Roles & Permissions
Access control in The Vault is permission-based. Each role is a named set of
granular permissions (e.g. view_wallet, create_master_key, create_policy,
export_logs, block_device), and a user can hold one or more roles per
profile. What a user sees and can do in the dashboard is derived from the union
of their roles’ permissions.
Built-in Roles
| Role | Purpose |
|---|---|
| Admin | Full access — all permissions, including user and role management, device approval, policy management, and system settings. |
| Finance Manager | Policy-focused: create, view, and delete approval policies; view wallets and the address whitelist. |
| Viewer | Read-only access across wallets, operations, policies, users, and logs. Useful for auditors, accountants, or board observers. |
Roles are assigned from Settings → Users → Assign Roles — a user can hold multiple roles, and the effective permission set is the union. Use Show Privileges on a user to inspect exactly what they can do.
Approvers Are Not a Role
Transaction approval rights come from enrolled mobile signer devices and the approval requirements configured in policies, not from a dashboard role. A user approves transfers from their paired mobile device because a policy requires N approvals — regardless of which dashboard role they hold.
Wallet-Group Scoping
Beyond roles, users can be scoped to wallet groups (Settings → Users → Assign Wallet Groups): a user only sees and operates on wallets in the groups they are assigned to. This is how per-team or per-desk separation is achieved.
Blocking Users
Users are blocked rather than deleted: blocking sets the account inactive, terminates sessions, and preserves the user’s identity in the audit trail. Unblocking restores access. See Inviting Users.