Roles and Permissions

This page defines protocol roles, access modifiers, and which addresses may call each privileged function across the Orion Finance protocol smart contracts.

---

Vault-Level Roles

Manager

The Manager is the vault's administrative owner. The manager address is set at vault creation and may update fees, access control, and the assigned strategist.

Strategist

The Strategist submits portfolio allocation intents. A strategist may be:

• A wallet address (active management); or
• A smart contract implementing IOrionStrategist (passive management).

Intent submission sets a target allocation; fulfillment depends on epoch execution, liquidity, and adapter behavior.

User

A User is any address that may interact with a vault to deposit assets, redeem shares, and manage pending deposit or redemption requests. Vaults configure user access as permissionless or permissioned through three optional slots — deposit, holder, and transfer - each an independent contract (address(0) = permissionless on that slot). See Vault Access Control.

Protocol-Level Roles

Admin

The Admin owns protocol-level contracts: OrionConfig, LiquidityOrchestrator, TransparentVaultFactory, EncryptedVaultFactory, and PriceAdapterRegistry.

Security implementation: The admin role is held by a multi-signature Gnosis Safe. Administrative transactions require multiple signer approvals under the Safe's configured threshold.

Guardian

The Guardian is a designated address for emergency response under Terms of Service §7.4. Policy intent prioritizes emergency pause via LiquidityOrchestrator.pause(), plus the narrow OrionConfig controls listed in the matrix below (setMinDepositAmount, setMinRedeemAmount, setMaxFulfillBatchSize), not broad operational retuning. Pause freezes protocol interaction; it does not restore lost funds or guarantee a specific recovery timeline.

Automation Registry

The Automation Registry is an off-chain service that drives the epoch-based rebalancing cycle. It monitors LiquidityOrchestrator via checkUpkeep() and submits upkeep when conditions are met.

---

Permission Matrix

Vault-Level Functions

Function	Manager	Strategist	User
updateFeeModel	Yes	No	No
claimVaultFees	Yes	No	No
setDepositAccessControl	Yes	No	No
setHolderAccessControl	Yes	No	No
setTransferAccessControl	Yes	No	No
updateStrategist	Yes	No	No
submitIntent	No*	Yes	No
requestDeposit	Yes	Yes	Yes
cancelDepositRequest	Yes	Yes	Yes
requestRedeem	Yes	Yes	Yes
cancelRedeemRequest	Yes	Yes	Yes
redeem	Yes	Yes	Yes

Note: A manager can set themselves as the strategist of a vault using updateStrategist, which would allow them to submit intents.

Factory Functions

Function	Whitelisted Manager	Admin
createVault	Yes	No
setVaultBeacon	No	Yes

Note: The createVault caller becomes the vault manager. Whitelisting is enforced via OrionConfig.isWhitelistedManager. Transparent vaults use TransparentVaultFactory; encrypted vaults use EncryptedVaultFactory. Both expose createVault / setVaultBeacon as above.

OrionConfig Functions

Function	Admin	Guardian	Manager
setLiquidityOrchestrator	Yes	No	No
setVaultFactory	Yes	No	No
setPriceAdapterRegistry	Yes	No	No
setProtocolRiskFreeRate	Yes	No	No
setMinDepositAmount	Yes	Yes	No
setMinRedeemAmount	Yes	Yes	No
setFeeChangeCooldownDuration	Yes	No	No
setMaxFulfillBatchSize	Yes	Yes	No
setGuardian	Yes	No	No
addWhitelistedAsset	Yes	No	No
removeWhitelistedAsset	Yes	No	No
addWhitelistedManager	Yes	No	No
removeWhitelistedManager	Yes	No	No
removeOrionVault	Yes	No	Yes
updateProtocolFees	Yes	No	No

LiquidityOrchestrator Functions

Function	Admin	Guardian	Automation Registry
pause	Yes	Yes	No
unpause	Yes	No	No
updateEpochDuration	Yes	No	No
updateMinibatchSize	Yes	No	No
updateExecutionMinibatchSize	Yes	No	No
updateCommitmentMinibatchSize	Yes	No	No
updateAutomationRegistry	Yes	No	No
updateVerifier	Yes	No	No
updateVKey	Yes	No	No
setTargetBufferRatio	Yes	No	No
setSlippageTolerance	Yes	No	No
withdrawLiquidity	Yes	No	No
claimProtocolFees	Yes	No	No
performUpkeep	Yes	No	Yes

---

Related Pages

• Protocol Summary
• Security Audits
• Protocol Invariants
• Contract Standards
• Contract Addresses