Roles65 editable
Permissions23across 5 areas
Irreversible6money, credentials, authority
Need two signatures2master admin excepted
What each role may do
One list, six presets over it
| Permission | Reach | Master admin | Fleet ops | Finance | Commercial | Compliance | Read-only |
|---|---|---|---|---|---|---|---|
| Fleet | |||||||
See the fleet fleet.view Hosts, terminals, accounts, brokers, symbols, proxies and capacity, read-only. | Read | — | |||||
Create and edit hosts fleet.host.manage Add a host record, mint its enrolment token, edit its agent address. | Changes things | — | — | — | — | ||
Drain a host fleet.host.drain Stop placements on a host and reassign its terminals. | Changes things | — | — | — | — | ||
Restart and move terminals fleet.terminal.manage Restart a terminal process or move it to another host. | Changes things | — | — | — | — | ||
Replace an account credential fleet.credential.set Write a new password for a broker account and dispatch it to a host. Write-only in both directions — this never reveals the stored value. | Irreversible | — | — | — | — | — | |
File brokers, servers and endpoints fleet.broker.write Add or edit a broker, a server, or the addresses a terminal dials. | Changes things | — | — | — | — | ||
Author the symbol registry fleet.symbol.write Create canonical symbols and edit any broker profile. | Changes things | — | — | — | — | ||
| Commercial | |||||||
See the commercial pages commercial.view Tenants, products, the approval queue, distribution, providers and plans. | Read | — | |||||
Change a tenant commercial.tenant.write Edit a tenant, suspend one, or regenerate its API key. | Changes things | — | — | — | — | ||
Approve or reject a product commercial.product.approve Decide the approval queue, including approving against a failed handshake. | Changes things | — | — | — | — | ||
Edit plans and provider shares commercial.plan.write Change what a plan costs and what share a provider is paid. | Changes things | — | — | — | — | ||
| Money | |||||||
See the money pages money.view Wallets, transactions, payouts and reconciliation, read-only. | Read | — | |||||
Adjust a wallet money.wallet.adjust Credit or debit any wallet by hand. The one money route that passes through no payment provider and no KYC check. | Irreversible Two signatures | — | — | — | — | ||
Approve a payout money.payout.approve Release a withdrawal to a tenant or a provider. Irreversible once sent. | Irreversible Two signatures | — | — | — | — | ||
Acknowledge a reconciliation difference money.recon.ack Record that a person looked at a difference. Does not make it balance. | Changes things | — | — | — | — | ||
| Governance | |||||||
Read the audit trail gov.audit.view Every action anyone took, append-only. No permission edits or deletes it. | Read | ||||||
Decide an escalation gov.escalation.decide Approve or decline what support could not do itself. Records a decision; does not perform the action. | Changes things | — | — | — | — | ||
Run a job gov.job.run Trigger a scheduled job by hand and acknowledge alerts. | Changes things | — | — | — | — | ||
Change a feature flag gov.flag.write | Changes things | — | — | — | — | — | |
| Platform | |||||||
Kill fan-out for a product, tenant or host platform.kill.scoped The three narrow scopes. Closes keep going out. | Irreversible | — | — | — | — | ||
Kill fan-out platform-wide platform.kill.global Everything stops fanning out. Closes keep going out. | Irreversible | — | — | — | — | — | |
See who holds what admin.view Read the staff list and the permission matrix. Changes nothing — the role that audits authority should not need the authority to change it. | Read | — | — | — | — | ||
Set roles and manage admins admin.manage Invite an admin, change somebody’s role, edit what a role may do. This is the permission that can grant every other one, which is why only the master admin has it and no role can be given it. | Irreversible Master admin only | — | — | — | — | — | |
Master admin
Fixed — not editable
Everything, everywhere, with no second signature and no gate. Cannot be edited, demoted or deleted, and exactly one person holds it.
- Permissions
- 23 of 23
- Pages it can open
- 24 of 24
- Irreversible
- 6
- Held by
- 1 person
Fleet ops
Editable
Keeps the fleet running. No money, no commercial decisions.
- Permissions
- 9 of 23
- Pages it can open
- 10 of 24
- Irreversible
- 1
- Held by
- 3 people
Finance
Editable
Wallets, payouts and reconciliation, plus the commercial pages read-only so a charge can be traced back to what was sold.
- Permissions
- 6 of 23
- Pages it can open
- 11 of 24
- Irreversible
- 2
- Held by
- 2 people
Commercial
Editable
Onboards tenants and providers and decides the approval queue. Can see what is owed and cannot move any of it.
- Permissions
- 7 of 23
- Pages it can open
- 19 of 24
- Irreversible
- none
- Held by
- 1 person
Compliance
Editable
Reads everything, decides escalations, and moves nothing. The role that exists to be able to answer a question without being able to change the answer.
- Permissions
- 6 of 23
- Pages it can open
- 22 of 24
- Irreversible
- none
- Held by
- 1 person
Read-only
Read only, by construction
The reporting pages and nothing else — no control anywhere, and the pages that are only controls (escalations, jobs, flags, admins) are not visible at all. For a new joiner, an auditor, or a contractor.
- Permissions
- 4 of 23
- Pages it can open
- 19 of 24
- Irreversible
- none
- Held by
- 1 person
Who sees this page
Reading the authority map and changing it are different permissions
- Can change anything here
- Master admin
- Can open it and change nothing
- Compliance
- Cannot open it at all
- Fleet ops, Finance, Commercial, Read-only
- Somebody with admin.view sees this matrix and the staff list exactly as they are, with every control absent. Auditing who can move money should not require being able to change who can move money.
- Nobody but the master admin can invite an admin, change a role, or edit what a role may do. There is no per-person override and no delegation — the two ways this would otherwise leak.
- The cost is a queue of one. Every joiner, leaver and role change waits on a single person, and there is no documented succession if that person is away or loses access.
How to read this
Four things the matrix does not say on its own
- Setting roles is the master admin’s, and only theirs. admin.manage is not offered by the role editor, does not appear in the invite dropdown, and cannot be added to any role — it is absent rather than refused, so no role can drift into it. Other admins can be given admin.view and read this page; only the master admin can change anything on it.
- Master admin bypasses every gate on this page, including the two signatures column. That is the decision that was made; the trade is that one compromised credential is the whole platform, so that account is the one to protect hardest.
- Two permissions need a second admin to countersign: approving a payout and adjusting a wallet. Managing admins was a third until setting roles became master-only — at which point the only holder was the one role that bypasses the gate, so the requirement could never fire. It was removed rather than left on the page advertising a protection that does not exist.
- A role that can open a page is not a role that can act on it. Compliance reads every money page and can move nothing, which is the whole reason that role exists.
- Editing a role changes what its holders can do immediately, for everybody in it. Cloning first and moving one person across is the safer shape for an experiment.