Roles and Permissions

This page defines protocol roles, access modifiers, and which addresses may call each privileged function across the Orion Finance protocol smart contracts.

---

Vault-Level Roles

Manager

The Manager is the vault's administrative owner. The manager address is set at vault creation and may update fees, access control, and the assigned strategist.

Strategist

The Strategist submits portfolio allocation intents. A strategist may be:

• A wallet address (active management); or
• A smart contract implementing IOrionStrategist (passive management).

Intent submission sets a target allocation; fulfillment depends on epoch execution, liquidity, and adapter behavior.

User

A User is any address that may interact with a vault to deposit assets, redeem shares, and manage pending deposit or redemption requests. Vaults configure user access as permissionless or permissioned through three optional slots (deposit, holder, and transfer) each an independent contract (address(0) = permissionless on that slot). See Vault Access Control.

Protocol-Level Roles

Each protocol role below has exactly one on-chain authoritative definition.

Admin

Authoritative identity	OrionConfig.owner()
How it is set	Config 2-step ownership transfer (transferOwnership() / acceptOwnership())

The admin role is held by a multi-signature Gnosis Safe.

Guardian

Authoritative identity	OrionConfig.guardian()
How it is set	OrionConfig.setGuardian()

The Guardian is a designated address for emergency response under Terms of Service §7.4. On-chain guardian authority is limited to:

• LiquidityOrchestrator.pause() and LiquidityOrchestrator.updateEpochDuration()
• OrionConfig.setMinDepositAmount() and OrionConfig.setMinRedeemAmount()

Guardian cannot unpause the protocol, change fulfill batch size, or retune other operational parameters. Pause freezes protocol interaction; it does not restore lost funds or guarantee a specific recovery timeline.

Automation Registry

Authoritative identity	LiquidityOrchestrator.automationRegistry()
How it is set	LiquidityOrchestrator.updateAutomationRegistry()

The Automation Registry is the address authorized to call performUpkeep. It is the intended off-chain automation caller that monitors checkUpkeep() and submits upkeep when conditions are met.

Upgrade Timelock

The Upgrade Timelock is set once per upgradeable contract via setUpgradeTimelock. Until it is set, Admin may call setUpgradeTimelock. After it is set, only the timelock address may replace the timelock or authorize UUPS upgrades on OrionConfig, LiquidityOrchestrator, TransparentVaultFactory, EncryptedVaultFactory, and PriceAdapterRegistry.

Each upgradeable contract stores its own upgradeTimelock address; Admin still means Config.owner when bootstrapping.

---

Permission Matrix

Vault-Level Functions

Function	Manager	Strategist	User
updateFeeModel	Yes	No	No
claimVaultFees	Yes	No	No
setDepositAccessControl	Yes	No	No
setHolderAccessControl	Yes	No	No
setTransferAccessControl	Yes	No	No
updateStrategist	Yes	No	No
submitIntent	No*	Yes	No
requestDeposit	No	No	Yes
requestDepositFor	No	No	Yes
cancelDepositRequest	No	No	Yes
requestRedeem	No	No	Yes
cancelRedeemRequest	No	No	Yes
claimUnderlying	No	No	Yes
redeem (decommissioned only)	No	No	Yes

Notes:

• A manager can set themselves as the strategist via updateStrategist, which allows them to submit intents.
• User means any address, subject to optional deposit/holder/transfer access-control modules. Managers and strategists may call user functions when acting as ordinary users.
• requestDepositFor applies deposit/holder ACL to the beneficiary, not the payer.
• Synchronous redeem is enabled only for decommissioned vaults. Standard ERC-4626 deposit / mint / withdraw always revert.

Factory Functions

Applies to both TransparentVaultFactory and EncryptedVaultFactory.

Function	Whitelisted Manager	Admin	Upgrade Timelock
createVault	Yes	No	No
setVaultBeacon	No	Yes	No
setUpgradeTimelock	No	Yes*	Yes*

Notes:

• The createVault caller becomes the vault manager. Whitelisting is enforced via OrionConfig.isWhitelistedManager.
• *setUpgradeTimelock: Admin if unset; Upgrade Timelock thereafter.

OrionConfig Functions

Function	Admin	Guardian	Manager
setLiquidityOrchestrator	Yes	No	No
setVaultFactory	Yes	No	No
setEncryptedVaultFactory	Yes	No	No
setPriceAdapterRegistry	Yes	No	No
setProtocolRiskFreeRate	Yes	No	No
setMinDepositAmount	Yes	Yes	No
setMinRedeemAmount	Yes	Yes	No
setFeeChangeCooldownDuration	Yes	No	No
setMaxFulfillBatchSize	Yes	No	No
setGuardian	Yes	No	No
setHpkePublicKey	Yes	No	No
addWhitelistedAsset	Yes	No	No
removeWhitelistedAsset	Yes	No	No
addWhitelistedManager	Yes	No	No
removeWhitelistedManager	Yes	No	No
removeOrionVault	Yes	No	Yes
updateProtocolFees	Yes	No	No
setUpgradeTimelock	Yes*	No	No

Notes:

• addWhitelistedAsset also registers the price adapter on PriceAdapterRegistry and the execution adapter on LiquidityOrchestrator.
• *setUpgradeTimelock: Admin if unset; Upgrade Timelock thereafter (Timelock column omitted for brevity; same pattern as factories).
• For removeOrionVault, Manager means that vault's manager.

LiquidityOrchestrator Functions

Function	Admin	Guardian	Automation Registry	Anyone
pause	Yes	Yes	No	No
unpause	Yes	No	No	No
updateEpochDuration	Yes	Yes	No	No
updateMinibatchSize	Yes	No	No	No
updateExecutionMinibatchSize	Yes	No	No	No
updateCommitmentMinibatchSize	Yes	No	No	No
updateAutomationRegistry	Yes	No	No	No
updateVerifier	Yes	No	No	No
updateVKey	Yes	No	No	No
setTargetBufferRatio	Yes	No	No	No
setSlippageTolerance	Yes	No	No	No
depositLiquidity	No	No	No	Yes
withdrawLiquidity	Yes	No	No	No
claimProtocolFees	Yes	No	No	No
performUpkeep	Yes	No	Yes	No
setUpgradeTimelock	Yes*	No	No	No

Notes:

• *setUpgradeTimelock: Admin if unset; Upgrade Timelock thereafter.

Execution Adapter Functions

Function	Contract	Admin	Liquidity Orchestrator	Anyone
setAssetFee	UniswapV3ExecutionAdapter	Yes	No	No
buy / sell	UniswapV3ExecutionAdapter	No	No	Yes
buy / sell	ERC4626ExecutionAdapter	No	Yes	No

Price Adapter and Registry Functions

Function	Contract	Admin	Upgrade Timelock
setUpgradeTimelock	PriceAdapterRegistry	Yes*	Yes*
setPool	UniswapV3PoolPriceAdapter	Yes	No
configureFeed	ChainlinkPriceAdapter	Yes	No
setFallbackAdapter	ChainlinkPriceAdapter	Yes	No

Notes:

• *setUpgradeTimelock: Admin if unset; Upgrade Timelock thereafter.

---

Related Pages

• Protocol Summary
• Security
• Incident Response
• Security Audits
• Protocol Invariants
• Contract Standards
• Contract Addresses