Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Roles

Create the named roles your workflow needs, control how many wallets each can hold, and see at a glance which roles are missing signers, permissions or gates.

Where: Account → ON-CHAIN ACCESS → Roles · You need: owner wallet connected

Roles page with Create role button and a table of five roles showing Role, Role ID, Signers and Actions columns, with AUDITOR flagged as having no actions
Five roles on a configured account. The padlock marks the two protected roles fixed at deploy. AUDITOR (1) carries a warning because it holds no actions, and the Signers column shows how close each role is to its wallet limit.

Protected and custom roles

Every account has three protected roles: Owner, Broadcaster and Recovery. They are created at deploy, cannot be renamed or removed, and their members are edited in Security. Their drawer reads "On-chain access for this system role. Members are managed in Security."

Custom roles are yours: Operator, Approver, Treasurer, whatever your process needs. You choose the name, the wallet limit, the members and the permissions.

Create a role

  1. Click Create role.

  2. Enter a Role name. It is stored on-chain and shown everywhere in the Platform; keep it short and unambiguous.

  3. Set Max wallets, the most addresses that may hold this role at once. Pick the smallest number that fits; you can raise it later.

  4. Confirm. The role is added to a pending batch that you then Sign and Execute (see Signers).

A new role has no signers, no permissions and no gates. It does nothing until you configure it.

The table

Column
Meaning

Role

Name, with a Gates gap link when the role has permissions whose gate is not granted. The link opens Gates.

Role ID

The on-chain hash that identifies the role, with a copy control. Developers use it with the SDK.

Signers

n / max: current members over the wallet limit

Actions

How many actions this role has at least one permission on

The header pill counts roles that "need gates". Two checkboxes filter the list:

  • No signers: roles with permissions but nobody holding them. Add members on Signers.

  • No actions: roles with members but no permissions. Assign steps under Manage permissions.

The role drawer

Role drawer for a custom role named Operator with Signers and Actions segments and buttons to manage signers, manage permissions and remove the role
A custom role, opened. Signers is who holds it; Actions is what they may do with it. Remove role is available here because the role is custom: the two protected roles cannot be removed.

Click a row.

  • Signers lists the members. Manage role signers adds or removes addresses.

  • Actions lists the steps this role may perform, per action and path. Manage role permissions opens the same editor as Actions → Manage permissions, scoped to this role.

  • Remove role deletes the custom role. It also removes all its members and, because gates are bound to roles, clears every gate the role held. This is the only way to clear a gate.

Permanent grants

Some actions cannot have a permission revoked once granted; the Platform labels these permanent grants. Removing the role is the only way to withdraw them. Before you grant a permanent step to a role, be sure the role's membership rules are what you want.

Deleting a role

  1. Remove or reassign its signers so nobody loses access unexpectedly.

  2. Open the drawer and click Remove role.

  3. Sign and execute the batch.

Pending requests raised under that role are not cancelled by removing it; approvers should clear them first.

Related

PreviousSigners
NextPolicies

Last updated

Was this helpful?