Users & Access
The Vault governs what each user can see and do through permission-based roles: every role is a named set of granular permissions, and a user can hold one or more roles per profile. Wallet-group assignments additionally scope which wallets a user can access.
Authentication and session management are handled by The Vault’s identity provider, with an Identity-Aware Proxy (IAP) acting as the decision point in front of the API gateway. Permissions are enforced on every request before any backend service is reached.
Roles Summary
| Role | Description |
|---|---|
| Admin | Full access — users, roles, wallets, policies, devices, and settings. |
| Finance Manager | Policy management — create, view, and delete approval policies; view wallets and the address whitelist. |
| Viewer | Read-only access to wallets, operations, policies, users, and logs. |
Approval rights are separate from dashboard roles. A user approves transfers because they have an enrolled mobile signer device and a policy requires approvals — not because of a role. See Approval Flows.
Identity Provider
The Vault includes a built-in identity provider that manages:
- User registration and invitation flows
- Password storage (industry-standard hashing)
- Session management (short-lived sessions with step-up for sensitive operations)
- Second-factor login (email one-time code by default, optional TOTP)
- Account recovery via email magic links
All identity operations are handled internally — The Vault does not rely on external OAuth providers.
Zero-Trust Authorization
Every API request passes through the Identity-Aware Proxy before reaching any backend service. The proxy:
- Validates the session or API key.
- Checks the user’s permissions against the requested operation.
- Enriches the request with verified identity headers before forwarding to the backend.
Backend services trust these headers but never perform their own authentication — they rely entirely on the proxy layer having already verified identity. This decoupling ensures that authentication logic is centralized and consistently applied across all services.