Permissions & Security

Overview

Conduit Treasury uses role-based access control (RBAC) to ensure that team members have the appropriate level of access to perform their duties while maintaining security.

Permission System

How It Works

Every action in Conduit Treasury requires a specific permission. When a user attempts an action:

System checks user’s role in the organization
System verifies if that role has the required permission
Action is allowed or denied based on permission check

// Example: User tries to create an account
// System checks: Does user have "account.create" permission?
// If yes → Action proceeds
// If no → 403 Forbidden error

Roles

Owner

Full ControlThe organization creator or appointed owner has complete access to all features and can perform any action.Typical User: CEO, CFO, Founder

Permissions:

✅ All account operations
✅ All transaction operations
✅ All workflow and trigger management
✅ View and manage all allocations
✅ Manage team members and roles
✅ Organization settings
✅ Billing and subscription

Admin

Management AccessAdmins can manage treasury operations but cannot modify team structure or billing.Typical User: Treasury Manager, Finance Director

Permissions:

✅ View, create, delete accounts
✅ Create and approve transactions
✅ Execute transactions
✅ Create, update, delete workflows
✅ Create, update, delete triggers
✅ View and manage allocations
❌ Manage team members
❌ Organization settings
❌ Billing

Member

Read-Only AccessMembers can view treasury data but cannot make changes.Typical User: Accountant, Auditor, Board Member

Permissions:

✅ View accounts and balances
✅ View transactions
✅ View workflows and triggers
✅ View allocations
❌ Create, modify, or delete anything
❌ Execute transactions
❌ Approve transactions

Detailed Permission Matrix

Permission	Owner	Admin	Member	Description
Accounts
`account.view`	✅	✅	✅	View account details and balances
`account.create`	✅	✅	❌	Add new accounts to organization
`account.delete`	✅	✅	❌	Remove accounts from organization
Transactions
`transaction.view`	✅	✅	✅	View transaction history
`transaction.create`	✅	✅	❌	Create new transactions
`transaction.approve`	✅	✅	❌	Approve pending transactions
`transaction.execute`	✅	✅	❌	Execute approved transactions on-chain
Workflows
`workflow.view`	✅	✅	✅	View workflows
`workflow.create`	✅	✅	❌	Create new workflows
`workflow.update`	✅	✅	❌	Modify existing workflows
`workflow.delete`	✅	✅	❌	Delete workflows
Triggers
`trigger.view`	✅	✅	✅	View triggers
`trigger.create`	✅	✅	❌	Create new triggers
`trigger.update`	✅	✅	❌	Modify existing triggers
`trigger.delete`	✅	✅	❌	Delete triggers
Allocations
`allocation.view`	✅	✅	✅	View DeFi strategy allocations
`allocation.create`	✅	✅	❌	Create new allocations
`allocation.update`	✅	✅	❌	Update allocation values
`allocation.delete`	✅	✅	❌	Delete allocations
Team
`team.view`	✅	✅	✅	View team members
`team.invite`	✅	❌	❌	Invite new team members
`team.remove`	✅	❌	❌	Remove team members
`team.role`	✅	❌	❌	Change member roles

API Permission Handling

Authentication Required

All API endpoints require a valid session:

// ❌ Without credentials
fetch('/api/accounts'); // Returns 401 Unauthorized

// ✅ With credentials
fetch('/api/accounts', {
  credentials: 'include'
}); // Returns data if user has permission

Permission Errors

When a user lacks permission:

{
  "error": "Permission denied: You do not have permission to create accounts"
}

HTTP Status Codes:

401 Unauthorized - No valid session
403 Forbidden - Valid session but insufficient permissions

Checking Permissions

Permissions are checked server-side on every request. There’s no need to check permissions client-side beyond hiding UI elements for better UX.

// Server-side (automatic)
export const POST = withOrganization(async ({ session, orgId }) => {
  // This function checks permission automatically
  await requirePermission(
    session.user.id,
    orgId,
    "account.create",
    "create accounts"
  );
  
  // If user lacks permission, 403 error is thrown
  // If user has permission, execution continues
});

Security Best Practices

1. Principle of Least Privilege

Give users only the permissions they need:

Assess Needs

Determine what each team member actually needs to do

Assign Minimum Role

Start with Member role, upgrade only if necessary

Regular Review

Audit permissions quarterly and remove unnecessary access

Example:

Accountant reviewing records → Member role
Treasury manager executing trades → Admin role
CFO overseeing everything → Owner role

2. Use Teams for Organization

Organize accounts and users by department:

Organization: Acme Corp
├── Team: Treasury (Owner: CFO)
│   ├── Member: Treasury Manager (Admin)
│   ├── Member: Senior Trader (Admin)
│   └── Account: Main Treasury (Safe 3/5)
├── Team: Operations (Owner: COO)
│   ├── Member: Ops Manager (Admin)
│   └── Account: Operational Wallet (EOA)
└── Team: Finance (Owner: CFO)
    ├── Member: Controller (Admin)
    ├── Member: Accountant (Member)
    └── Account: Payroll Wallet (Safe 2/3)

3. Transaction Approval Workflow

Implement maker-checker controls:

// Maker: Junior staff creates transaction
const tx = await createTransaction({
  accountId: 'treasury',
  type: 'transfer',
  amount: '50000',
  description: 'Vendor payment'
});

// Checker: Senior staff approves
await approveTransaction(tx.id);

// Executor: Another senior staff executes
await executeTransaction(tx.id, txHash);

4. Audit Trail

All actions are logged with:

Who performed the action
What action was performed
When it occurred
What resources were affected

// Example audit log entry
{
  "timestamp": "2026-01-15T10:30:00Z",
  "userId": "user_123",
  "userName": "Alice Smith",
  "action": "transaction.create",
  "resourceType": "transaction",
  "resourceId": "tx_789",
  "organizationId": "org_456",
  "details": {
    "amount": "50000",
    "token": "usdc",
    "type": "transfer"
  }
}

5. Regular Security Reviews

Monthly: Access Review

Review all team members
Verify roles are still appropriate
Remove departed team members
Check for unused accounts

Quarterly: Permission Audit

Review all workflows and triggers
Audit transaction history
Check for anomalous activity
Update security policies

Annually: Comprehensive Security Audit

Full team access review
Wallet security assessment
Strategy risk evaluation
Disaster recovery testing

Managing Team Members

Inviting Users

// Only Owners can invite users
await fetch('/api/team/invite', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  credentials: 'include',
  body: JSON.stringify({
    email: '[email protected]',
    role: 'member',  // or 'admin'
    teamId: 'team_123' // optional
  })
});

Changing Roles

// Only Owners can change roles
await fetch(`/api/team/members/${userId}`, {
  method: 'PATCH',
  headers: { 'Content-Type': 'application/json' },
  credentials: 'include',
  body: JSON.stringify({
    role: 'admin'  // Promote to admin
  })
});

Removing Users

// Only Owners can remove users
await fetch(`/api/team/members/${userId}`, {
  method: 'DELETE',
  credentials: 'include'
});

Common Permission Scenarios

Scenario 1: New Hire

Junior Treasury Analyst joins the team:

Owner invites with Member role
User can view all data but not make changes
After 3 months of training, promote to Admin
User can now manage workflows and transactions

Scenario 2: External Auditor

Accounting firm needs to review records:

Create temporary Member account
Auditor can view all transactions and balances
Auditor cannot make any changes
Remove access after audit completes

Scenario 3: Emergency Response

Treasury Manager is unavailable, urgent transfer needed:

Owner or another Admin can approve/execute
Multiple Admins provide redundancy
All actions are logged in audit trail
Review incident afterwards

Scenario 4: Intern Access

Finance intern needs limited access:

Create Member account
Optionally restrict to specific team
Intern can generate reports but not transact
Remove access at end of internship

Security Incidents

If an Account is Compromised

Immediate Action

Pause all workflows
Lock affected accounts
Change authentication credentials

Assessment

Review audit logs
Identify unauthorized actions
Determine scope of breach

Remediation

Revoke compromised user access
Review and approve pending transactions
Move funds to secure accounts if necessary

Post-Incident

Document what happened
Update security procedures
Notify relevant parties
Implement additional controls

Suspicious Activity Alerts

Watch for:

Unusual transaction amounts
Transactions to unknown addresses
Rapid succession of operations
Access from unusual locations
Permission elevation requests
Bulk data exports

Best Practices Summary

Security Checklist

✅ Use principle of least privilege✅ Regular access reviews (monthly)✅ Enable multi-sig for large transactions✅ Implement maker-checker workflows✅ Monitor audit logs regularly✅ Use teams to organize access✅ Remove access for departed team members immediately✅ Test incident response procedures✅ Document security policies✅ Train team on security practices

Next Steps

Core Concepts

Understand organization structure

Workflows & Automation

Learn about automated workflows

API Reference

Explore API documentation

Quickstart

Get started guide

Getting Started

Treasury Management

Integration

​Overview

​Permission System

​How It Works

​Roles

​Owner

Owner

​Admin

Admin

​Member

Member

​Detailed Permission Matrix

​API Permission Handling

​Authentication Required

​Permission Errors

​Checking Permissions

​Security Best Practices

​1. Principle of Least Privilege

​2. Use Teams for Organization

​3. Transaction Approval Workflow

​4. Audit Trail

​5. Regular Security Reviews

​Managing Team Members

​Inviting Users

​Changing Roles

​Removing Users

​Common Permission Scenarios

​Scenario 1: New Hire

​Scenario 2: External Auditor

​Scenario 3: Emergency Response

​Scenario 4: Intern Access

​Security Incidents

​If an Account is Compromised

​Suspicious Activity Alerts

​Best Practices Summary

Security Checklist

​Next Steps

Core Concepts

Workflows & Automation

API Reference

Quickstart

Overview

Permission System

How It Works

Roles

Owner

Admin

Member

Detailed Permission Matrix

API Permission Handling

Authentication Required

Permission Errors

Checking Permissions

Security Best Practices

1. Principle of Least Privilege

2. Use Teams for Organization

3. Transaction Approval Workflow

4. Audit Trail

5. Regular Security Reviews

Managing Team Members

Inviting Users

Changing Roles

Removing Users

Common Permission Scenarios

Scenario 1: New Hire

Scenario 2: External Auditor

Scenario 3: Emergency Response

Scenario 4: Intern Access

Security Incidents

If an Account is Compromised

Suspicious Activity Alerts

Best Practices Summary

Next Steps