Help needed; how can we enforce rules like m of n controllers can have access to a DID?

Hi everyone,

We are from Hypersign <https://hid-explorer.netlify.app/explorer/dids>  based out of Bangalore, India, building public VDR to manage DIDs.  This network is built using cosmos sdk.  We have been researching on DIDs for quite sometime but still facing issues in applying to some of the use cases we came across. It would be very helpful is someone one clarifies our confusion. 

So,

What we know is the following:

1. If there is no controller present in the `controller[]` of didDoc, then DID subject has the access of that DIDdoc
[
10:20
]
2. If there is 1 controller (not necessarily DID subject), then it will have access of that DIDdoc
3. If there are more than 1 controllers, then all of them individually have access of that DIDdoc - each one of them can modify that DIDdoc.

What we do not know is as follows:

1. We don't know how we can specify rules like m of n controllers can have access of a DIDdoc?
[10:22]
2. How can we enforce that we need signatures of 2 out of 3 controller present in didDoc in order to update it?
3. In my view, these rules needs to be specified in on-chain since there is trust associated with it, if that is the case then how can we do that in DIDDoc? 


---

Thanks & Regards,

Vishwas