the component state for substate references
diff --git a/dan_layer/indexer_lib/src/transaction_autofiller.rs b/dan_layer/indexer_lib/src/transaction_autofiller.rs
index d5491fe99f..42d8bf57ca 100644
--- a/dan_layer/indexer_lib/src/transaction_autofiller.rs
+++ b/dan_layer/indexer_lib/src/transaction_autofiller.rs
@@ -6,7 +6,7 @@ use std::{collections::HashMap, sync::Arc};
 use log::*;
 use tari_dan_common_types::{NodeAddressable, ShardId};
 use tari_engine_types::{
-    indexed_value::IndexedValueVisitorError,
+    indexed_value::IndexedValueError,
     substate::{Substate, SubstateAddress},
 };
 use tari_epoch_manager::EpochManagerReader;
@@ -20,7 +20,7 @@ const LOG_TARGET: &str = "tari::indexer::transaction_autofiller";
 #[derive(Debug, thiserror::Error)]
 pub enum TransactionAutofillerError {
     #[error("Could not decode the substate: {0}")]
-    IndexedValueVisitorError(#[from] IndexedValueVisitorError),
+    IndexedValueVisitorError(#[from] IndexedValueError),
     #[error("Indexer error: {0}")]
     IndexerError(#[from] IndexerError),
 }
diff --git a/dan_layer/storage/src/consensus_models/executed_transaction.rs b/dan_layer/storage/src/consensus_models/executed_transaction.rs
index f7b1c262d7..6756cebdea 100644
--- a/dan_layer/storage/src/consensus_models/executed_transaction.rs
+++ b/dan_layer/storage/src/consensus_models/executed_transaction.rs
@@ -94,7 +94,7 @@ impl ExecutedTransaction {
             } else {
                 // TODO: We preserve the original result mainly for debugging purposes, but this is a little hacky
                 ExecuteResult {
-                    finalize: FinalizeResult::new_rejectted(
+                    finalize: FinalizeResult::new_rejected(
                         self.result.finalize.transaction_hash,
                         RejectReason::ShardRejected(format!(
                             "Validators decided to abort: {}",
diff --git a/dan_layer/storage/src/consensus_models/transaction.rs b/dan_layer/storage/src/consensus_models/transaction.rs
index ac6929fe80..9500c61e5b 100644
--- a/dan_layer/storage/src/consensus_models/transaction.rs
+++ b/dan_layer/storage/src/consensus_models/transaction.rs
@@ -112,7 +112,7 @@ impl TransactionRecord {
                 self.result
             } else {
                 Some(ExecuteResult {
-                    finalize: FinalizeResult::new_rejectted(
+                    finalize: FinalizeResult::new_rejected(
                         self.transaction.id().into_array().into(),
                         RejectReason::ShardRejected(format!(
                             "Validators decided to abort: {}",
diff --git a/dan_layer/storage_lmdb/src/engine_state_store.rs b/dan_layer/storage_lmdb/src/engine_state_store.rs
index 406ceffc1b..bdf2aa46c9 100644
--- a/dan_layer/storage_lmdb/src/engine_state_store.rs
+++ b/dan_layer/storage_lmdb/src/engine_state_store.rs
@@ -94,7 +94,7 @@ impl<'a, T: Deref<Target = ConstTransaction<'a>>> StateReader for LmdbTransactio
             })
     }
 
-    fn exists(&self, key: &[u8]) -> Result<bool, StateStoreError> {
+    fn exists_raw(&self, key: &[u8]) -> Result<bool, StateStoreError> {
         Ok(self.get_state_raw(&encode(key)?).optional()?.is_some())
     }
 }
@@ -143,7 +143,7 @@ mod tests {
         {
             let mut access = store.write_access().unwrap();
             access.set_state(b"abc", user_data.clone()).unwrap();
-            assert!(access.exists(b"abc").unwrap());
+            assert!(access.exists_raw(b"abc").unwrap());
             let res: UserData = access.get_state(b"abc").unwrap();
             assert_eq!(res, user_data);
             let res = access.get_state::<_, UserData>(b"def").optional().unwrap();
@@ -155,7 +155,7 @@ mod tests {
             let access = store.read_access().unwrap();
             let res = access.get_state::<_, UserData>(b"abc").optional().unwrap();
             assert_eq!(res, None);
-            assert!(!access.exists(b"abc").unwrap());
+            assert!(!access.exists_raw(b"abc").unwrap());
         }
 
         {
diff --git a/dan_layer/tari_bor/src/lib.rs b/dan_layer/tari_bor/src/lib.rs
index 6d128429c5..23ace06d55 100644
--- a/dan_layer/tari_bor/src/lib.rs
+++ b/dan_layer/tari_bor/src/lib.rs
@@ -17,8 +17,7 @@ mod walker;
 pub use ciborium::value::Value;
 use ciborium::{de::from_reader, ser::into_writer};
 pub use error::BorError;
-pub use serde;
-use serde::{de::DeserializeOwned, Serialize};
+pub use serde::{self, de::DeserializeOwned, Deserialize, Serialize};
 pub use walker::*;
 
 pub fn encode_with_len<T: Serialize>(val: &T) -> Vec<u8> {
@@ -54,6 +53,14 @@ pub fn encode<T: Serialize + ?Sized>(val: &T) -> Result<Vec<u8>, BorError> {
     Ok(buf)
 }
 
+pub fn to_value<T: Serialize + ?Sized>(val: &T) -> Result<Value, BorError> {
+    Value::serialized(val).map_err(to_bor_error)
+}
+
+pub fn from_value<T: DeserializeOwned>(val: &Value) -> Result<T, BorError> {
+    Value::deserialized(val).map_err(to_bor_error)
+}
+
 pub fn decode<T: DeserializeOwned>(mut input: &[u8]) -> Result<T, BorError> {
     decode_inner(&mut input)
 }
diff --git a/dan_layer/template_abi/src/call_info.rs b/dan_layer/template_abi/src/call_info.rs
index ef1d26fa50..e3e736356a 100644
--- a/dan_layer/template_abi/src/call_info.rs
+++ b/dan_layer/template_abi/src/call_info.rs
@@ -27,6 +27,6 @@ use crate::rust::{string::String, vec::Vec};
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct CallInfo {
     pub func_name: String,
-    pub args: Vec<Vec<u8>>,
+    pub args: Vec<tari_bor::Value>,
     pub abi_context: Vec<u8>,
 }
diff --git a/dan_layer/template_abi/src/ops.rs b/dan_layer/template_abi/src/ops.rs
index 99b39c30af..a6ab4cea11 100644
--- a/dan_layer/template_abi/src/ops.rs
+++ b/dan_layer/template_abi/src/ops.rs
@@ -38,6 +38,7 @@ pub enum EngineOp {
     GenerateRandomInvoke = 0x0A,
     EmitEvent = 0x0B,
     CallInvoke = 0x0C,
+    ProofInvoke = 0x0D,
 }
 
 impl EngineOp {
@@ -56,6 +57,7 @@ impl EngineOp {
             0x0A => Some(EngineOp::GenerateRandomInvoke),
             0x0B => Some(EngineOp::EmitEvent),
             0x0C => Some(EngineOp::CallInvoke),
+            0x0D => Some(EngineOp::ProofInvoke),
             _ => None,
         }
     }
diff --git a/dan_layer/template_builtin/templates/account/src/lib.rs b/dan_layer/template_builtin/templates/account/src/lib.rs
index 0db0853eb6..6c389c31a4 100644
--- a/dan_layer/template_builtin/templates/account/src/lib.rs
+++ b/dan_layer/template_builtin/templates/account/src/lib.rs
@@ -26,22 +26,21 @@ use tari_template_lib::prelude::*;
 #[template]
 mod account_template {
     use super::*;
-
     pub struct Account {
         // TODO: Lazy key value map/store
         vaults: BTreeMap<ResourceAddress, Vault>,
     }
 
     impl Account {
-        pub fn create(owner_token: NonFungibleAddress) -> AccountComponent {
+        pub fn create(owner_token: NonFungibleAddress) -> Component<Account> {
             Self::internal_create(owner_token, None)
         }
 
-        pub fn create_with_bucket(owner_token: NonFungibleAddress, bucket: Bucket) -> AccountComponent {
+        pub fn create_with_bucket(owner_token: NonFungibleAddress, bucket: Bucket) -> Component<Account> {
             Self::internal_create(owner_token, Some(bucket))
         }
 
-        fn internal_create(owner_token: NonFungibleAddress, bucket: Option<Bucket>) -> AccountComponent {
+        fn internal_create(owner_token: NonFungibleAddress, bucket: Option<Bucket>) -> Component<Account> {
             // extract the public key from the token
             // we only allow owner tokens that correspond to public keys
             let public_key = owner_token
@@ -52,7 +51,8 @@ mod account_template {
             let component_id = public_key.as_hash();
 
             // only the owner of the token will be able to withdraw funds from the account
-            let withdraw_rule = AccessRule::Restricted(Require(owner_token));
+            let withdraw_rule =
+                AccessRule::Restricted(RestrictedAccessRule::Require(RequireRule::Require(owner_token.into())));
             let rules = AccessRules::new()
                 .add_method_rule("balance", AccessRule::AllowAll)
                 .add_method_rule("get_balances", AccessRule::AllowAll)
@@ -67,7 +67,10 @@ mod account_template {
                 vaults.insert(b.resource_address(), Vault::from_bucket(b));
             }
 
-            Self { vaults }.create_with_options(rules, Some(component_id))
+            Component::new(Self { vaults })
+                .with_access_rules(rules)
+                .with_component_id(component_id)
+                .create()
         }
 
         // #[access_rule(allow_all)]
@@ -191,5 +194,33 @@ mod account_template {
             self.get_vault_mut(CONFIDENTIAL_TARI_RESOURCE_ADDRESS)
                 .pay_fee_confidential(proof);
         }
+
+        pub fn create_proof_for_resource(&mut self, resource: ResourceAddress) -> Proof {
+            emit_event("create_proof_for_resource", [("resource", resource.to_string())]);
+            let v = self.get_vault_mut(resource);
+            v.create_proof()
+        }
+
+        pub fn create_proof_by_non_fungible_ids(
+            &mut self,
+            resource: ResourceAddress,
+            ids: Vec<NonFungibleId>,
+        ) -> Proof {
+            emit_event("create_proof_by_non_fungible_ids", [
+                ("resource", resource.to_string()),
+                ("ids", ids.iter().map(ToString::to_string).collect::<Vec<_>>().join(",")),
+            ]);
+            let v = self.get_vault_mut(resource);
+            v.create_proof_by_non_fungible_ids(ids.into_iter().collect())
+        }
+
+        pub fn create_proof_by_amount(&mut self, resource: ResourceAddress, amount: Amount) -> Proof {
+            emit_event("create_proof_by_amount", [
+                ("resource", resource.to_string()),
+                ("amount", amount.to_string()),
+            ]);
+            let v = self.get_vault_mut(resource);
+            v.create_proof_by_amount(amount)
+        }
     }
 }
diff --git a/dan_layer/template_builtin/templates/account_nfts/src/lib.rs b/dan_layer/template_builtin/templates/account_nfts/src/lib.rs
index 0581602aeb..68c74df2d7 100644
--- a/dan_layer/template_builtin/templates/account_nfts/src/lib.rs
+++ b/dan_layer/template_builtin/templates/account_nfts/src/lib.rs
@@ -31,7 +31,7 @@ mod account_non_fungible_template {
     }
 
     impl AccountNonFungible {
-        pub fn create(owner_token: NonFungibleAddress, token_symbol: String) -> AccountNonFungibleComponent {
+        pub fn create(owner_token: NonFungibleAddress, token_symbol: String) -> Component<AccountNonFungible> {
             // extract the public key from the token
             // we only allow owner tokens that correspond to public keys
             let public_key = owner_token
@@ -40,16 +40,22 @@ mod account_non_fungible_template {
             // the account component will be addressed using the public key
             let component_id = public_key.as_hash();
 
-            // create the resource address
-            let resource_address = ResourceBuilder::non_fungible(token_symbol).build();
-
             // only the owner of the token will be able to withdraw funds from the account
-            let mint_rule = AccessRule::Restricted(Require(owner_token));
+            let mint_rule =
+                AccessRule::Restricted(RestrictedAccessRule::Require(RequireRule::Require(owner_token.into())));
+            // create the resource
+            let resource_address = ResourceBuilder::non_fungible(token_symbol)
+                .mintable(mint_rule.clone())
+                .build();
+
             let rules = AccessRules::new()
                 .add_method_rule("non_fungible_token_get_resource_address", AccessRule::AllowAll)
                 .default(mint_rule);
 
-            Self { resource_address }.create_with_options(rules, Some(component_id))
+            Component::new(Self { resource_address })
+                .with_access_rules(rules)
+                .with_component_id(component_id)
+                .create()
         }
 
         pub fn mint(&mut self, metadata: Metadata) -> Bucket {
@@ -59,14 +65,11 @@ mod account_non_fungible_template {
         }
 
         pub fn mint_specific(&mut self, id: NonFungibleId, metadata: Metadata) -> Bucket {
-            emit_event(
-                "mint",
-                [
-                    ("id".to_string(), id.to_string()),
-                    ("metadata".to_string(), metadata.to_string()),
-                    ("resource_address".to_string(), self.resource_address.to_string()),
-                ],
-            );
+            emit_event("mint", [
+                ("id".to_string(), id.to_string()),
+                ("metadata".to_string(), metadata.to_string()),
+                ("resource_address".to_string(), self.resource_address.to_string()),
+            ]);
 
             // Mint the NFT, this will fail if the token ID already exists
             ResourceManager::get(self.resource_address).mint_non_fungible(id, &metadata, &{})
diff --git a/dan_layer/template_lib/src/args/mod.rs b/dan_layer/template_lib/src/args/mod.rs
index 5b5e5faebd..4753b4368d 100644
--- a/dan_layer/template_lib/src/args/mod.rs
+++ b/dan_layer/template_lib/src/args/mod.rs
@@ -21,8 +21,8 @@
 // OTHERWISE) ARISING IN ANY WAY OUT OF THE  USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
 // DAMAGE.
 
-mod engine;
-pub use engine::*;
+mod types;
+pub use types::*;
 
 mod arg;
 pub use arg::Arg;
diff --git a/dan_layer/template_lib/src/args/result.rs b/dan_layer/template_lib/src/args/result.rs
index 927f4cdd8c..fb96b73ff9 100644
--- a/dan_layer/template_lib/src/args/result.rs
+++ b/dan_layer/template_lib/src/args/result.rs
@@ -24,10 +24,6 @@ impl InvokeResult {
         Self(Ok(data))
     }
 
-    pub fn unwrap_decode<T: DeserializeOwned>(self) -> T {
-        self.decode().unwrap()
-    }
-
     pub fn unit() -> Self {
         Self(Ok(encode(&()).unwrap()))
     }
diff --git a/dan_layer/template_lib/src/args/engine.rs b/dan_layer/template_lib/src/args/types.rs
similarity index 84%
rename from dan_layer/template_lib/src/args/engine.rs
rename to dan_layer/template_lib/src/args/types.rs
index d2b03cab49..682383a5fb 100644
--- a/dan_layer/template_lib/src/args/engine.rs
+++ b/dan_layer/template_lib/src/args/types.rs
@@ -30,6 +30,8 @@ use tari_template_abi::rust::{
 };
 
 use crate::{
+    args::Arg,
+    auth::{OwnerRule, ResourceAccessRules},
     models::{
         Amount,
         BucketId,
@@ -38,10 +40,11 @@ use crate::{
         Metadata,
         NonFungibleAddress,
         NonFungibleId,
+        ProofId,
         ResourceAddress,
         VaultRef,
     },
-    prelude::{AccessRules, ConfidentialOutputProof, TemplateAddress},
+    prelude::{ComponentAccessRules, ConfidentialOutputProof, TemplateAddress},
     resource::ResourceType,
     Hash,
 };
@@ -105,7 +108,7 @@ pub struct ComponentInvokeArg {
     pub args: Vec<Vec<u8>>,
 }
 
-#[derive(Debug, Clone, PartialEq, Eq, Hash, PartialOrd, Ord, Serialize, Deserialize)]
+#[derive(Debug, Clone, Serialize, Deserialize)]
 pub enum ComponentAction {
     Get,
     Create,
@@ -131,7 +134,8 @@ impl ComponentRef {
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct CreateComponentArg {
     pub encoded_state: Vec<u8>,
-    pub access_rules: AccessRules,
+    pub owner_rule: OwnerRule,
+    pub access_rules: ComponentAccessRules,
     pub component_id: Option<Hash>,
 }
 
@@ -174,12 +178,13 @@ impl From<ResourceAddress> for ResourceRef {
 
 #[derive(Debug, Clone, PartialEq, Eq, Hash, PartialOrd, Ord, Serialize, Deserialize)]
 pub enum ResourceAction {
-    GetTotalSupply,
-    GetResourceType,
-    GetNonFungible,
     Create,
     Mint,
     UpdateNonFungibleData,
+    GetTotalSupply,
+    GetResourceType,
+    GetNonFungible,
+    UpdateAccessRules,
 }
 
 #[derive(Clone, Debug, Serialize, Deserialize)]
@@ -198,6 +203,8 @@ pub enum MintArg {
 #[derive(Clone, Debug, Serialize, Deserialize)]
 pub struct CreateResourceArg {
     pub resource_type: ResourceType,
+    pub owner_rule: OwnerRule,
+    pub access_rules: ResourceAccessRules,
     pub token_symbol: String,
     pub metadata: Metadata,
     pub mint_arg: Option<MintArg>,
@@ -239,6 +246,10 @@ pub enum VaultAction {
     GetCommitmentCount,
     ConfidentialReveal,
     PayFee,
+    CreateProofByResource,
+    CreateProofByFungibleAmount,
+    CreateProofByNonFungibles,
+    CreateProofByConfidentialResource,
 }
 
 #[derive(Clone, Debug, Serialize, Deserialize)]
@@ -293,7 +304,6 @@ impl BucketRef {
 
 #[derive(Clone, Copy, Debug, Serialize, Deserialize)]
 pub enum BucketAction {
-    Create,
     GetResourceAddress,
     GetResourceType,
     GetAmount,
@@ -311,10 +321,10 @@ pub struct BucketBurnArg {
 // -------------------------------- Workspace -------------------------------- //
 #[derive(Clone, Copy, Debug, Serialize, Deserialize)]
 pub enum WorkspaceAction {
-    Put,
     PutLastInstructionOutput,
     Get,
     ListBuckets,
+    DropAllProofs,
 }
 
 #[derive(Clone, Debug, Serialize, Deserialize)]
@@ -368,6 +378,7 @@ pub struct CallerContextInvokeArg {
 #[derive(Clone, Debug, Serialize, Deserialize)]
 pub enum CallerContextAction {
     GetCallerPublicKey,
+    GetComponentAddress,
 }
 
 // -------------------------------- CallInvoke -------------------------------- //
@@ -377,7 +388,7 @@ pub struct CallInvokeArg {
     pub args: Vec<Vec<u8>>,
 }
 
-#[derive(Debug, Clone, PartialEq, Eq, Hash, PartialOrd, Ord, Serialize, Deserialize)]
+#[derive(Debug, Clone, Serialize, Deserialize)]
 pub enum CallAction {
     CallFunction,
     CallMethod,
@@ -387,12 +398,68 @@ pub enum CallAction {
 pub struct CallFunctionArg {
     pub template_address: TemplateAddress,
     pub function: String,
-    pub args: Vec<Vec<u8>>,
+    pub args: Vec<Arg>,
 }
 
 #[derive(Clone, Debug, Serialize, Deserialize)]
 pub struct CallMethodArg {
     pub component_address: ComponentAddress,
     pub method: String,
+    pub args: Vec<Arg>,
+}
+
+// -------------------------------- ProofInvoke -------------------------------- //
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct ProofInvokeArg {
+    pub proof_ref: ProofRef,
+    pub action: ProofAction,
     pub args: Vec<Vec<u8>>,
 }
+
+#[derive(Clone, Copy, Debug, Serialize, Deserialize)]
+pub enum ProofRef {
+    Proof(ResourceAddress),
+    Ref(ProofId),
+}
+
+impl ProofRef {
+    pub fn resource_address(&self) -> Option<ResourceAddress> {
+        match self {
+            ProofRef::Proof(addr) => Some(*addr),
+            ProofRef::Ref(_) => None,
+        }
+    }
+
+    pub fn proof_id(&self) -> Option<ProofId> {
+        match self {
+            ProofRef::Proof(_) => None,
+            ProofRef::Ref(id) => Some(*id),
+        }
+    }
+}
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub enum ProofAction {
+    GetAmount,
+    GetResourceAddress,
+    GetResourceType,
+    Authorize,
+    DropAuthorize,
+    Drop,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct VaultCreateProofByFungibleAmountArg {
+    pub amount: Amount,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct VaultCreateProofByNonFungiblesArg {
+    pub ids: BTreeSet<NonFungibleId>,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct CreateProofOfResourceByConfidentialArg {
+    // TODO: confidential. zero knowledge proof of commitment factors
+    // pub proof: ConfidentialProofOfKnowledge
+}
diff --git a/dan_layer/template_lib/src/auth/access_rules.rs b/dan_layer/template_lib/src/auth/access_rules.rs
index e2caf7e215..42e4a80b32 100644
--- a/dan_layer/template_lib/src/auth/access_rules.rs
+++ b/dan_layer/template_lib/src/auth/access_rules.rs
@@ -4,7 +4,7 @@
 use serde::{Deserialize, Serialize};
 use tari_template_abi::rust::collections::BTreeMap;
 
-use crate::{auth::NativeFunctionCall, models::NonFungibleAddress};
+use crate::models::{NonFungibleAddress, ResourceAddress};
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub enum AccessRule {
@@ -14,66 +14,92 @@ pub enum AccessRule {
 }
 
 impl AccessRule {
-    pub fn is_access_allowed(&self, proofs: &[NonFungibleAddress]) -> bool {
-        match self {
-            AccessRule::AllowAll => true,
-            AccessRule::DenyAll => false,
-            AccessRule::Restricted(rule) => rule.is_access_allowed(proofs),
+    pub fn and(self, other: Self) -> Self {
+        match (self, other) {
+            (Self::AllowAll, Self::AllowAll) => Self::AllowAll,
+            (Self::DenyAll, _) | (_, Self::DenyAll) => Self::DenyAll,
+            (Self::Restricted(rule1), Self::Restricted(rule2)) => Self::Restricted(rule1.and(rule2)),
+            (Self::Restricted(rule), Self::AllowAll) | (Self::AllowAll, Self::Restricted(rule)) => {
+                Self::Restricted(rule)
+            },
+        }
+    }
+
+    pub fn or(self, other: Self) -> Self {
+        match (self, other) {
+            (Self::AllowAll, _) | (_, Self::AllowAll) => Self::AllowAll,
+            (Self::DenyAll, Self::DenyAll) => Self::DenyAll,
+            (Self::Restricted(rule1), Self::Restricted(rule2)) => Self::Restricted(rule1.or(rule2)),
+            (Self::Restricted(rule), Self::DenyAll) | (Self::DenyAll, Self::Restricted(rule)) => Self::Restricted(rule),
         }
     }
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub enum RestrictedAccessRule {
-    Require(NonFungibleAddress),
-    // TODO: Other requirements, for example, holder of a particular resource or particular balance of funds locked
-    //       for the transaction
+    Require(RequireRule),
+    AnyOf(Vec<RestrictedAccessRule>),
+    AllOf(Vec<RestrictedAccessRule>),
 }
 
 impl RestrictedAccessRule {
-    pub fn is_access_allowed(&self, proofs: &[NonFungibleAddress]) -> bool {
-        match self {
-            RestrictedAccessRule::Require(proof) => proofs.contains(proof),
-        }
+    pub fn and(self, other: Self) -> Self {
+        Self::AllOf(vec![self, other])
+    }
+
+    pub fn or(self, other: Self) -> Self {
+        Self::AnyOf(vec![self, other])
+    }
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub enum ResourceOrNonFungibleAddress {
+    Resource(ResourceAddress),
+    NonFungibleAddress(NonFungibleAddress),
+}
+
+impl From<ResourceAddress> for ResourceOrNonFungibleAddress {
+    fn from(address: ResourceAddress) -> Self {
+        Self::Resource(address)
+    }
+}
+
+impl From<NonFungibleAddress> for ResourceOrNonFungibleAddress {
+    fn from(address: NonFungibleAddress) -> Self {
+        Self::NonFungibleAddress(address)
     }
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct AccessRules {
+pub enum RequireRule {
+    Require(ResourceOrNonFungibleAddress),
+    AnyOf(Vec<ResourceOrNonFungibleAddress>),
+    AllOf(Vec<ResourceOrNonFungibleAddress>),
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct ComponentAccessRules {
     method_access: BTreeMap<String, AccessRule>,
-    native_method_access: BTreeMap<NativeFunctionCall, AccessRule>,
     default: AccessRule,
 }
 
-impl AccessRules {
+impl ComponentAccessRules {
     pub fn new() -> Self {
         Self {
             method_access: BTreeMap::new(),
-            native_method_access: BTreeMap::new(),
             default: AccessRule::DenyAll,
         }
     }
 
-    // TODO: we use this for all component functions which return Self. Either we need to remove Self support from
-    //       template macro (meaning users HAVE to define AccessRules), or we provide
-    //       #[template(access_rule = "require(...)")] method annotations, or we decide that AllowAll is a sensible
-    //       default for this case.
-    pub fn with_default_allow() -> Self {
+    pub fn allow_all() -> Self {
         Self {
             method_access: BTreeMap::new(),
-            native_method_access: BTreeMap::new(),
             default: AccessRule::AllowAll,
         }
     }
 
     pub fn add_method_rule<S: Into<String>>(mut self, name: S, rule: AccessRule) -> Self {
-        let name = name.into();
-        self.method_access.insert(name, rule);
-        self
-    }
-
-    pub fn add_native_rule(mut self, call: NativeFunctionCall, rule: AccessRule) -> Self {
-        self.native_method_access.insert(call, rule);
+        self.method_access.insert(name.into(), rule);
         self
     }
 
@@ -86,16 +112,98 @@ impl AccessRules {
         self.method_access.get(name).unwrap_or(&self.default)
     }
 
-    pub fn get_native_access_rule(&self, call: &NativeFunctionCall) -> &AccessRule {
-        self.native_method_access.get(call).unwrap_or(&self.default)
-    }
-
     pub fn method_access_rules_iter(&self) -> impl Iterator<Item = (&String, &AccessRule)> {
         self.method_access.iter()
     }
 }
 
-impl Default for AccessRules {
+impl Default for ComponentAccessRules {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+#[derive(Debug, Clone)]
+pub enum ResourceAuthAction {
+    Mint,
+    Burn,
+    Withdraw,
+    Deposit,
+    UpdateNonFungibleData,
+    UpdateAccessRules,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct ResourceAccessRules {
+    mintable: AccessRule,
+    burnable: AccessRule,
+    withdrawable: AccessRule,
+    depositable: AccessRule,
+    update_non_fungible_data: AccessRule,
+}
+
+impl ResourceAccessRules {
+    pub fn new() -> Self {
+        Self {
+            // User should explicitly enable minting and/or burning
+            mintable: AccessRule::DenyAll,
+            burnable: AccessRule::DenyAll,
+            // But explicitly disable withdrawing, updating and/or depositing
+            withdrawable: AccessRule::AllowAll,
+            depositable: AccessRule::AllowAll,
+            update_non_fungible_data: AccessRule::AllowAll,
+        }
+    }
+
+    pub fn deny_all() -> Self {
+        Self {
+            mintable: AccessRule::DenyAll,
+            burnable: AccessRule::DenyAll,
+            withdrawable: AccessRule::DenyAll,
+            depositable: AccessRule::DenyAll,
+            update_non_fungible_data: AccessRule::DenyAll,
+        }
+    }
+
+    pub fn mintable(mut self, rule: AccessRule) -> Self {
+        self.mintable = rule;
+        self
+    }
+
+    pub fn burnable(mut self, rule: AccessRule) -> Self {
+        self.burnable = rule;
+        self
+    }
+
+    pub fn withdrawable(mut self, rule: AccessRule) -> Self {
+        self.withdrawable = rule;
+        self
+    }
+
+    pub fn depositable(mut self, rule: AccessRule) -> Self {
+        self.depositable = rule;
+        self
+    }
+
+    pub fn update_non_fungible_data(mut self, rule: AccessRule) -> Self {
+        self.update_non_fungible_data = rule;
+        self
+    }
+
+    pub fn get_access_rule(&self, action: &ResourceAuthAction) -> &AccessRule {
+        match action {
+            ResourceAuthAction::Mint => &self.mintable,
+            ResourceAuthAction::Burn => &self.burnable,
+            ResourceAuthAction::Withdraw => &self.withdrawable,
+            ResourceAuthAction::Deposit => &self.depositable,
+            ResourceAuthAction::UpdateNonFungibleData => &self.update_non_fungible_data,
+            // Only owner can do this
+            ResourceAuthAction::UpdateAccessRules => &AccessRule::DenyAll,
+        }
+    }
+}
+
+impl Default for ResourceAccessRules {
     fn default() -> Self {
         Self::new()
     }
diff --git a/dan_layer/template_lib/src/auth/mod.rs b/dan_layer/template_lib/src/auth/mod.rs
index 4e35e1c0d8..3f0bcf5dda 100644
--- a/dan_layer/template_lib/src/auth/mod.rs
+++ b/dan_layer/template_lib/src/auth/mod.rs
@@ -1,8 +1,7 @@
 //   Copyright 2023 The Tari Project
 //   SPDX-License-Identifier: BSD-3-Clause
-
 mod access_rules;
-pub use access_rules::{AccessRule, AccessRules, RestrictedAccessRule};
+pub use access_rules::*;
 
-mod native;
-pub use native::NativeFunctionCall;
+mod owner_rule;
+pub use owner_rule::*;
diff --git a/dan_layer/template_lib/src/auth/native.rs b/dan_layer/template_lib/src/auth/native.rs
deleted file mode 100644
index f8d34becdd..0000000000
--- a/dan_layer/template_lib/src/auth/native.rs
+++ /dev/null
@@ -1,24 +0,0 @@
-//   Copyright 2023 The Tari Project
-//   SPDX-License-Identifier: BSD-3-Clause
-
-use serde::{Deserialize, Serialize};
-use tari_template_abi::rust::fmt::{Display, Formatter};
-
-use crate::args::{ComponentAction, ResourceAction, VaultAction};
-
-#[derive(Debug, Clone, PartialEq, Eq, Hash, PartialOrd, Ord, Serialize, Deserialize)]
-pub enum NativeFunctionCall {
-    Component(ComponentAction),
-    Resource(ResourceAction),
-    Vault(VaultAction),
-}
-
-impl Display for NativeFunctionCall {
-    fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
-        match self {
-            NativeFunctionCall::Component(action) => write!(f, "component.{:?}", action),
-            NativeFunctionCall::Resource(action) => write!(f, "resource.{:?}", action),
-            NativeFunctionCall::Vault(action) => write!(f, "vault.{:?}", action),
-        }
-    }
-}
diff --git a/dan_layer/template_lib/src/auth/owner_rule.rs b/dan_layer/template_lib/src/auth/owner_rule.rs
new file mode 100644
index 0000000000..d0e416bd4c
--- /dev/null
+++ b/dan_layer/template_lib/src/auth/owner_rule.rs
@@ -0,0 +1,18 @@
+//   Copyright 2023 The Tari Project
+//   SPDX-License-Identifier: BSD-3-Clause
+
+use crate::{auth::AccessRule, crypto::RistrettoPublicKeyBytes};
+
+#[derive(Debug, Clone, Copy)]
+pub struct Ownership<'a> {
+    pub owner_key: &'a RistrettoPublicKeyBytes,
+    pub owner_rule: &'a OwnerRule,
+}
+
+#[derive(Debug, Clone, Default, serde::Serialize, serde::Deserialize)]
+pub enum OwnerRule {
+    #[default]
+    OwnedBySigner,
+    None,
+    ByAccessRule(AccessRule),
+}
diff --git a/dan_layer/template_lib/src/caller_context.rs b/dan_layer/template_lib/src/caller_context.rs
index 25bee0fdf6..f885eb794f 100644
--- a/dan_layer/template_lib/src/caller_context.rs
+++ b/dan_layer/template_lib/src/caller_context.rs
@@ -5,16 +5,27 @@ use tari_template_abi::{call_engine, EngineOp};
 use crate::{
     args::{CallerContextAction, CallerContextInvokeArg, InvokeResult},
     crypto::RistrettoPublicKeyBytes,
+    models::ComponentAddress,
 };
 
-pub struct CallerContext {}
+pub struct CallerContext;
 
 impl CallerContext {
-    pub fn caller() -> RistrettoPublicKeyBytes {
+    pub fn transaction_signer_public_key() -> RistrettoPublicKeyBytes {
         let resp: InvokeResult = call_engine(EngineOp::CallerContextInvoke, &CallerContextInvokeArg {
             action: CallerContextAction::GetCallerPublicKey,
         });
 
         resp.decode().expect("Failed to decode PublicKey")
     }
+
+    pub fn current_component_address() -> ComponentAddress {
+        let resp: InvokeResult = call_engine(EngineOp::CallerContextInvoke, &CallerContextInvokeArg {
+            action: CallerContextAction::GetComponentAddress,
+        });
+
+        resp.decode::<Option<ComponentAddress>>()
+            .expect("Failed to decode Option<ComponentAddress>")
+            .expect("Not in a component instance context")
+    }
 }
diff --git a/dan_layer/template_lib/src/component/instance.rs b/dan_layer/template_lib/src/component/instance.rs
new file mode 100644
index 0000000000..83d20c7fdf
--- /dev/null
+++ b/dan_layer/template_lib/src/component/instance.rs
@@ -0,0 +1,94 @@
+//   Copyright 2023 The Tari Project
+//   SPDX-License-Identifier: BSD-3-Clause
+
+use std::marker::PhantomData;
+
+use crate::{
+    auth::{ComponentAccessRules, OwnerRule},
+    engine,
+    models::ComponentAddress,
+    Hash,
+};
+
+pub struct ComponentBuilder<T> {
+    component: T,
+    owner_rule: OwnerRule,
+    access_rules: ComponentAccessRules,
+    component_id: Option<Hash>,
+}
+
+impl<T: serde::Serialize> ComponentBuilder<T> {
+    fn new(component: T) -> Self {
+        Self {
+            component,
+            owner_rule: OwnerRule::default(),
+            access_rules: ComponentAccessRules::new(),
+            component_id: None,
+        }
+    }
+
+    pub fn with_owner_rule(mut self, owner_rule: OwnerRule) -> Self {
+        self.owner_rule = owner_rule;
+        self
+    }
+
+    pub fn with_access_rules(mut self, access_rules: ComponentAccessRules) -> Self {
+        self.access_rules = access_rules;
+        self
+    }
+
+    pub fn with_component_id(mut self, component_id: Hash) -> Self {
+        self.component_id = Some(component_id);
+        self
+    }
+
+    pub fn create(self) -> Component<T> {
+        let address = engine().create_component(self.component, self.owner_rule, self.access_rules, self.component_id);
+        Component::from_address(address)
+    }
+}
+
+#[derive(Debug, Clone, serde::Serialize, serde::Deserialize)]
+#[serde(transparent)]
+pub struct Component<T> {
+    address: ComponentAddress,
+    #[serde(skip)]
+    _component: PhantomData<T>,
+}
+
+impl<T: serde::Serialize> Component<T> {
+    #[allow(clippy::new_ret_no_self)]
+    pub fn new(component: T) -> ComponentBuilder<T> {
+        ComponentBuilder::new(component)
+    }
+
+    pub fn create(component: T) -> Component<T> {
+        Self::new(component).create()
+    }
+
+    fn from_address(address: ComponentAddress) -> Self {
+        Self {
+            address,
+            _component: PhantomData,
+        }
+    }
+
+    pub fn address(&self) -> &ComponentAddress {
+        &self.address
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use tari_bor::{decode, encode};
+
+    use super::*;
+
+    #[test]
+    fn it_serializes_as_a_component_address() {
+        decode::<ComponentAddress>(
+            &encode(&Component::<u32>::from_address(ComponentAddress::new(Hash::default()))).unwrap(),
+        )
+        .unwrap();
+    }
+}
diff --git a/dan_layer/template_lib/src/component/interface.rs b/dan_layer/template_lib/src/component/interface.rs
deleted file mode 100644
index be567dfbbf..0000000000
--- a/dan_layer/template_lib/src/component/interface.rs
+++ /dev/null
@@ -1,20 +0,0 @@
-//   Copyright 2023 The Tari Project
-//   SPDX-License-Identifier: BSD-3-Clause
-
-use crate::{auth::AccessRules, Hash};
-
-pub trait ComponentInterface {
-    type Component: ComponentInstanceInterface;
-
-    fn create(self) -> Self::Component
-    where Self: Sized {
-        // TODO: What should happen if you create a component without access rules?
-        self.create_with_options(AccessRules::new(), None)
-    }
-
-    fn create_with_options(self, access_rules: AccessRules, component_id: Option<Hash>) -> Self::Component;
-}
-
-pub trait ComponentInstanceInterface {
-    fn set_access_rules(self, rules: AccessRules) -> Self;
-}
diff --git a/dan_layer/template_lib/src/component/manager.rs b/dan_layer/template_lib/src/component/manager.rs
index 877d74ed68..da22934863 100644
--- a/dan_layer/template_lib/src/component/manager.rs
+++ b/dan_layer/template_lib/src/component/manager.rs
@@ -25,8 +25,17 @@ use tari_bor::{decode_exact, encode};
 use tari_template_abi::{call_engine, EngineOp};
 
 use crate::{
-    args::{CallAction, CallInvokeArg, CallMethodArg, ComponentAction, ComponentInvokeArg, ComponentRef, InvokeResult},
-    auth::AccessRules,
+    args::{
+        Arg,
+        CallAction,
+        CallInvokeArg,
+        CallMethodArg,
+        ComponentAction,
+        ComponentInvokeArg,
+        ComponentRef,
+        InvokeResult,
+    },
+    auth::ComponentAccessRules,
     models::ComponentAddress,
 };
 
@@ -43,7 +52,7 @@ impl ComponentManager {
         Self { address }
     }
 
-    pub fn call<T: DeserializeOwned>(&self, method: String, args: Vec<Vec<u8>>) -> T {
+    pub fn call<T: DeserializeOwned>(&self, method: String, args: Vec<Arg>) -> T {
         self.call_internal(CallMethodArg {
             component_address: self.address,
             method,
@@ -83,7 +92,7 @@ impl ComponentManager {
         });
     }
 
-    pub fn set_access_rules(&self, access_rules: AccessRules) {
+    pub fn set_access_rules(&self, access_rules: ComponentAccessRules) {
         call_engine::<_, InvokeResult>(EngineOp::ComponentInvoke, &ComponentInvokeArg {
             component_ref: ComponentRef::Ref(self.address),
             action: ComponentAction::SetAccessRules,
diff --git a/dan_layer/template_lib/src/component/mod.rs b/dan_layer/template_lib/src/component/mod.rs
index dc8114af5e..edee207ff7 100644
--- a/dan_layer/template_lib/src/component/mod.rs
+++ b/dan_layer/template_lib/src/component/mod.rs
@@ -20,7 +20,8 @@
 //  WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
 //  USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-pub mod interface;
-
 mod manager;
-pub use manager::ComponentManager;
+pub use manager::*;
+
+mod instance;
+pub use instance::*;
diff --git a/dan_layer/template_lib/src/crypto.rs b/dan_layer/template_lib/src/crypto.rs
index 877058245a..5a4fc6a0c7 100644
--- a/dan_layer/template_lib/src/crypto.rs
+++ b/dan_layer/template_lib/src/crypto.rs
@@ -9,7 +9,7 @@ use tari_template_abi::rust::{
     string::String,
 };
 
-use crate::Hash;
+use crate::{models::NonFungibleAddress, Hash};
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Default, Serialize, Deserialize)]
 #[serde(transparent)]
@@ -47,6 +47,10 @@ impl RistrettoPublicKeyBytes {
     pub fn as_hash(&self) -> Hash {
         Hash::from_array(self.0)
     }
+
+    pub fn to_non_fungible_address(&self) -> NonFungibleAddress {
+        NonFungibleAddress::from_public_key(*self)
+    }
 }
 
 impl TryFrom<&[u8]> for RistrettoPublicKeyBytes {
diff --git a/dan_layer/template_lib/src/engine.rs b/dan_layer/template_lib/src/engine.rs
index e47fa347fb..a0647a3b86 100644
--- a/dan_layer/template_lib/src/engine.rs
+++ b/dan_layer/template_lib/src/engine.rs
@@ -26,11 +26,12 @@ use tari_template_abi::{call_engine, EngineOp};
 
 use crate::{
     args::{ComponentAction, ComponentInvokeArg, ComponentRef, CreateComponentArg, EmitLogArg, InvokeResult, LogLevel},
+    auth::OwnerRule,
     component::ComponentManager,
     context::Context,
     get_context,
     models::ComponentAddress,
-    prelude::AccessRules,
+    prelude::ComponentAccessRules,
     Hash,
 };
 
@@ -52,7 +53,8 @@ impl TariEngine {
     pub fn create_component<T: Serialize>(
         &self,
         initial_state: T,
-        access_rules: AccessRules,
+        owner_rule: OwnerRule,
+        access_rules: ComponentAccessRules,
         component_id: Option<Hash>,
     ) -> ComponentAddress {
         let encoded_state = encode(&initial_state).unwrap();
@@ -62,6 +64,7 @@ impl TariEngine {
             action: ComponentAction::Create,
             args: invoke_args![CreateComponentArg {
                 encoded_state,
+                owner_rule,
                 access_rules,
                 component_id,
             }],
diff --git a/dan_layer/template_lib/src/lib.rs b/dan_layer/template_lib/src/lib.rs
index 6a7c222468..de8e65dd94 100644
--- a/dan_layer/template_lib/src/lib.rs
+++ b/dan_layer/template_lib/src/lib.rs
@@ -75,3 +75,5 @@ pub mod workspace;
 
 #[macro_use]
 mod newtype_serde_macros;
+#[macro_use]
+pub mod macros;
diff --git a/dan_layer/template_lib/src/macros.rs b/dan_layer/template_lib/src/macros.rs
new file mode 100644
index 0000000000..8a897c2bb7
--- /dev/null
+++ b/dan_layer/template_lib/src/macros.rs
@@ -0,0 +1,14 @@
+//   Copyright 2023 The Tari Project
+//   SPDX-License-Identifier: BSD-3-Clause
+
+pub use tari_template_abi::call_debug;
+
+#[macro_export]
+macro_rules! debug {
+    ($fmt:expr) => {
+        $crate::macros::call_debug($fmt)
+    };
+    ($fmt:expr, $($args:tt)*) => {
+        $crate::macros::call_debug(format!($fmt, $($args)*))
+    };
+}
diff --git a/dan_layer/template_lib/src/models/binary_tag.rs b/dan_layer/template_lib/src/models/binary_tag.rs
index 556bba06ca..1c469378cd 100644
--- a/dan_layer/template_lib/src/models/binary_tag.rs
+++ b/dan_layer/template_lib/src/models/binary_tag.rs
@@ -32,6 +32,7 @@ pub enum BinaryTag {
     BucketId = 133,
     TransactionReceipt = 134,
     FeeClaim = 135,
+    ProofId = 136,
 }
 
 impl BinaryTag {
@@ -45,6 +46,7 @@ impl BinaryTag {
             133 => Some(Self::BucketId),
             134 => Some(Self::TransactionReceipt),
             135 => Some(Self::FeeClaim),
+            136 => Some(Self::ProofId),
             _ => None,
         }
     }
@@ -67,6 +69,9 @@ mod tests {
             BinaryTag::ResourceAddress,
             BinaryTag::VaultId,
             BinaryTag::BucketId,
+            BinaryTag::TransactionReceipt,
+            BinaryTag::FeeClaim,
+            BinaryTag::ProofId,
         ];
 
         for case in cases {
diff --git a/dan_layer/template_lib/src/models/mod.rs b/dan_layer/template_lib/src/models/mod.rs
index b90731eab1..9de583e427 100644
--- a/dan_layer/template_lib/src/models/mod.rs
+++ b/dan_layer/template_lib/src/models/mod.rs
@@ -50,6 +50,9 @@ pub use non_fungible::{NonFungible, NonFungibleAddress, NonFungibleAddressConten
 mod resource;
 pub use resource::ResourceAddress;
 
+mod proof;
+pub use proof::*;
+
 mod system;
 pub use system::SystemAddress;
 
diff --git a/dan_layer/template_lib/src/models/proof.rs b/dan_layer/template_lib/src/models/proof.rs
new file mode 100644
index 0000000000..b97ea261e5
--- /dev/null
+++ b/dan_layer/template_lib/src/models/proof.rs
@@ -0,0 +1,145 @@
+//  Copyright 2022. The Tari Project
+//
+//  Redistribution and use in source and binary forms, with or without modification, are permitted provided that the
+//  following conditions are met:
+//
+//  1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following
+//  disclaimer.
+//
+//  2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the
+//  following disclaimer in the documentation and/or other materials provided with the distribution.
+//
+//  3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote
+//  products derived from this software without specific prior written permission.
+//
+//  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES,
+//  INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+//  DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+//  SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+//  SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+//  WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
+//  USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+use serde::{Deserialize, Serialize};
+use tari_bor::BorTag;
+use tari_template_abi::{call_engine, rust::fmt, EngineOp};
+
+use crate::{
+    args::{InvokeResult, ProofAction, ProofInvokeArg, ProofRef},
+    models::{Amount, BinaryTag, ResourceAddress},
+    prelude::ResourceType,
+};
+
+const TAG: u64 = BinaryTag::ProofId.as_u64();
+
+#[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq, Ord, PartialOrd, Hash)]
+pub struct ProofId(BorTag<u32, TAG>);
+
+impl From<u32> for ProofId {
+    fn from(value: u32) -> Self {
+        Self(BorTag::new(value))
+    }
+}
+
+impl fmt::Display for ProofId {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(f, "ProofId({})", self.0.inner())
+    }
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(transparent)]
+pub struct Proof {
+    id: ProofId,
+}
+
+impl Proof {
+    pub const fn from_id(id: ProofId) -> Self {
+        Self { id }
+    }
+
+    pub fn id(&self) -> ProofId {
+        self.id
+    }
+
+    pub fn resource_address(&self) -> ResourceAddress {
+        let resp: InvokeResult = call_engine(EngineOp::ProofInvoke, &ProofInvokeArg {
+            proof_ref: ProofRef::Ref(self.id),
+            action: ProofAction::GetResourceAddress,
+            args: invoke_args![],
+        });
+
+        resp.decode()
+            .expect("Proof GetResourceAddress returned invalid resource address")
+    }
+
+    pub fn resource_type(&self) -> ResourceType {
+        let resp: InvokeResult = call_engine(EngineOp::ProofInvoke, &ProofInvokeArg {
+            proof_ref: ProofRef::Ref(self.id),
+            action: ProofAction::GetResourceType,
+            args: invoke_args![],
+        });
+
+        resp.decode()
+            .expect("Proof GetResourceType returned invalid resource type")
+    }
+
+    pub fn amount(&self) -> Amount {
+        let resp: InvokeResult = call_engine(EngineOp::ProofInvoke, &ProofInvokeArg {
+            proof_ref: ProofRef::Ref(self.id),
+            action: ProofAction::GetAmount,
+            args: invoke_args![],
+        });
+
+        resp.decode().expect("Proof GetAmount returned invalid amount")
+    }
+
+    pub fn authorize(&self) -> ProofAccess {
+        self.try_authorize().expect("Proof authorization failed")
+    }
+
+    /// Try to authorize the proof. If the proof cannot be authorized, this will return an error.
+    pub fn try_authorize(&self) -> Result<ProofAccess, NotAuthorized> {
+        let resp: InvokeResult = call_engine(EngineOp::ProofInvoke, &ProofInvokeArg {
+            proof_ref: ProofRef::Ref(self.id),
+            action: ProofAction::Authorize,
+            args: invoke_args![],
+        });
+
+        resp.decode::<Result<(), NotAuthorized>>()
+            .expect("Proof Access error")?;
+        Ok(ProofAccess { id: self.id })
+    }
+
+    /// Drop/destroy this proof
+    pub fn drop(self) {
+        let resp: InvokeResult = call_engine(EngineOp::ProofInvoke, &ProofInvokeArg {
+            proof_ref: ProofRef::Ref(self.id),
+            action: ProofAction::Drop,
+            args: invoke_args![],
+        });
+
+        resp.decode().expect("Proof drop error")
+    }
+}
+
+#[derive(Debug, Serialize, Deserialize)]
+pub struct NotAuthorized;
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct ProofAccess {
+    pub id: ProofId,
+}
+
+impl Drop for ProofAccess {
+    fn drop(&mut self) {
+        let resp: InvokeResult = call_engine(EngineOp::ProofInvoke, &ProofInvokeArg {
+            proof_ref: ProofRef::Ref(self.id),
+            action: ProofAction::DropAuthorize,
+            args: invoke_args![],
+        });
+
+        resp.decode()
+            .unwrap_or_else(|_| panic!("Drop failed for proof {}", self.id));
+    }
+}
diff --git a/dan_layer/template_lib/src/models/vault.rs b/dan_layer/template_lib/src/models/vault.rs
index 8465e1d815..a246930b15 100644
--- a/dan_layer/template_lib/src/models/vault.rs
+++ b/dan_layer/template_lib/src/models/vault.rs
@@ -20,7 +20,7 @@
 //  WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
 //  USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-use std::str::FromStr;
+use std::{collections::BTreeSet, str::FromStr};
 
 use serde::{Deserialize, Serialize};
 use tari_bor::BorTag;
@@ -33,12 +33,23 @@ use tari_template_abi::{
     EngineOp,
 };
 
-use super::BinaryTag;
+use super::{BinaryTag, Proof};
 use crate::{
-    args::{ConfidentialRevealArg, InvokeResult, PayFeeArg, VaultAction, VaultInvokeArg, VaultWithdrawArg},
+    args::{
+        ConfidentialRevealArg,
+        InvokeResult,
+        PayFeeArg,
+        VaultAction,
+        VaultCreateProofByFungibleAmountArg,
+        VaultCreateProofByNonFungiblesArg,
+        VaultInvokeArg,
+        VaultWithdrawArg,
+    },
     hash::HashParseError,
     models::{Amount, Bucket, ConfidentialWithdrawProof, NonFungibleId, ResourceAddress},
     newtype_struct_serde_impl,
+    prelude::ResourceType,
+    resource::ResourceManager,
     Hash,
 };
 
@@ -171,6 +182,10 @@ impl Vault {
         resp.decode().expect("failed to decode Bucket")
     }
 
+    pub fn withdraw_non_fungible(&mut self, id: NonFungibleId) -> Bucket {
+        self.withdraw_non_fungibles(Some(id))
+    }
+
     pub fn withdraw_non_fungibles<I: IntoIterator<Item = NonFungibleId>>(&mut self, ids: I) -> Bucket {
         let resp: InvokeResult = call_engine(EngineOp::VaultInvoke, &VaultInvokeArg {
             vault_ref: self.vault_ref(),
@@ -245,6 +260,10 @@ impl Vault {
             .expect("GetResourceAddress returned invalid resource address")
     }
 
+    pub fn resource_type(&self) -> ResourceType {
+        ResourceManager::get(self.resource_address()).resource_type()
+    }
+
     pub fn reveal_confidential(&mut self, proof: ConfidentialWithdrawProof) -> Bucket {
         let resp: InvokeResult = call_engine(EngineOp::VaultInvoke, &VaultInvokeArg {
             vault_ref: self.vault_ref(),
@@ -279,11 +298,41 @@ impl Vault {
         self.deposit(bucket);
     }
 
+    pub fn create_proof(&self) -> Proof {
+        let resp: InvokeResult = call_engine(EngineOp::VaultInvoke, &VaultInvokeArg {
+            vault_ref: self.vault_ref(),
+            action: VaultAction::CreateProofByResource,
+            args: invoke_args![],
+        });
+
+        resp.decode().expect("CreateProofOfResource failed")
+    }
+
+    pub fn create_proof_by_amount(&self, amount: Amount) -> Proof {
+        let resp: InvokeResult = call_engine(EngineOp::VaultInvoke, &VaultInvokeArg {
+            vault_ref: self.vault_ref(),
+            action: VaultAction::CreateProofByFungibleAmount,
+            args: invoke_args![VaultCreateProofByFungibleAmountArg { amount }],
+        });
+
+        resp.decode().expect("CreateProofByFungibleAmount failed")
+    }
+
+    pub fn create_proof_by_non_fungible_ids(&self, ids: BTreeSet<NonFungibleId>) -> Proof {
+        let resp: InvokeResult = call_engine(EngineOp::VaultInvoke, &VaultInvokeArg {
+            vault_ref: self.vault_ref(),
+            action: VaultAction::CreateProofByNonFungibles,
+            args: invoke_args![VaultCreateProofByNonFungiblesArg { ids }],
+        });
+
+        resp.decode().expect("CreateProofByNonFungibles failed")
+    }
+
     pub fn vault_id(&self) -> VaultId {
         self.vault_id
     }
 
-    pub fn vault_ref(&self) -> VaultRef {
+    fn vault_ref(&self) -> VaultRef {
         VaultRef::Ref(self.vault_id)
     }
 
diff --git a/dan_layer/template_lib/src/prelude.rs b/dan_layer/template_lib/src/prelude.rs
index 75bf6796ee..5d4220614a 100644
--- a/dan_layer/template_lib/src/prelude.rs
+++ b/dan_layer/template_lib/src/prelude.rs
@@ -22,20 +22,20 @@
 
 //! The prelude contains all the commonly used types and functions that are used. To use it, add the import `use
 //! tari_template_lib::prelude::*;`
+
 pub use tari_bor;
 #[cfg(feature = "macro")]
 pub use tari_template_macros::template;
 
 pub use crate::{
-    auth::{AccessRule, AccessRules, RestrictedAccessRule::*},
+    args,
+    auth::{ComponentAccessRules as AccessRules, RestrictedAccessRule::*, *},
     caller_context::CallerContext,
-    component::{
-        interface::{ComponentInstanceInterface, ComponentInterface},
-        ComponentManager,
-    },
+    component::{Component, ComponentManager},
     consensus::Consensus,
     constants::{CONFIDENTIAL_TARI_RESOURCE_ADDRESS, PUBLIC_IDENTITY_RESOURCE_ADDRESS},
     crypto::RistrettoPublicKeyBytes,
+    debug,
     events::emit_event,
     invoke_args,
     models::{
@@ -49,6 +49,8 @@ pub use crate::{
         NonFungible,
         NonFungibleAddress,
         NonFungibleId,
+        Proof,
+        ProofId,
         ResourceAddress,
         TemplateAddress,
         Vault,
diff --git a/dan_layer/template_lib/src/resource/builder/confidential.rs b/dan_layer/template_lib/src/resource/builder/confidential.rs
index 629a5636e1..979ffbf481 100644
--- a/dan_layer/template_lib/src/resource/builder/confidential.rs
+++ b/dan_layer/template_lib/src/resource/builder/confidential.rs
@@ -3,6 +3,7 @@
 
 use crate::{
     args::MintArg,
+    auth::{AccessRule, OwnerRule, ResourceAccessRules},
     models::{Bucket, Metadata, ResourceAddress},
     prelude::ConfidentialOutputProof,
     resource::{ResourceManager, ResourceType},
@@ -12,6 +13,8 @@ pub struct ConfidentialResourceBuilder {
     initial_supply_proof: Option<ConfidentialOutputProof>,
     token_symbol: String,
     metadata: Metadata,
+    access_rules: ResourceAccessRules,
+    owner_rule: OwnerRule,
 }
 
 impl ConfidentialResourceBuilder {
@@ -20,9 +23,41 @@ impl ConfidentialResourceBuilder {
             token_symbol: token_symbol.into(),
             initial_supply_proof: None,
             metadata: Metadata::new(),
+            access_rules: ResourceAccessRules::new(),
+            owner_rule: OwnerRule::default(),
         }
     }
 
+    pub fn with_owner_rule(mut self, rule: OwnerRule) -> Self {
+        self.owner_rule = rule;
+        self
+    }
+
+    pub fn with_access_rules(mut self, rules: ResourceAccessRules) -> Self {
+        self.access_rules = rules;
+        self
+    }
+
+    pub fn mintable(mut self, rule: AccessRule) -> Self {
+        self.access_rules = self.access_rules.mintable(rule);
+        self
+    }
+
+    pub fn burnable(mut self, rule: AccessRule) -> Self {
+        self.access_rules = self.access_rules.burnable(rule);
+        self
+    }
+
+    pub fn withdrawable(mut self, rule: AccessRule) -> Self {
+        self.access_rules = self.access_rules.withdrawable(rule);
+        self
+    }
+
+    pub fn depositable(mut self, rule: AccessRule) -> Self {
+        self.access_rules = self.access_rules.depositable(rule);
+        self
+    }
+
     pub fn add_metadata<K: Into<String>, V: Into<String>>(mut self, key: K, value: V) -> Self {
         self.metadata.insert(key, value);
         self
@@ -36,10 +71,16 @@ impl ConfidentialResourceBuilder {
     pub fn build(self) -> ResourceAddress {
         // TODO: Improve API
         assert!(
-            self.initial_supply_proof.is_some(),
-            "call build_bucket when initial supply set"
+            self.initial_supply_proof.is_none(),
+            "call build_bucket when initial supply is set"
+        );
+        let (address, _) = Self::build_internal(
+            self.owner_rule,
+            self.access_rules,
+            self.token_symbol,
+            self.metadata,
+            None,
         );
-        let (address, _) = Self::build_internal(self.token_symbol, self.metadata, None);
         address
     }
 
@@ -51,15 +92,30 @@ impl ConfidentialResourceBuilder {
             ),
         };
 
-        let (_, bucket) = Self::build_internal(self.token_symbol, self.metadata, Some(mint_args));
+        let (_, bucket) = Self::build_internal(
+            self.owner_rule,
+            self.access_rules,
+            self.token_symbol,
+            self.metadata,
+            Some(mint_args),
+        );
         bucket.expect("[build_bucket] Bucket not returned from system")
     }
 
     fn build_internal(
+        owner_rule: OwnerRule,
+        access_rules: ResourceAccessRules,
         token_symbol: String,
         metadata: Metadata,
         mint_args: Option<MintArg>,
     ) -> (ResourceAddress, Option<Bucket>) {
-        ResourceManager::new().create(ResourceType::Confidential, token_symbol, metadata, mint_args)
+        ResourceManager::new().create(
+            ResourceType::Confidential,
+            owner_rule,
+            access_rules,
+            token_symbol,
+            metadata,
+            mint_args,
+        )
     }
 }
diff --git a/dan_layer/template_lib/src/resource/builder/fungible.rs b/dan_layer/template_lib/src/resource/builder/fungible.rs
index ebfd597644..e9d45b4243 100644
--- a/dan_layer/template_lib/src/resource/builder/fungible.rs
+++ b/dan_layer/template_lib/src/resource/builder/fungible.rs
@@ -3,6 +3,7 @@
 
 use crate::{
     args::MintArg,
+    auth::{AccessRule, OwnerRule, ResourceAccessRules},
     models::{Amount, Bucket, Metadata, ResourceAddress},
     resource::{ResourceManager, ResourceType},
 };
@@ -10,6 +11,8 @@ use crate::{
 pub struct FungibleResourceBuilder {
     token_symbol: String,
     initial_supply: Amount,
+    owner_rule: OwnerRule,
+    access_rules: ResourceAccessRules,
     metadata: Metadata,
 }
 
@@ -18,10 +21,42 @@ impl FungibleResourceBuilder {
         Self {
             token_symbol: token_symbol.into(),
             initial_supply: Amount::zero(),
+            owner_rule: OwnerRule::default(),
+            access_rules: ResourceAccessRules::new(),
             metadata: Metadata::new(),
         }
     }
 
+    pub fn with_owner_rule(mut self, rule: OwnerRule) -> Self {
+        self.owner_rule = rule;
+        self
+    }
+
+    pub fn with_access_rules(mut self, rules: ResourceAccessRules) -> Self {
+        self.access_rules = rules;
+        self
+    }
+
+    pub fn mintable(mut self, rule: AccessRule) -> Self {
+        self.access_rules = self.access_rules.mintable(rule);
+        self
+    }
+
+    pub fn burnable(mut self, rule: AccessRule) -> Self {
+        self.access_rules = self.access_rules.burnable(rule);
+        self
+    }
+
+    pub fn withdrawable(mut self, rule: AccessRule) -> Self {
+        self.access_rules = self.access_rules.withdrawable(rule);
+        self
+    }
+
+    pub fn depositable(mut self, rule: AccessRule) -> Self {
+        self.access_rules = self.access_rules.depositable(rule);
+        self
+    }
+
     pub fn add_metadata<K: Into<String>, V: Into<String>>(mut self, key: K, value: V) -> Self {
         self.metadata.insert(key, value);
         self
@@ -38,7 +73,13 @@ impl FungibleResourceBuilder {
             self.initial_supply.is_zero(),
             "call build_bucket when initial supply set"
         );
-        let (address, _) = Self::build_internal(self.token_symbol, self.metadata, None);
+        let (address, _) = Self::build_internal(
+            self.token_symbol,
+            self.owner_rule,
+            self.access_rules,
+            self.metadata,
+            None,
+        );
         address
     }
 
@@ -47,15 +88,30 @@ impl FungibleResourceBuilder {
             amount: self.initial_supply,
         };
 
-        let (_, bucket) = Self::build_internal(self.token_symbol, self.metadata, Some(mint_args));
+        let (_, bucket) = Self::build_internal(
+            self.token_symbol,
+            self.owner_rule,
+            self.access_rules,
+            self.metadata,
+            Some(mint_args),
+        );
         bucket.expect("[build_bucket] Bucket not returned from system")
     }
 
     fn build_internal(
         token_symbol: String,
+        owner_rule: OwnerRule,
+        access_rules: ResourceAccessRules,
         metadata: Metadata,
         mint_args: Option<MintArg>,
     ) -> (ResourceAddress, Option<Bucket>) {
-        ResourceManager::new().create(ResourceType::Fungible, token_symbol, metadata, mint_args)
+        ResourceManager::new().create(
+            ResourceType::Fungible,
+            owner_rule,
+            access_rules,
+            token_symbol,
+            metadata,
+            mint_args,
+        )
     }
 }
diff --git a/dan_layer/template_lib/src/resource/builder/non_fungible.rs b/dan_layer/template_lib/src/resource/builder/non_fungible.rs
index 8ec4cf03b6..c040d989ff 100644
--- a/dan_layer/template_lib/src/resource/builder/non_fungible.rs
+++ b/dan_layer/template_lib/src/resource/builder/non_fungible.rs
@@ -7,13 +7,16 @@ use tari_template_abi::rust::{collections::HashMap, fmt, ops::RangeInclusive};
 
 use crate::{
     args::MintArg,
+    auth::{AccessRule, OwnerRule, ResourceAccessRules},
     models::{Bucket, Metadata, NonFungibleId, ResourceAddress},
     resource::{ResourceManager, ResourceType},
 };
 
 pub struct NonFungibleResourceBuilder {
     token_symbol: String,
+    owner_rule: OwnerRule,
     metadata: Metadata,
+    access_rules: ResourceAccessRules,
     tokens_ids: HashMap<NonFungibleId, (Vec<u8>, Vec<u8>)>,
 }
 
@@ -21,16 +24,63 @@ impl NonFungibleResourceBuilder {
     pub(super) fn new<S: Into<String>>(symbol: S) -> Self {
         Self {
             token_symbol: symbol.into(),
+            owner_rule: OwnerRule::default(),
             metadata: Metadata::new(),
+            access_rules: ResourceAccessRules::new(),
             tokens_ids: HashMap::new(),
         }
     }
 
+    pub fn with_owner_rule(mut self, rule: OwnerRule) -> Self {
+        self.owner_rule = rule;
+        self
+    }
+
+    pub fn with_access_rules(mut self, rules: ResourceAccessRules) -> Self {
+        self.access_rules = rules;
+        self
+    }
+
+    pub fn mintable(mut self, rule: AccessRule) -> Self {
+        self.access_rules = self.access_rules.mintable(rule);
+        self
+    }
+
+    pub fn burnable(mut self, rule: AccessRule) -> Self {
+        self.access_rules = self.access_rules.burnable(rule);
+        self
+    }
+
+    pub fn withdrawable(mut self, rule: AccessRule) -> Self {
+        self.access_rules = self.access_rules.withdrawable(rule);
+        self
+    }
+
+    pub fn depositable(mut self, rule: AccessRule) -> Self {
+        self.access_rules = self.access_rules.depositable(rule);
+        self
+    }
+
+    pub fn update_non_fungible_data(mut self, rule: AccessRule) -> Self {
+        self.access_rules = self.access_rules.update_non_fungible_data(rule);
+        self
+    }
+
     pub fn add_metadata<K: Into<String>, V: Into<String>>(mut self, key: K, value: V) -> Self {
         self.metadata.insert(key, value);
         self
     }
 
+    pub fn with_non_fungible<T, U>(mut self, id: NonFungibleId, data: &T, mutable: &U) -> Self
+    where
+        T: Serialize,
+        U: Serialize,
+    {
+        self.tokens_ids
+            .insert(id, (encode(data).unwrap(), encode(mutable).unwrap()));
+        self
+    }
+
     pub fn with_non_fungibles<'a, I, T, U>(mut self, tokens: I) -> Self
     where
         I: IntoIterator<Item = (NonFungibleId, (&'a T, &'a U))>,
@@ -58,7 +108,13 @@ impl NonFungibleResourceBuilder {
     pub fn build(self) -> ResourceAddress {
         // TODO: Improve API
         assert!(self.tokens_ids.is_empty(), "call build_bucket with initial tokens set");
-        let (address, _) = Self::build_internal(self.token_symbol, self.metadata, None);
+        let (address, _) = Self::build_internal(
+            self.token_symbol,
+            self.owner_rule,
+            self.access_rules,
+            self.metadata,
+            None,
+        );
         address
     }
 
@@ -67,15 +123,30 @@ impl NonFungibleResourceBuilder {
             tokens: self.tokens_ids,
         };
 
-        let (_, bucket) = Self::build_internal(self.token_symbol, self.metadata, Some(mint_args));
+        let (_, bucket) = Self::build_internal(
+            self.token_symbol,
+            self.owner_rule,
+            self.access_rules,
+            self.metadata,
+            Some(mint_args),
+        );
         bucket.expect("[build_bucket] Bucket not returned from system")
     }
 
     fn build_internal(
         token_symbol: String,
+        owner_rule: OwnerRule,
+        access_rules: ResourceAccessRules,
         metadata: Metadata,
         mint_args: Option<MintArg>,
     ) -> (ResourceAddress, Option<Bucket>) {
-        ResourceManager::new().create(ResourceType::NonFungible, token_symbol, metadata, mint_args)
+        ResourceManager::new().create(
+            ResourceType::NonFungible,
+            owner_rule,
+            access_rules,
+            token_symbol,
+            metadata,
+            mint_args,
+        )
     }
 }
diff --git a/dan_layer/template_lib/src/resource/manager.rs b/dan_layer/template_lib/src/resource/manager.rs
index 75e95f3846..a87886d40a 100644
--- a/dan_layer/template_lib/src/resource/manager.rs
+++ b/dan_layer/template_lib/src/resource/manager.rs
@@ -36,6 +36,7 @@ use crate::{
         ResourceRef,
         ResourceUpdateNonFungibleDataArg,
     },
+    auth::{OwnerRule, ResourceAccessRules},
     models::{Amount, Bucket, Metadata, NonFungible, NonFungibleId, ResourceAddress},
     prelude::ResourceType,
 };
@@ -78,6 +79,8 @@ impl ResourceManager {
     pub fn create(
         &mut self,
         resource_type: ResourceType,
+        owner_rule: OwnerRule,
+        access_rules: ResourceAccessRules,
         token_symbol: String,
         metadata: Metadata,
         mint_arg: Option<MintArg>,
@@ -87,6 +90,8 @@ impl ResourceManager {
             action: ResourceAction::Create,
             args: invoke_args![CreateResourceArg {
                 resource_type,
+                owner_rule,
+                access_rules,
                 token_symbol,
                 metadata,
                 mint_arg
@@ -176,7 +181,16 @@ impl ResourceManager {
             }],
         });
 
-        resp.decode()
-            .expect("[update_non_fungible_data] Failed to decode Amount")
+        resp.decode().expect("[update_non_fungible_data] Failed")
+    }
+
+    pub fn set_access_rules(&self, access_rules: ResourceAccessRules) {
+        let resp: InvokeResult = call_engine(EngineOp::ResourceInvoke, &ResourceInvokeArg {
+            resource_ref: self.expect_resource_address(),
+            action: ResourceAction::UpdateAccessRules,
+            args: invoke_args![access_rules],
+        });
+
+        resp.decode().expect("[set_access_rules] Failed")
     }
 }
diff --git a/dan_layer/template_lib/src/resource/mod.rs b/dan_layer/template_lib/src/resource/mod.rs
index 089d479842..9df5ba6e61 100644
--- a/dan_layer/template_lib/src/resource/mod.rs
+++ b/dan_layer/template_lib/src/resource/mod.rs
@@ -19,17 +19,28 @@
 //   SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
 //   WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
 //   USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
 mod builder;
-pub use builder::{ResourceBuilder, TOKEN_SYMBOL};
-
+pub use builder::*;
 mod manager;
-pub use manager::ResourceManager;
-use serde::{Deserialize, Serialize};
+pub use manager::*;
 
-#[derive(Clone, Copy, Debug, PartialEq, Serialize, Deserialize)]
+#[derive(Clone, Copy, Debug, PartialEq, serde::Serialize, serde::Deserialize)]
 pub enum ResourceType {
     Fungible,
     NonFungible,
     Confidential,
 }
+
+impl ResourceType {
+    pub fn is_fungible(&self) -> bool {
+        matches!(self, Self::Fungible)
+    }
+
+    pub fn is_non_fungible(&self) -> bool {
+        matches!(self, Self::NonFungible)
+    }
+
+    pub fn is_confidential(&self) -> bool {
+        matches!(self, Self::Confidential)
+    }
+}
diff --git a/dan_layer/template_lib/src/template/manager.rs b/dan_layer/template_lib/src/template/manager.rs
index 1f3c8bfd71..353413a7ae 100644
--- a/dan_layer/template_lib/src/template/manager.rs
+++ b/dan_layer/template_lib/src/template/manager.rs
@@ -24,7 +24,7 @@ use serde::de::DeserializeOwned;
 use tari_template_abi::{call_engine, EngineOp};
 
 use crate::{
-    args::{CallAction, CallFunctionArg, CallInvokeArg, InvokeResult},
+    args::{Arg, CallAction, CallFunctionArg, CallInvokeArg, InvokeResult},
     prelude::TemplateAddress,
 };
 
@@ -38,7 +38,7 @@ impl TemplateManager {
         Self { template_address }
     }
 
-    pub fn call<T: DeserializeOwned>(&self, function: String, args: Vec<Vec<u8>>) -> T {
+    pub fn call<T: DeserializeOwned>(&self, function: String, args: Vec<Arg>) -> T {
         self.call_internal(CallFunctionArg {
             template_address: self.template_address,
             function,
diff --git a/dan_layer/template_lib/src/template_dependencies.rs b/dan_layer/template_lib/src/template_dependencies.rs
index 6b21a0a55d..0030af752f 100644
--- a/dan_layer/template_lib/src/template_dependencies.rs
+++ b/dan_layer/template_lib/src/template_dependencies.rs
@@ -21,7 +21,7 @@
 //  USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 //! Public types that are available to all template authors.
-pub use tari_bor::{decode, decode_exact, encode_with_len, serde};
+pub use tari_bor::{decode, decode_exact, encode_with_len, from_value, serde};
 pub use tari_template_abi::{call_debug as debug, wrap_ptr, ArgDef, CallInfo, FunctionDef, TemplateDef, Type};
 
 pub use crate::{args::LogLevel, engine, get_context as context};
diff --git a/dan_layer/template_macros/src/template/definition.rs b/dan_layer/template_macros/src/template/definition.rs
index 5178a309e5..1945c234f1 100644
--- a/dan_layer/template_macros/src/template/definition.rs
+++ b/dan_layer/template_macros/src/template/definition.rs
@@ -27,8 +27,6 @@ use crate::template::ast::TemplateAst;
 
 pub fn generate_definition(ast: &TemplateAst) -> TokenStream {
     let template_mod_name = format_ident!("{}_template", ast.template_name);
-    let component_ident = ast.template_name.clone();
-    let component_wrapper_ident = format_ident!("{}Component", ast.template_name);
     let (_, items) = ast.module.content.as_ref().unwrap();
 
     quote! {
@@ -37,28 +35,6 @@ pub fn generate_definition(ast: &TemplateAst) -> TokenStream {
             use ::tari_template_lib::template_dependencies::*;
 
             #(#items)*
-
-            impl ::tari_template_lib::component::interface::ComponentInterface for #component_ident {
-                type Component = #component_wrapper_ident;
-
-                fn create_with_options(self, access_rules: ::tari_template_lib::auth::AccessRules, component_id: Option<::tari_template_lib::Hash>) -> Self::Component {
-                    let address = engine().create_component(self, access_rules, component_id);
-                    #component_wrapper_ident{ address }
-                }
-            }
-
-            #[derive(serde::Serialize, serde::Deserialize)]
-            #[serde(transparent, crate = "self::serde")]
-            pub struct #component_wrapper_ident {
-                address: tari_template_lib::models::ComponentAddress,
-            }
-
-            impl ::tari_template_lib::component::interface::ComponentInstanceInterface for #component_wrapper_ident {
-                fn set_access_rules(self, rules: tari_template_lib::auth::AccessRules) -> Self {
-                    engine().component_manager(self.address).set_access_rules(rules);
-                    self
-                }
-            }
         }
     }
 }
@@ -103,36 +79,33 @@ mod tests {
         let output = generate_definition(&ast);
 
         assert_code_eq(output, quote! {
-                   # [allow (non_snake_case)]
+        #[allow(non_snake_case)]
         pub mod Foo_template {
-            use :: tari_template_lib :: template_dependencies :: * ;
-            # [derive (Debug ,  serde :: Serialize , serde :: Deserialize)] # [serde (crate = "self::serde")] struct Foo { }
-            impl Foo { pub fn no_args_function () -> String { "Hello World!" . to_string () }
-                pub fn some_args_function (a : i8 , b : String) -> u32 { 1_u32 }
-                pub fn no_return_function () { }
-                pub fn constructor () -> Self { Self { } }
-                pub fn method (& self) { }
-                fn private_function () { }
-            }
-            impl :: tari_template_lib :: component :: interface :: ComponentInterface for Foo {
-                type Component = FooComponent ;
-                fn create_with_options (self , access_rules : :: tari_template_lib :: auth :: AccessRules , component_id : Option < :: tari_template_lib :: Hash > ) -> Self :: Component {
-                    let address = engine () . create_component (self , access_rules, component_id) ;
-                    FooComponent { address }
+            use ::tari_template_lib::template_dependencies::*;
+            #[derive(Debug, serde :: Serialize, serde :: Deserialize)]
+            #[serde(crate = "self::serde")]
+            struct Foo {}
+            impl Foo {
+                pub fn no_args_function() -> String {
+                    "Hello World!".to_string()
                 }
-            }
-            # [derive (serde :: Serialize , serde :: Deserialize)] # [serde (transparent , crate = "self::serde")]
-            pub struct FooComponent {
-                address : tari_template_lib :: models :: ComponentAddress ,
-            }
-            impl :: tari_template_lib :: component :: interface :: ComponentInstanceInterface for FooComponent {
-                fn set_access_rules (self , rules : tari_template_lib :: auth :: AccessRules) -> Self {
-                    engine () . component_manager (self . address) . set_access_rules (rules) ;
-                    self
+
+                pub fn some_args_function(a: i8, b: String) -> u32 {
+                    1_u32
                 }
+
+                pub fn no_return_function() {}
+
+                pub fn constructor() -> Self {
+                    Self {}
+                }
+
+                pub fn method(&self) {}
+
+                fn private_function() {}
             }
         }
-                });
+        });
     }
 
     fn assert_code_eq(a: TokenStream, b: TokenStream) {
diff --git a/dan_layer/template_macros/src/template/dispatcher.rs b/dan_layer/template_macros/src/template/dispatcher.rs
index 310bc56b28..f0b1c08816 100644
--- a/dan_layer/template_macros/src/template/dispatcher.rs
+++ b/dan_layer/template_macros/src/template/dispatcher.rs
@@ -34,7 +34,7 @@ pub fn generate_dispatcher(ast: &TemplateAst) -> Result<TokenStream> {
     let output = quote! {
         #[no_mangle]
         pub unsafe extern "C" fn #dispatcher_function_name(call_info: *mut u8, call_info_len: usize) -> *mut u8 {
-            use ::tari_template_lib::{template_dependencies::{decode_exact, encode_with_len, CallInfo, wrap_ptr},init_context, panic_hook::register_panic_hook};
+            use ::tari_template_lib::{template_dependencies::{decode_exact, from_value, encode_with_len, CallInfo, wrap_ptr},init_context, panic_hook::register_panic_hook};
 
             register_panic_hook();
 
@@ -97,7 +97,7 @@ fn get_function_block(template_ident: &Ident, ast: FunctionAst) -> Expr {
                 vec![
                     parse_quote! {
                     let component_address =
-                        decode_exact::<::tari_template_lib::models::ComponentAddress>(&call_info.args[#i])
+                        from_value::<::tari_template_lib::models::ComponentAddress>(&call_info.args[#i])
                         .unwrap_or_else(|e| panic!("failed to decode component instance for function '{}': {}",  #func_name, e));
                     },
                     parse_quote! {
@@ -112,14 +112,14 @@ fn get_function_block(template_ident: &Ident, ast: FunctionAst) -> Expr {
             TypeAst::Typed { type_path, .. } => {
                 args.push(parse_quote! { #arg_ident });
                 vec![parse_quote! {
-                    let #arg_ident = decode_exact::<#type_path>(&call_info.args[#i])
+                    let #arg_ident = from_value::<#type_path>(&call_info.args[#i])
                         .unwrap_or_else(|e| panic!("failed to decode argument at position {} for function '{}': {}", #i, #func_name, e));
                 }]
             },
             TypeAst::Tuple(tuple) => {
                 args.push(parse_quote! { #arg_ident });
                 vec![parse_quote! {
-                    let #arg_ident = decode_exact::<#tuple>(&call_info.args[#i])
+                    let #arg_ident = from_value::<#tuple>(&call_info.args[#i])
                         .unwrap_or_else(|e| panic!("failed to decode tuple argument at position {} for function '{}'.", #i, #func_name, e));
                 }]
             },
@@ -185,9 +185,9 @@ fn replace_self_in_single_value(type_path: &TypePath) -> Option<Stmt> {
     let type_ident = &type_path.path.segments[0].ident;
 
     if type_ident == "Self" {
-        // TODO: AccessRules - currently we allow all calls for functions that return Self.
+        // When we return self we use default rules - which only permit the owner of the component to call methods
         return Some(parse_quote! {
-            let rtn = engine().create_component(rtn, ::tari_template_lib::auth::AccessRules::with_default_allow(), None);
+            let rtn = engine().create_component(rtn, ::tari_template_lib::auth::OwnerRule::default(), ::tari_template_lib::auth::ComponentAccessRules::new(), None);
         });
     }
 
@@ -205,9 +205,9 @@ fn replace_self_in_tuple(type_tuple: &TypeTuple) -> Stmt {
                 let ident = path.path.segments[0].ident.clone();
                 let field_expr = build_tuple_field_expr("rtn".to_string(), i as u32);
                 if ident == "Self" {
-                    // TODO: AccessRules - currently we allow all calls for functions that return Self.
+                    // When we return self we use default rules - which only permit the owner of the component to call methods
                     parse_quote! {
-                        engine().create_component(#field_expr, ::tari_template_lib::auth::AccessRules::with_default_allow(), None)
+                        engine().create_component(#field_expr, ::tari_template_lib::auth::OwnerRule::default(), ::tari_template_lib::auth::ComponentAccessRules::new(), None)
                     }
                 } else {
                     field_expr
diff --git a/dan_layer/template_test_tooling/src/template_test.rs b/dan_layer/template_test_tooling/src/template_test.rs
index dec1723be0..7c5bf561df 100644
--- a/dan_layer/template_test_tooling/src/template_test.rs
+++ b/dan_layer/template_test_tooling/src/template_test.rs
@@ -5,13 +5,15 @@ use std::{
     collections::{HashMap, HashSet},
     path::Path,
     sync::Arc,
+    time::Instant,
 };
 
 use anyhow::anyhow;
 use serde::de::DeserializeOwned;
 use tari_bor::encode;
 use tari_crypto::{
-    ristretto::RistrettoSecretKey,
+    keys::PublicKey,
+    ristretto::{RistrettoPublicKey, RistrettoSecretKey},
     tari_utilities::{hex::Hex, ByteArray},
 };
 use tari_dan_common_types::crypto::create_key_pair;
@@ -31,7 +33,7 @@ use tari_dan_engine::{
     wasm::{compile::compile_template, LoadedWasmTemplate, WasmModule},
 };
 use tari_engine_types::{
-    commit_result::ExecuteResult,
+    commit_result::{ExecuteResult, RejectReason},
     component::{ComponentBody, ComponentHeader},
     hashing::template_hasher,
     instruction::Instruction,
@@ -44,9 +46,10 @@ use tari_template_builtin::{get_template_builtin, ACCOUNT_TEMPLATE_ADDRESS};
 use tari_template_lib::{
     args,
     args::Arg,
+    auth::OwnerRule,
     crypto::RistrettoPublicKeyBytes,
     models::{Amount, ComponentAddress, NonFungibleAddress, TemplateAddress},
-    prelude::{AccessRules, CONFIDENTIAL_TARI_RESOURCE_ADDRESS},
+    prelude::{ComponentAccessRules, CONFIDENTIAL_TARI_RESOURCE_ADDRESS},
     Hash,
 };
 use tari_transaction::{id_provider::IdProvider, Transaction};
@@ -62,6 +65,7 @@ pub struct TemplateTest {
     package: Arc<Package>,
     track_calls: TrackCallsModule,
     secret_key: RistrettoSecretKey,
+    public_key: RistrettoPublicKey,
     last_outputs: HashSet<SubstateAddress>,
     name_to_template: HashMap<String, TemplateAddress>,
     state_store: MemoryStateStore,
@@ -74,6 +78,7 @@ impl TemplateTest {
     pub fn new<I: IntoIterator<Item = P>, P: AsRef<Path>>(template_paths: I) -> Self {
         let secret_key =
             RistrettoSecretKey::from_hex("7e100429f979d37999f051e65b94734e206925e9346759fd73caafb2f3232578").unwrap();
+        let public_key = RistrettoPublicKey::from_secret_key(&secret_key);
 
         let mut name_to_template = HashMap::new();
         let mut builder = Package::builder();
@@ -105,7 +110,12 @@ impl TemplateTest {
         {
             let mut tx = state_store.write_access().unwrap();
             bootstrap_state(&mut tx).unwrap();
-            Self::initial_tari_faucet_supply(&mut tx, Amount::from(100_000), test_faucet_template_address);
+            Self::initial_tari_faucet_supply(
+                &mut tx,
+                &public_key,
+                Amount::from(100_000),
+                test_faucet_template_address,
+            );
             tx.commit().unwrap();
         }
 
@@ -115,6 +125,7 @@ impl TemplateTest {
         Self {
             package: Arc::new(package),
             track_calls: TrackCallsModule::new(),
+            public_key,
             secret_key,
             name_to_template,
             last_outputs: HashSet::new(),
@@ -127,16 +138,16 @@ impl TemplateTest {
 
     fn initial_tari_faucet_supply(
         tx: &mut MemoryWriteTransaction<'_>,
+        signer_public_key: &RistrettoPublicKey,
         initial_supply: Amount,
         test_faucet_template_address: TemplateAddress,
     ) {
         let id_provider = IdProvider::new(Hash::default(), 10);
         let vault_id = id_provider.new_vault_id().unwrap();
-        let vault = Vault::new(vault_id, ResourceContainer::Confidential {
-            address: CONFIDENTIAL_TARI_RESOURCE_ADDRESS,
-            commitments: Default::default(),
-            revealed_amount: initial_supply,
-        });
+        let vault = Vault::new(
+            vault_id,
+            ResourceContainer::confidential(CONFIDENTIAL_TARI_RESOURCE_ADDRESS, vec![], initial_supply),
+        );
         tx.set_state(&SubstateAddress::Vault(vault_id), Substate::new(0, vault))
             .unwrap();
 
@@ -154,7 +165,9 @@ impl TemplateTest {
             Substate::new(0, ComponentHeader {
                 template_address: test_faucet_template_address,
                 module_name: "TestFaucet".to_string(),
-                access_rules: AccessRules::with_default_allow(),
+                owner_key: RistrettoPublicKeyBytes::from_bytes(signer_public_key.as_bytes()).unwrap(),
+                owner_rule: OwnerRule::None,
+                access_rules: ComponentAccessRules::allow_all(),
                 state: ComponentBody { state },
             }),
         )
@@ -300,6 +313,14 @@ impl TemplateTest {
         }]
     }
 
+    pub fn get_test_proof_and_secret_key(&self) -> (NonFungibleAddress, RistrettoSecretKey) {
+        (self.get_test_proof(), self.secret_key.clone())
+    }
+
+    pub fn get_test_proof(&self) -> NonFungibleAddress {
+        NonFungibleAddress::from_public_key(RistrettoPublicKeyBytes::from_bytes(self.public_key.as_bytes()).unwrap())
+    }
+
     pub fn create_empty_account(&mut self) -> (ComponentAddress, NonFungibleAddress, RistrettoSecretKey) {
         let (owner_proof, secret_key) = self.create_owner_proof();
         let old_fail_fees = self.enable_fees;
@@ -313,22 +334,18 @@ impl TemplateTest {
         let (owner_proof, secret_key) = self.create_owner_proof();
         let old_fail_fees = self.enable_fees;
         self.enable_fees = false;
-        let result = self
-            .try_execute_and_commit(
-                Transaction::builder()
-                    .call_method(test_faucet_component(), "take_free_coins", args![])
-                    .put_last_instruction_output_on_workspace("bucket")
-                    .call_function(self.get_template_address("Account"), "create_with_bucket", args![
-                        &owner_proof,
-                        Workspace("bucket")
-                    ])
-                    .sign(&secret_key)
-                    .build(),
-                vec![owner_proof.clone()],
-            )
-            .unwrap();
-
-        result.expect_success();
+        let result = self.execute_expect_success(
+            Transaction::builder()
+                .call_method(test_faucet_component(), "take_free_coins", args![])
+                .put_last_instruction_output_on_workspace("bucket")
+                .call_function(self.get_template_address("Account"), "create_with_bucket", args![
+                    &owner_proof,
+                    Workspace("bucket")
+                ])
+                .sign(&secret_key)
+                .build(),
+            vec![owner_proof.clone()],
+        );
 
         let component = result.finalize.execution_results[2]
             .decode::<ComponentAddress>()
@@ -365,7 +382,7 @@ impl TemplateTest {
         transaction: Transaction,
         proofs: Vec<NonFungibleAddress>,
     ) -> Result<ExecuteResult, TransactionError> {
-        let mut modules: Vec<Arc<dyn RuntimeModule<Package>>> = vec![Arc::new(self.track_calls.clone())];
+        let mut modules: Vec<Arc<dyn RuntimeModule>> = vec![Arc::new(self.track_calls.clone())];
 
         if self.enable_fees {
             modules.push(Arc::new(FeeModule::new(0, self.fee_table.clone())));
@@ -382,10 +399,14 @@ impl TemplateTest {
             modules,
         );
 
+        let tx_id = *transaction.id();
+        eprintln!("START Transaction id = \"{}\"", tx_id);
+
         let result = processor.execute(transaction)?;
 
         if self.enable_fees {
             if let Some(ref fee) = result.fee_receipt {
+                eprintln!("Initial payment: {}", fee.total_allocated_fee_payments());
                 eprintln!("Fee: {}", fee.total_fees_charged());
                 eprintln!("Paid: {}", fee.total_fees_paid());
                 eprintln!("Refund: {}", fee.total_refunded());
@@ -396,19 +417,59 @@ impl TemplateTest {
             }
         }
 
+        let timer = Instant::now();
+        eprintln!("Finished Transaction \"{}\" in {:.2?}", tx_id, timer.elapsed());
+        eprintln!();
+
         Ok(result)
     }
 
-    pub fn try_execute_and_commit(
+    pub fn execute_and_commit_on_success(
         &mut self,
         transaction: Transaction,
         proofs: Vec<NonFungibleAddress>,
-    ) -> Result<ExecuteResult, TransactionError> {
-        let result = self.try_execute(transaction, proofs)?;
+    ) -> ExecuteResult {
+        let result = self.try_execute(transaction, proofs).unwrap();
         if let Some(diff) = result.finalize.result.accept() {
             self.commit_diff(diff);
         }
-        Ok(result)
+
+        result
+    }
+
+    /// Executes a transaction. Panics if the transaction is not finalized (fee transaction fails). Does not panic if
+    /// the main instructions fails (use execute_expect_success for that).
+    pub fn execute_expect_commit(
+        &mut self,
+        transaction: Transaction,
+        proofs: Vec<NonFungibleAddress>,
+    ) -> ExecuteResult {
+        let result = self.try_execute(transaction, proofs).unwrap();
+        let diff = result.expect_finalization_success();
+        self.commit_diff(diff);
+
+        result
+    }
+
+    /// Executes a transaction. Panics if the transaction fails.
+    pub fn execute_expect_success(
+        &mut self,
+        transaction: Transaction,
+        proofs: Vec<NonFungibleAddress>,
+    ) -> ExecuteResult {
+        let result = self.execute_expect_commit(transaction, proofs);
+        result.expect_success();
+        result
+    }
+
+    /// Executes a transaction. Panics if the transaction succeeds.
+    pub fn execute_expect_failure(
+        &mut self,
+        transaction: Transaction,
+        proofs: Vec<NonFungibleAddress>,
+    ) -> RejectReason {
+        let result = self.try_execute(transaction, proofs).unwrap();
+        result.expect_transaction_failure().clone()
     }
 
     pub fn execute_and_commit(
diff --git a/dan_layer/template_test_tooling/src/track_calls.rs b/dan_layer/template_test_tooling/src/track_calls.rs
index 5dba0d15ae..b97dfa2a2b 100644
--- a/dan_layer/template_test_tooling/src/track_calls.rs
+++ b/dan_layer/template_test_tooling/src/track_calls.rs
@@ -3,11 +3,7 @@
 
 use std::sync::{Arc, RwLock};
 
-use tari_dan_common_types::services::template_provider::TemplateProvider;
-use tari_dan_engine::{
-    packager::LoadedTemplate,
-    runtime::{RuntimeModule, RuntimeModuleError, StateTracker},
-};
+use tari_dan_engine::runtime::{RuntimeModule, RuntimeModuleError, StateTracker};
 
 #[derive(Debug, Clone)]
 pub struct TrackCallsModule {
@@ -30,14 +26,8 @@ impl TrackCallsModule {
     }
 }
 
-impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate>> RuntimeModule<TTemplateProvider>
-    for TrackCallsModule
-{
-    fn on_runtime_call(
-        &self,
-        _tracker: &StateTracker<TTemplateProvider>,
-        call: &'static str,
-    ) -> Result<(), RuntimeModuleError> {
+impl RuntimeModule for TrackCallsModule {
+    fn on_runtime_call(&self, _tracker: &StateTracker, call: &'static str) -> Result<(), RuntimeModuleError> {
         self.calls.write().unwrap().push(call);
         Ok(())
     }
diff --git a/dan_layer/transaction/src/builder.rs b/dan_layer/transaction/src/builder.rs
index 69cc5279e5..45974ab8eb 100644
--- a/dan_layer/transaction/src/builder.rs
+++ b/dan_layer/transaction/src/builder.rs
@@ -89,6 +89,10 @@ impl TransactionBuilder {
         })
     }
 
+    pub fn drop_all_proofs_in_workspace(self) -> Self {
+        self.add_instruction(Instruction::DropAllProofsInWorkspace)
+    }
+
     pub fn put_last_instruction_output_on_workspace<T: AsRef<[u8]>>(self, label: T) -> Self {
         self.add_instruction(Instruction::PutLastInstructionOutputOnWorkspace {
             key: label.as_ref().to_vec(),
diff --git a/dan_layer/transaction/src/id_provider.rs b/dan_layer/transaction/src/id_provider.rs
index 469aa94db4..cfb71d8aad 100644
--- a/dan_layer/transaction/src/id_provider.rs
+++ b/dan_layer/transaction/src/id_provider.rs
@@ -8,7 +8,7 @@ use tari_engine_types::{
     hashing::{hasher, EngineHashDomainLabel},
 };
 use tari_template_lib::{
-    models::{BucketId, ComponentAddress, ResourceAddress, TemplateAddress, VaultId},
+    models::{BucketId, ComponentAddress, ProofId, ResourceAddress, TemplateAddress, VaultId},
     Hash,
 };
 
@@ -93,6 +93,11 @@ impl IdProvider {
         self.bucket_id.fetch_add(1, std::sync::atomic::Ordering::Relaxed).into()
     }
 
+    pub fn new_proof_id(&self) -> ProofId {
+        // Proofs and buckets can share the same ID counter
+        self.bucket_id.fetch_add(1, std::sync::atomic::Ordering::Relaxed).into()
+    }
+
     pub fn new_uuid(&self) -> Result<[u8; 32], IdProviderError> {
         let n = self.uuid.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
         let id = hasher(EngineHashDomainLabel::UuidOutput)
diff --git a/dan_layer/validator_node_rpc/proto/transaction.proto b/dan_layer/validator_node_rpc/proto/transaction.proto
index 606ad7052f..6032165997 100644
--- a/dan_layer/validator_node_rpc/proto/transaction.proto
+++ b/dan_layer/validator_node_rpc/proto/transaction.proto
@@ -37,6 +37,7 @@ message Instruction {
     EMIT_LOG = 3;
     CLAIM_BURN = 4;
     CLAIM_VALIDATOR_FEES = 5;
+    DROP_ALL_PROOFS_IN_WORKSPACE = 6;
     CREATE_FREE_TEST_COINS = 101;
   }
   InstructionType instruction_type = 1;
diff --git a/dan_layer/validator_node_rpc/src/conversions/transaction.rs b/dan_layer/validator_node_rpc/src/conversions/transaction.rs
index 442a42ffb6..1d5dfc49ae 100644
--- a/dan_layer/validator_node_rpc/src/conversions/transaction.rs
+++ b/dan_layer/validator_node_rpc/src/conversions/transaction.rs
@@ -221,6 +221,7 @@ impl TryFrom<proto::transaction::Instruction> for Instruction {
                 validator_public_key: PublicKey::from_bytes(&request.claim_validator_fees_validator_public_key)
                     .map_err(|e| anyhow!("claim_validator_fees_validator_public_key: {}", e))?,
             },
+            InstructionType::DropAllProofsInWorkspace => Instruction::DropAllProofsInWorkspace,
             InstructionType::CreateFreeTestCoins => Instruction::CreateFreeTestCoins {
                 revealed_amount: request.create_free_test_coins_amount.try_into()?,
                 output: tari_bor::decode(&request.create_free_test_coins_output_blob)?,
@@ -273,6 +274,17 @@ impl From<Instruction> for proto::transaction::Instruction {
                 result.claim_burn_public_key = claim.public_key.to_vec();
                 result.claim_burn_withdraw_proof = claim.withdraw_proof.map(Into::into);
             },
+            Instruction::ClaimValidatorFees {
+                epoch,
+                validator_public_key,
+            } => {
+                result.instruction_type = InstructionType::ClaimValidatorFees as i32;
+                result.claim_validator_fees_epoch = epoch;
+                result.claim_validator_fees_validator_public_key = validator_public_key.to_vec();
+            },
+            Instruction::DropAllProofsInWorkspace => {
+                result.instruction_type = InstructionType::DropAllProofsInWorkspace as i32;
+            },
             // TODO: debugging feature should not be the default. Perhaps a better way to create faucet coins is to mint
             //       a faucet vault in the genesis state for dev networks and use faucet builtin template to withdraw
             //       funds.
@@ -286,14 +298,6 @@ impl From<Instruction> for proto::transaction::Instruction {
                     .map(|o| tari_bor::encode(&o).unwrap())
                     .unwrap_or_else(|| tari_bor::encode(&None::<ConfidentialOutput>).unwrap());
             },
-            Instruction::ClaimValidatorFees {
-                epoch,
-                validator_public_key,
-            } => {
-                result.instruction_type = InstructionType::ClaimValidatorFees as i32;
-                result.claim_validator_fees_epoch = epoch;
-                result.claim_validator_fees_validator_public_key = validator_public_key.to_vec();
-            },
         }
         result
     }
diff --git a/dan_layer/wallet/sdk/src/apis/confidential_outputs.rs b/dan_layer/wallet/sdk/src/apis/confidential_outputs.rs
index 78e8322a49..f878b4a7ac 100644
--- a/dan_layer/wallet/sdk/src/apis/confidential_outputs.rs
+++ b/dan_layer/wallet/sdk/src/apis/confidential_outputs.rs
@@ -160,11 +160,11 @@ impl<'a, TStore: WalletStore> ConfidentialOutputsApi<'a, TStore> {
         Ok(balance)
     }
 
-    pub fn verify_and_update_confidential_outputs(
+    pub fn verify_and_update_confidential_outputs<'i, I: IntoIterator<Item = &'i ConfidentialOutput>>(
         &self,
         account_addr: &SubstateAddress,
         vault_addr: &SubstateAddress,
-        outputs: Vec<&ConfidentialOutput>,
+        outputs: I,
     ) -> Result<(), ConfidentialOutputsApiError> {
         let account = self.accounts_api.get_account_by_address(account_addr)?;
         // We do not support changing of account key at this time
diff --git a/dan_layer/wallet/sdk/src/apis/substate.rs b/dan_layer/wallet/sdk/src/apis/substate.rs
index e30cf19d3c..d61413d81a 100644
--- a/dan_layer/wallet/sdk/src/apis/substate.rs
+++ b/dan_layer/wallet/sdk/src/apis/substate.rs
@@ -6,7 +6,7 @@ use std::collections::HashMap;
 use log::*;
 use tari_dan_common_types::optional::{IsNotFoundError, Optional};
 use tari_engine_types::{
-    indexed_value::{IndexedValue, IndexedValueVisitorError},
+    indexed_value::{IndexedValue, IndexedValueError},
     substate::{SubstateAddress, SubstateValue},
     transaction_receipt::TransactionReceiptAddress,
 };
@@ -218,7 +218,7 @@ pub enum SubstateApiError {
     #[error("Substate {address} does not exist")]
     SubstateDoesNotExist { address: SubstateAddress },
     #[error("ValueVisitorError: {0}")]
-    ValueVisitorError(#[from] IndexedValueVisitorError),
+    ValueVisitorError(#[from] IndexedValueError),
 }
 
 impl IsNotFoundError for SubstateApiError {
diff --git a/dan_layer/wallet/sdk/src/apis/transaction.rs b/dan_layer/wallet/sdk/src/apis/transaction.rs
index 3cb47baa4f..3c1776fd4f 100644
--- a/dan_layer/wallet/sdk/src/apis/transaction.rs
+++ b/dan_layer/wallet/sdk/src/apis/transaction.rs
@@ -6,7 +6,7 @@ use tari_common_types::types::PublicKey;
 use tari_dan_common_types::optional::{IsNotFoundError, Optional};
 use tari_engine_types::{
     commit_result::RejectReason,
-    indexed_value::{IndexedValue, IndexedValueVisitorError},
+    indexed_value::{IndexedValue, IndexedValueError},
     substate::SubstateDiff,
 };
 use tari_transaction::{SubstateRequirement, Transaction, TransactionId};
@@ -297,7 +297,7 @@ pub enum TransactionApiError {
     #[error("Network interface error: {0}")]
     NetworkInterfaceError(String),
     #[error("Failed to extract known type data from value: {0}")]
-    ValueVisitorError(#[from] IndexedValueVisitorError),
+    ValueVisitorError(#[from] IndexedValueError),
     #[error("Invalid transaction query response: {details}")]
     InvalidTransactionQueryResponse { details: String },
 }
diff --git a/integration_tests/src/templates/basic_nft/src/lib.rs b/integration_tests/src/templates/basic_nft/src/lib.rs
index 5cc65e82fb..5319e9f5d8 100644
--- a/integration_tests/src/templates/basic_nft/src/lib.rs
+++ b/integration_tests/src/templates/basic_nft/src/lib.rs
@@ -29,30 +29,43 @@ pub struct Sparkle {
 #[template]
 mod sparkle_nft_template {
     use super::*;
-
     pub struct SparkleNft {
         resource_address: ResourceAddress,
         vault: Vault,
     }
 
     impl SparkleNft {
-        pub fn new() -> Self {
-            let resource_address = ResourceBuilder::non_fungible("SPKL").build();
+        pub fn new() -> Component<Self> {
+            let resource_address = ResourceBuilder::non_fungible("SPKL")
+                // AllowAll makes testing easier
+                .mintable(AccessRule::AllowAll)
+                .burnable(AccessRule::AllowAll)
+                .build();
             let vault = Vault::new_empty(resource_address);
 
-            Self { resource_address, vault }
+            Component::new(Self {
+                resource_address,
+                vault,
+            })
+            .with_access_rules(AccessRules::allow_all())
+            .create()
         }
 
-        pub fn new_with_initial_nft(nft: NonFungibleId) -> Self {
+        pub fn new_with_initial_nft(nft: NonFungibleId) -> Component<Self> {
             let empty = Metadata::new();
             let bucket = ResourceBuilder::non_fungible("SPKL")
                 .with_non_fungibles(Some((nft, (&(), &empty))))
+                // AllowAll makes testing easier
+                .mintable(AccessRule::AllowAll)
+                .burnable(AccessRule::AllowAll)
                 .build_bucket();
 
-            Self {
+            Component::new(Self {
                 resource_address: bucket.resource_address(),
                 vault: Vault::from_bucket(bucket),
-            }
+            })
+            .with_access_rules(AccessRules::allow_all())
+            .create()
         }
 
         pub fn take_initial_nft(&mut self) -> Bucket {
@@ -66,7 +79,7 @@ mod sparkle_nft_template {
         }
 
         pub fn mint_specific(&mut self, id: NonFungibleId, name: String, url: String) -> Bucket {
-            debug(format!("Minting {}", id));
+            debug!("Minting {}", id);
             // These are characteristic of the NFT and are immutable
             let mut immutable_data = Metadata::new();
             immutable_data.insert("name", name).insert("image_url", url);
@@ -81,7 +94,7 @@ mod sparkle_nft_template {
         }
 
         pub fn inc_brightness(&mut self, id: NonFungibleId, brightness: u32) {
-            debug(format!("Increase brightness on {} by {}", id, brightness));
+            debug!("Increase brightness on {} by {}", id, brightness);
             self.with_sparkle_mut(id, |data| {
                 data.brightness = data.brightness.checked_add(brightness).expect("Brightness overflow");
             });
diff --git a/integration_tests/src/templates/counter/src/lib.rs b/integration_tests/src/templates/counter/src/lib.rs
index 686a5ea52c..867c640a0e 100644
--- a/integration_tests/src/templates/counter/src/lib.rs
+++ b/integration_tests/src/templates/counter/src/lib.rs
@@ -24,13 +24,17 @@ use tari_template_lib::prelude::*;
 
 #[template]
 mod counter {
+    use super::*;
+
     pub struct Counter {
         value: u32,
     }
 
     impl Counter {
-        pub fn new() -> Self {
-            Self { value: 0 }
+        pub fn new() -> Component<Self> {
+            Component::new(Self { value: 0 })
+                .with_access_rules(AccessRules::allow_all())
+                .create()
         }
 
         pub fn value(&self) -> u32 {
diff --git a/integration_tests/src/templates/faucet/src/lib.rs b/integration_tests/src/templates/faucet/src/lib.rs
index 3d35712e3b..6baef04c08 100644
--- a/integration_tests/src/templates/faucet/src/lib.rs
+++ b/integration_tests/src/templates/faucet/src/lib.rs
@@ -31,14 +31,16 @@ mod faucet_template {
     }
 
     impl TestFaucet {
-        pub fn mint(initial_supply: Amount) -> Self {
+        pub fn mint(initial_supply: Amount) -> Component<Self> {
             let coins = ResourceBuilder::fungible("test")
                 .initial_supply(initial_supply)
                 .build_bucket();
 
-            Self {
+            Component::new(Self {
                 vault: Vault::from_bucket(coins),
-            }
+            })
+            .with_access_rules(AccessRules::allow_all())
+            .create()
         }
 
         pub fn take_free_coins(&mut self) -> Bucket {
diff --git a/integration_tests/tests/features/nft.feature b/integration_tests/tests/features/nft.feature
index ca1f1a8dd7..1a6c60e66d 100644
--- a/integration_tests/tests/features/nft.feature
+++ b/integration_tests/tests/features/nft.feature
@@ -31,13 +31,13 @@ Feature: NFTs
     # A file-base CLI account must be created to sign future calls
     When I use an account key named K1
 
-    # Create a new BasicNft component
-    When I call function "new" on template "basic_nft" on VN named "NFT"
-
     # Create an account to deposit the minted nfts
     When I create an account ACC1 on VN
     When I create an account ACC2 on VN
 
+    # Create a new BasicNft component
+    When I call function "new" on template "basic_nft" on VN named "NFT"
+
     # Submit a transaction with NFT operations
     When I submit a transaction manifest on VN with inputs "NFT, ACC1, ACC2" named "TX1" signed with key ACC1
     ```