Roles and permissions

A role is a named set of permissions. When you assign a role to a user in a workspace, that user receives all permissions included in that role. A user can hold different roles in different workspaces.

Permissions are granular. Each permission controls a specific category of action: initiating a movement, signing a movement, managing users, viewing balances, and so on. You build roles by selecting the permissions that match the responsibilities of each position in your organisation.

There are 11 named permissions in SQRL. See the Permission reference for the complete list.

#The Owner role

The Owner role is created automatically when the organisation is set up. It has unrestricted access to every operation and bypasses all permission checks. The Owner is responsible for initial setup: creating workspaces, inviting the first users, and establishing the role structure.

The Owner role cannot be created, modified, or assigned manually. It exists at the organisation level, and there is one Owner per organisation by design.

#Standard role starting points

SQRL ships with several suggested role configurations to help you get started. These are starting points, not fixed system roles. You can modify their permissions, rename them, or replace them entirely.

• Admin. Day-to-day workspace administration. Suggested permissions: Manage Workspace, Manage Users, Manage Roles, Manage Permissions, Create Workspace, View Balances, View Logs. An Admin typically handles workspace configuration, user onboarding, vault setup, and token deployment.
• Approver. Movement and deployment signing. Suggested permissions: Approve Payment, View Balances. An Approver reviews pending movements and provides their cryptographic signature. They do not initiate movements.
• Initiator. Movement creation. Suggested permissions: Initiate Payment, View Balances. An Initiator creates movement requests that others sign. In some configurations you may combine the Initiator and Approver permissions into a single role.
• Auditor. Read-only monitoring. Suggested permissions: View Balances, View Logs. An Auditor reviews audit logs and vault balances. They cannot initiate, sign, or modify anything.

#Creating a custom role

Required role: Owner, or a role with the Manage Roles permission.

Required permissions: MANAGE_ROLE

Prerequisites: You must be in the workspace where you want to create the role.

1. Navigate to the Users page.
2. Open the role management area.
3. Select the option to create a new role.
4. Enter a name for the role.
5. Select the permissions to include. See the Permission reference for a description of each permission.
6. Save the role.

What happens next: The role is available for assignment to users in this workspace. Roles are workspace-scoped. The role does not exist in other workspaces.

#Assigning permissions to a role

Required role: Owner, or a role with the Manage Permissions permission.

Required permissions: MANAGE_PERMS

You can modify the permissions assigned to any custom role at any time. Changes take effect for all users who hold that role in the workspace.

1. Navigate to the Users page.
2. Open the role management area.
3. Select the role you want to edit.
4. Add or remove permissions as needed.
5. Save your changes.