Roles and permissions

See the Permission reference for every permission and what it allows.

#Default roles

Every workspace starts with these roles. Apart from Owner, you can change their permissions or replace them.

• Owner. Every permission in the workspace.
• Admin. Every permission except Owner. Day-to-day workspace administration.
• Initiator. Initiate movement and View balances. Creates transfers for others to sign.
• Minter. Mint tokens and View balances. Issues new tokens within the supply cap and the vault's limit.
• Burner. Burn tokens and View balances. Destroys tokens on redemption and executes clawbacks a compliance officer requests.
• Pauser. Pause tokens and View balances. Halts and resumes an asset.
• Compliance officer. Manage compliance, View balances and View logs. Manages whitelists and the Address Book, screens, freezes and releases, and requests clawbacks. May not mint or burn.

#Maker-checker

Every asset action and movement is maker-checker. The operator who proposes an action cannot be one of the signers who approves it, so no single person can both propose and complete a mint, a burn, a freeze or a clawback.

#Creating a role

Required permissions: Manage permissions (MANAGE_USER_PERMS).

1. Open Policies and select the Roles & Permissions tab.
2. Select Add role.
3. Enter a name and a description.
4. Set the role's Transaction limit (Tokens) and its cycle. See Vault policies.
5. Select the permissions to include.
6. Save the role.

The role is available in this workspace only.

#Changing a role's permissions

Required permissions: Manage policies (MANAGE_ROLES).

1. Open Policies › Roles & Permissions.
2. Select Edit permissions on the role.
3. Add or remove permissions and save.