# Roles & Permissions

Owner, admin, operator, developer, viewer — five roles, around fifty granular permissions, no
super-admin bypass.

Digital-asset operations fail at the seam between people and keys: one account that can do
everything, shared credentials, an auditor with write access because read-only was inconvenient.
Vaultody ships five roles with additive permissions, and signing power comes from holding a key
share rather than from a role checkbox — so access control and custody control reinforce each
other instead of blurring.

## Separation of duties, by default

- **Initiating and approving are different permissions** — operations raises, finance approves.
- **Read access is genuinely read-only** — a viewer sees the full picture and can sign nothing:
  the auditor seat with no attack surface.
- **Developers integrate without spending** — API integration rights are separate from transfer
  rights, so an engineer can ship without being able to move funds.
- **Additive, not deny-override** — roles are permission sets, so there are no inherited
  surprises, and owner and admin are themselves permission-bound.
- **Role changes are approval-gated** — promoting someone is a governed action, recorded like any
  other sensitive change.

## FAQ

**Someone leaves the company. What do we do?**
Revoke the role, and if they held a key share, run a reshare ceremony. Key material never travels
with people, and addresses never change.

**Can we define our own roles?**
The five roles with granular permissions cover the practical shapes; custom composition is an
Enterprise conversation.

## Related

- [Policy Engine](/features/policy-engine)
- [Audit Trail](/features/audit-trail)
- [Key Shards & Recovery](/features/key-shards-and-recovery)
- [Enterprise](/enterprise)