The token is the key.

A Broker is an ERC-721. Its account is an ERC-6551 contract that treats the token's current owner as its only authority. Understanding that one relationship explains everything else in the protocol.

The pair

Two things exist for every Broker: the token, which is what you hold and trade, and the account, which is what actually holds the portfolio. They are permanently bound. A Broker cannot be pointed at a different account, and an account cannot be reassigned to a different Broker.

A deterministic address

The account address is derived from five inputs: the registry, the account implementation, a salt, the chain id, the token contract and the token id. Nothing about it is stored or assigned, so it can be computed by anyone at any time, including before the account has any code.

Two consequences follow. An account can receive assets before it is deployed, because an address does not need code to hold a balance. And deployment is idempotent: calling createAccount against an already-deployed account returns the existing address instead of reverting.

Deployment only matters when the account needs to act — signing a stock desk purchase, for instance. Receiving assets never requires it.

Where authority comes from

The account has no private key and no admin role. When a call arrives it asks the token contract who currently owns the Broker, and it accepts the call only from that address:

function owner() view returns (address) {
    return IERC721(tokenContract).ownerOf(tokenId);
}

Because that lookup happens at call time rather than being cached at deployment, control follows the token automatically. A sale needs no migration step and the account never learns that a sale happened, which is why control transfers in the same block as the token.

What the account can do

The owner drives the account through a single entry point. execute takes a target, a value, a calldata payload and an operation type, and returns whatever the call returned:

function execute(address to, uint256 value, bytes calldata data, uint8 op)
    payable returns (bytes memory)

That is enough to buy an hStock, approve a token, or forward ETH — the account is a general purpose executor whose permission check happens to be an ownerOf call.

Limits worth knowing

• Approvals outlive sales. A token approval granted from inside the account stays valid after the Broker changes hands. Revoke before selling.
• The account is not a vault. The owner can move anything out of it at any time. Buying a Broker for its portfolio means checking the portfolio is still there in the same block.
• A pledged Broker is still yours to use. Drawing credit does not freeze the account, so collateral value can be removed while a loan is open. The credit desk prices that risk through the tier limits.
• Nested ownership is possible. Nothing stops one Broker's account from holding another Broker. The protocol does not special-case it.