User roles

In Liminal Vaults, an organisation is a workspace where VASP like exchanges manage their wallets, transactions, and policies. The platform uses role-based access control (RBAC). Each user has one or more roles. The roles decide what the user can see and do.

The owner is the first user onboarded in an organisation. The owner and admins can then invite other users and assign roles.

Roles

Role	What the role does
Owner	Has full control of the organisation. Manages users, teams, wallets, policies and settings.
Admin	Manages wallets, teams, policies, alerts and integrations.
Developer	Manages API keys, IP allowlists, webhooks and event logs.
Viewer	Has read-only access to wallets, balances, transactions and policies.
Signer	Signs pending transactions. Rejects and cancels transactions.
Initiator	Creates, cancels, rejects and simulates transactions. Submits Travel Rule information.
Compliance Officer	Manages firewall policies, screens addresses and releases quarantined transactions.

How roles work

You assign roles when you invite a user
A human user can hold more than one role. Permissions from all of the user's roles apply together
An API user holds one role only.
Signer and Initiator cannot be assigned to the same user.

Key permissions by role

This table shows common actions only. For every permission, see the complete permissions map.

Legend:

✅ granted: the role can perform the action; ❌ not granted: the role cannot perform the action.

Navigation	Permission	Owner	Admin	Developer	Viewer	Signer	Initiator	Compliance Officer
Wallets	View wallets	✅	✅	❌	✅	✅	✅	✅
Wallets	Add a wallet	✅	✅	❌	❌	❌	❌	❌
Wallets	Create a transaction	❌	❌	❌	❌	❌	✅	❌
Home > Pending Actions	Sign a pending transaction	❌	❌	❌	❌	✅	❌	❌
Home > Pending Actions	Approve a transaction by quorum	✅	✅	❌	❌	❌	❌	❌
Settings > Policy	Create a wallet policy	✅	✅	❌	❌	❌	❌	✅
Firewall	Release a quarantined transaction	❌	❌	❌	❌	❌	❌	✅
Settings > User Management	Invite a user	✅	✅	❌	❌	❌	❌	❌
Settings > Team Management	Create a team	✅	✅	❌	❌	❌	❌	❌
Settings > Team Management	Update team membership	✅	✅	❌	❌	❌	❌	❌
Dev	Create an API key	❌	❌	✅	❌	❌	❌	❌
Dev	Create a webhook	❌	❌	✅	❌	❌	❌	❌
Dev	Add an IP to the allowlist	❌	❌	✅	❌	❌	❌	❌
Settings > Audit logs	View audit logs	✅	✅	✅	❌	❌	❌	✅

Add users to your organisation

Owners and admins can invite users and assign roles. The role becomes active when the user activates their account.

Log into Vaults.
Go to Settings > User Management.
Select Invite.
Enter the user's name and email address.
In Assign Roles, select one or more roles.
Select Send Invite.

To see the roles of each user, check the Role type column on the Users page. It shows one badge for each role.

Edit a user role

You can add or remove roles for a user. You do not need to create a second account.

Log into Vaults.
Go to Settings > User Management.
Select the three dots icon on the user's row, then select Edit User.
In Assign Roles, add or remove roles.
Select Submit, then confirm the change.

Note :

The change applies at once. The user does not need to sign in again.

The first owner of the organisation (the primary owner) cannot be changed.

API users

An API user is a machine user that connects to Liminal with an API key. An API user has one role only. It can do only the actions that its role allows.

Teams

A team in a wallet is a group of users who collaboratively manage your wallet transactions. You can create teams of transaction initiators and signers. Transaction initiators are responsible for initiating transactions from a wallet. Transaction signers are responsible for signing the transactions, using the appropriate signing devices like mobile phone for warm MPC wallets and Ledger for cold multisig wallets. You can create teams and then assign them at the time of creating a new wallet.

Note :

Users can be added to a team of transaction initiators and signers.

A user who has set up their signing devices like mobile phone or Ledger, can be added to the team of signers.

Users' team roles (initiator or signer) are limited to the wallet assigned to their team. The same user may have a different role in another wallet.

Create a team of users

An owner or admin of your organisation can set up teams of users who can initiate or sign transactions from warm MPC wallets. Refer to the Create a team of initiators to create an initiator team. Refer to the Create a team of signers to create a signer team.

Once done, you can assign the team while creating new warm MPC wallets.

Edit users in a team

As an owner or admin of your organisation, you can edit the members of a team. A team is assigned one-time at the time of creating new wallets. With the ability to edit members of a team, you can update users in a team that is already assigned to the existing wallets. You can also view all the associated wallets and the preconfigured minimum number of users for each wallet.

Take the following steps to edit users in a team.

Log into Vaults.
Go to Settings > Teams. Then select View.

Select the three dots icon for a team and then select Edit Team.

You can add or remove users from the team.
Select Edit Team to confirm the changes.

Note :

Right now You can add team that mix of different roles, but if you assign that team as an initiator in a wallet, only user from that team with roles with initiator can only initiate the transaction

You will receive an alert in case the number of users are inadequate in any wallet as per its configuration, as shown in the following screenshot.

Deleting a team is not currently supported in Liminal Vaults.

Currently , Initiator and signer can't be assigned to same person .

User roles

Roles

How roles work

You assign roles when you invite a user

Key permissions by role

Legend: ✅ granted: the role can perform the action; ❌ not granted: the role cannot perform the action.

Add users to your organisation

Edit a user role

API users

Teams

Note :

Create a team of users

Edit users in a team

Note :

Legend:

✅ granted: the role can perform the action; ❌ not granted: the role cannot perform the action.