can_call uses a typed action; can_call_fn uses a function symbol. Each returns (allowed, tokens_in, tokens_out). validate_tokens_in checks a supplied list against Registry. Admin can change Registry and upgrade WASM.
The facade remains available as a policy interface. AccountManager’s current exec implementation optimizes the transaction budget by reading Registry.get_exec_gate and calling the controller directly, so an architecture diagram must not require the facade in every execution.
Function signatures
These signatures are copied from the reviewed Rust implementation.env is supplied by Soroban and is not a transaction argument. Result errors and panics must be handled by the caller; simulation does not guarantee later execution. Public methods include privileged and internal-contract callbacks, not just user entrypoints.
__constructor
can_call
can_call_fn
validate_tokens_in
get_registry
set_registry
upgrade
Source reference
Protocol_V1_Soroban_testnet/contracts/ControllerFacadeContract/src/facade.rs

