Hi @AndreaReguzzoni
Creating a permissioned ASA is really easy: you just need to specify the DefaultFrozen property as True on asset create.
Once the Frozen ASA is on the ledger you can give “permissions” to specific accounts to enable them in transacting (both sending and receiving) that ASA.
You can follow this example to learn how to manage Freeze/Unfreeze operation through SDKs.
On the other topic: permissioning on Smart Contract is something you have to define with your custom rules/policies by leveraging users’ local states in the Smart Contract, for example: you can have a key/value pair KYC local variable that is initialised as False on users’ opt-in. This key/value pair could maybe updated just by a specific account (the KYC provider) or another Smart Contract (acting like a decentralised credential verifier).