All
Filter by:
How do I deposit cash into my account?
I need help with account verification
Why can't I access my account?
Are there any crypto withdrawal fees?
I need help signing into my account
Roles, Profiles, and Permissions
This article explains how access works in Organizations: what a Member can do, on which accounts, and what happens when they do it. For how approval policies resolve requests, see Policies, approvals, and governance. For the account structure itself, see Accounts.
A Member’s access is assembled from two building blocks, and resolved by a third:
- Account Roles answer “what can this Member do, and on which accounts?” They carry account permissions, Read, Trade, Earn Allocate, Earn Deallocate, Withdraw, Transfer, each scoped to a set of accounts. A Member with multiple Account Roles assigned will inherit all the permissions carried by each role.
- The Workflow Profile answers “what actions can this Member take on governed operations?” For each workflow, it sets the ability for a Member to View, Initiate, Approve or Execute the operation. Each Member can hold only one Workflow Profile.
- Policies answer “how does a governed operation complete?” Each workflow’s policy decides whether requests are executed immediately or require multiple approvals. Policies are covered in Policies, approvals, and governance.
Put together:
Effective access = one Workflow Profile + the union of Account Roles + the workflow’s policy
Roles and profiles are kept separate on purpose. Account Roles are scoped to accounts; Workflow Profile levels are not. Showing them as one bundle would suggest that approval rights vary by account, they never do. A Member who can approve withdrawal requests can approve them anywhere in the Organization.
Account permissions are carried by Account Roles. Each permission is granted per account: holding it on one account gives nothing on any other.
Direct permissions
These take effect immediately, no requests, no approvals:
Permission | What it allows |
|---|---|
Read | See the account’s balances, trade history, ledger entries, and open orders |
Trade | Place and manage orders on the account |
Earn Allocate | Allocate assets from the account into Earn products |
Earn Deallocate | Deallocate assets from Earn back into the account |
Note:
Trade includes both spot and margin on the main account and spot trading only on additional accounts; margin support for additional accounts is planned. Some operations, Futures, Options, OTC, Convert, DeFi Earn, and others, have no Organization permission yet and remain exclusive to the Owner. See Availability and limitations.
Fund-movement permissions
These two permissions work differently: they don’t grant anything on their own. Rather, they select which accounts a Member can withdraw and transfer from via an approval workflow. A Member must hold a Workflow Profile allowing them to start these operations.
Permission | What it selects |
|---|---|
Withdraw | Accounts the Member can withdraw from. Required on the source account. |
Transfer | Accounts the Member can transfer between. Required on both the source and the destination account. |
For the complete picture of how a withdrawal or transfer resolves, see Transfers and withdrawals.
An Account Role is a reusable bundle: a set of account permissions applied to a set of accounts. A trading role might grant Read and Trade on the accounts one desk uses; a funding role might grant Read, Transfer, and Withdraw on the accounts your operations team manages. You define the role once and assign it to all the Members that need it.
- Members can hold multiple Account Roles. Their permissions combine, a Member holding both a trading role and a funding role will inherit both sets of access.
- Roles are live resources, not templates. Editing a role changes access for every Member who already holds it, effective immediately. Before saving, the system shows which Members are affected by the role change and how.
Tip:
Mixed needs are best satisfied with two roles. A role applies one permission set to its accounts. If someone needs to trade on one set of accounts and move funds on another, give them two roles rather than one role that blurs the two.
The Workflow Profile is the governance half of a Member’s access. For each workflow, it sets which levels the Member holds:
Level | What it allows |
|---|---|
View | See the workflow’s requests and history |
Initiate | Start a new request on the workflow |
Approve | Approve or reject requests started by other Members |
Execute | Complete a request immediately, when the workflow’s policy allows it |
The levels are capabilities, not ranks:
- View is the base. Holding any other level always includes View.
- Initiate and Approve are independent. A Member can approve without being able to start requests, or they can start requests without being able to approve. This granularity ensures separation of duties.
- Execute includes Initiate and Approve. A Member trusted to complete actions without further approvals will also be able to start and review requests.
Two properties are worth pausing on:
- Profile levels apply Organization-wide. Approve on Withdrawal Request means the Member can review every withdrawal request in the Organization, regardless of which account it draws from. Only creating withdrawals is account-scoped: a Member can only initiate withdrawals and transfers on accounts for which they hold a fund-movement account permission.
- Each Member holds exactly one profile. There is no stacking of profiles, so reading a Member’s profile tells you their complete governance position at a glance. Like Account Roles, profiles are live resources: editing one changes what every Member with that profile can do. The system always shows the affected Members before you save a change to an existing profile.
The available workflows are:
Workflow | Operations it governs |
|---|---|
Withdrawal Request | Withdraw to a whitelisted external address |
Transfer Request | Transfer funds between the Organization’s accounts |
Manage Team & Access | Invite, edit, deactivate, and reactivate Members; assign and change Account Roles and Workflow Profiles |
Manage API Keys | Create, edit, and revoke API keys |
Manage Accounts | Add, edit, disable, enable, and delete accounts |
Manage Addresses | Add and delete whitelisted withdrawal addresses |
Manage Policies | Change any workflow’s policy settings; lock and unlock each workflow’s policy |
Note:
API key administration is its own workflow, separate from Manage Team & Access. You can let someone manage API keys without giving them any ability to change Members’ access, and the two workflows can carry different approval policies.
Every Organization starts with a set of system-defined Account Roles and Workflow Profiles. They cover the common patterns so you can provision a team without building anything custom first, and they serve as worked examples to help you design your own governance.
System-defined Account Roles
Role | What it grants |
|---|---|
Full access | Every account permission, on all current and future accounts |
Trade all | Trading on all current and future accounts |
Funds all | Funding operations, Transfer, Withdraw, Earn Allocate, Earn Deallocate, on all current and future accounts |
Read all | Read-only access on all current and future accounts |
The system-defined roles cover all current and future accounts: a Member holding Trade all will be able to trade on an account created tomorrow without their access being adjusted to include the new account. It is also possible to create a custom role scoped to a specific and static list of accounts.
System-defined profiles and roles cannot be edited or deleted. However, it is possible to clone one and modify the copy to suit your Organization’s specific needs.
System-defined Workflow Profiles
Profile | What it holds |
|---|---|
Admin | Every level on every workflow, including Execute. Held by the Organization Owner when the Organization is created. |
Initiator | View and Initiate on every workflow. Cannot approve requests. |
Approver | View and Approve on every workflow. Cannot start requests. |
Funds Manager | View, Initiate, and Approve on Withdrawal Request and Transfer Request. View and Initiate on Manage Addresses. No level on Manage Team & Access, Manage API Keys, Manage Accounts, or Manage Policies. |
Auditor | Can view requests and history on every workflow, but cannot start or approve anything. |
A profile that holds Initiate or Execute on Withdrawal Request must also hold View on Manage Addresses. This makes access to the Organization’s withdrawal-address whitelist visible in the profile configuration. View on Manage Addresses does not grant permission to start or approve address changes.
Funds Manager can propose a new or replacement withdrawal address, but cannot approve address changes. That keeps approval of an address change independent from the person who can later initiate or approve withdrawals to it.
The Initiator, Approver, and Auditor profiles map to the three seats of a review process: the people who propose, the people who sign off, and the people who oversee. Funds Manager is the day-to-day profile for operators who handle fund movements and can propose the destination addresses they need.
The effective access a Member has is determined by the Workflow Profile and the Account Roles assigned, plus the current policy for each workflow.
- Go to Team and select the Member, or select Invite Member to add someone new.
- Choose their Workflow Profile, one of the system-defined profiles or a custom one.
- Add one or more Account Roles covering the accounts they operate.
- Review the effective access preview. It shows the profile and roles separately, then resolves them: for each account, what the Member can do directly, and for each fund-movement permission, how a request from them would complete under the current policies.
- Confirm. If the Manage Team & Access workflow has a policy requiring approval, the assignment enters the approval queue first.
The preview also flags combinations that grant less than they appear to, for example, a role granting Withdraw on an account paired with a profile that cannot initiate Withdrawal Requests. Neither grant is wrong, but together they do not yet let the Member withdraw, and the preview shows this state before you save.
Note:
Changing a Member’s access later follows the same path and the same governance as the original assignment.
Troubleshooting
Withdraw is an account permission that determines which accounts the Member can withdraw from, if they are granted a Workflow Profile allowing them to start withdrawal requests at all. Check their profile: they need Initiate (or Execute) on the Withdrawal Request workflow. The effective access preview on their Member page shows this resolution for each account.
This is intended and it is how Approve works. Workflow Profile levels apply across all the accounts of the Organization. A Member with an Approve level on withdrawal requests can approve any withdrawal request. The current model does not support account-scoped approval rights.
That is by design. Roles are live resources, every Member holding the role inherits the permissions that role carries. When you edit a role, the confirmation step shows how Members’ access will change before you save the changes. To change access for one Member only, define and assign a new role rather than editing a shared one.
Members can hold only one Workflow Profile. If no existing profile fits, create a custom profile with the combination of levels you need and assign that profile.
Members need visibility into accounts they operate, and roles that grant Trade abilities typically include Read rights on the same accounts. To restrict a Member to trade with less visibility on other accounts, narrow the account set of their roles rather than the permissions within an account.