# User roles and permissions

In this section
- [Manage users](/products/wallet/organization-and-access/users-and-roles/manage-users) – Invite, edit, and block users
- [Single sign-on](/products/wallet/organization-and-access/single-sign-on) – Configure SSO for your organization


Ripple Custody (Wallet) provides six user roles. Assign each user the role with the least privilege needed for their responsibilities. To assign or change a user's role, see [Manage users](/products/wallet/organization-and-access/users-and-roles/manage-users).

Contact Ripple for more information on these roles, or if your organization requires a more bespoke role structure.

## Role summary

| Role | Purpose | Typical team member |
|  --- | --- | --- |
| **Owner** | Full access, including organization-level settings | CTO, Head of Operations |
| **Administrator** | Full access except organization-level settings | Operations lead, security lead |
| **Proposer** | Manage vaults and wallets, initiate and approve transactions | Treasury analyst, operations team |
| **Approver** | Review and approve transactions, addresses, policies | Compliance officer, senior manager |
| **Viewer** | Read-only access | Finance team, reporting |
| **Auditor** | Read access across the organization, including users, devices, API credentials, webhooks, and sweeps, plus freezing and unfreezing transactions | Internal or external auditors |


Owners and administrators share nearly identical permissions. The key difference is that only owners can update organization settings, such as single sign-on (SSO) and the Travel Rule connection, and create backups.

If a procedure mentions a button or menu item you can't see, your role probably doesn't include that task. Ask an owner or administrator in your organization. Each procedure states the roles that can do it, and the actions table at the top of each task page has a **Console role** column.

API credentials don't have roles. Each credential has a type and the permissions you grant when you create it. See [Manage API credentials](/products/wallet/organization-and-access/api-credentials/manage-api-credentials).

## Roles

### Owner

An owner has full control over all aspects of the system. They can perform all actions across all users, vaults, wallets, devices, transactions, API credentials, counterparties, addresses, policies, approval groups, and organization settings.

**Example**: The CEO of a company who needs full control over all aspects of the system, including creating and managing users, vaults, wallets, and approving high-level changes.

### Administrator

Similar to owner, but with slightly fewer privileges. Can manage most aspects of the system, including users, vaults, wallets, devices, and transactions, but can't update organization settings, such as single sign-on, or create backups.

**Example**: A member of the C-suite that has executive power and is responsible for day-to-day business operations, including handling user accounts, configuring vaults and wallets, and managing devices and API credentials.

### Proposer

Can create and manage vaults, wallets, and transactions, and approve requests as a member of an approval group. Can't manage other users or perform administrative tasks such as configuring policies, approval groups, or the address book.

**Example**: A finance team member who needs to create transactions and manage vaults and wallets but requires approval for specific actions, such as finalizing/sending transactions.

### Approver

Primarily focused on approving transactions and some policy rules. Can view many areas of the platform but has limited creation or modification rights.

**Example**: A senior finance officer responsible for reviewing and approving transactions, address book entries, and policy rules proposed by others.

### Viewer

Has the most restricted access. Can view vaults, wallets, and transactions, but cannot create, modify, or approve most items.

**Example**: A junior team member or finance admin who needs to view transactions and basic information but doesn't have permission to make changes or approvals.

### Auditor

Designed for oversight. Can view most aspects of the system, including users, vaults, wallets, devices, and transactions. The only change an auditor can make is to freeze or unfreeze a transaction. Has access to view organization settings.

**Example**: An internal or external compliance or security officer who needs comprehensive view access to conduct audits and ensure regulatory compliance without the ability to change configuration.

## Permissions by role

The following tables show the permissions and related actions each role can perform. In the tables, **Admin** is the Administrator role.

An **Approve** permission lets a user act on an approval request only when they're a member of the approval group for that request type. See [Configure approval flows](/products/wallet/governance-and-controls/approvals/configure-approval-flows).

### Users

| Users | Owner | Admin | Proposer | Approver | Viewer | Auditor |
|  --- | --- | --- | --- | --- | --- | --- |
| View all users | ✅ | ✅ | 🔴 | 🔴 | 🔴 | ✅ |
| View own user | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| [Create users](/products/wallet/organization-and-access/users-and-roles/manage-users#invite-a-new-user-via-the-console) | ✅ | ✅ | 🔴 | 🔴 | 🔴 | 🔴 |
| [Update all users](/products/wallet/organization-and-access/users-and-roles/manage-users#update-user-via-the-console) | ✅ | ✅ | 🔴 | 🔴 | 🔴 | 🔴 |
| [Update own user](/products/wallet/organization-and-access/users-and-roles/manage-users#edit-your-own-profile-via-the-console) | ✅ | ✅ | ✅ | ✅ | ✅ | 🔴 |
| [Block users](/products/wallet/organization-and-access/users-and-roles/manage-users#block-user-via-the-console) | ✅ | ✅ | 🔴 | 🔴 | 🔴 | 🔴 |
| [Reset all users password/2FA](/products/wallet/organization-and-access/users-and-roles/manage-users#reset-password-via-the-console) | ✅ | ✅ | 🔴 | 🔴 | 🔴 | 🔴 |
| Reset own user password/2FA | ✅ | ✅ | ✅ | ✅ | ✅ | 🔴 |
| Approve users | ✅ | ✅ | ✅ | ✅ | 🔴 | 🔴 |


### Organization settings

| Organization settings | Owner | Admin | Proposer | Approver | Viewer | Auditor |
|  --- | --- | --- | --- | --- | --- | --- |
| View settings | ✅ | ✅ | 🔴 | 🔴 | 🔴 | ✅ |
| [Update settings, including SSO and the Travel Rule connection](/products/wallet/organization-and-access/single-sign-on#configure-sso-for-your-organization-via-the-console) | ✅ | 🔴 | 🔴 | 🔴 | 🔴 | 🔴 |


### Backup and recovery

| Backup and recovery | Owner | Admin | Proposer | Approver | Viewer | Auditor |
|  --- | --- | --- | --- | --- | --- | --- |
| View backups | ✅ | ✅ | 🔴 | 🔴 | 🔴 | ✅ |
| [Create backups](/products/wallet/signing-and-key-management/backup-and-recovery#set-up-backups) | ✅ | 🔴 | 🔴 | 🔴 | 🔴 | 🔴 |


### Registry

| Registry | Owner | Admin | Proposer | Approver | Viewer | Auditor |
|  --- | --- | --- | --- | --- | --- | --- |
| View blockchains, assets, and currencies | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| [Create custom assets](/products/wallet/vaults-and-wallets/registry/manage-custom-assets) | ✅ | ✅ | 🔴 | 🔴 | 🔴 | 🔴 |
| Update custom assets | ✅ | ✅ | 🔴 | 🔴 | 🔴 | 🔴 |
| Enable or disable custom assets | ✅ | ✅ | 🔴 | 🔴 | 🔴 | 🔴 |


### Vaults

| Vaults | Owner | Admin | Proposer | Approver | Viewer | Auditor |
|  --- | --- | --- | --- | --- | --- | --- |
| [View vaults](/products/wallet/vaults-and-wallets/vaults/manage-vaults#list-vaults-via-the-console) | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| [Create vaults](/products/wallet/vaults-and-wallets/vaults/manage-vaults#create-a-vault-via-the-console) | ✅ | ✅ | ✅ | 🔴 | 🔴 | 🔴 |
| View vault settings | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| [Update vault settings](/products/wallet/vaults-and-wallets/vaults/manage-vaults#edit-or-delete-a-vault-via-the-console) | ✅ | ✅ | ✅ | 🔴 | 🔴 | 🔴 |
| [Add tags to vaults](/products/wallet/vaults-and-wallets/vaults/manage-vaults#tag-a-vault-via-the-console) | ✅ | ✅ | ✅ | 🔴 | 🔴 | 🔴 |
| [Remove tags from vaults](/products/wallet/vaults-and-wallets/vaults/manage-vaults#tag-a-vault-via-the-console) | ✅ | ✅ | 🔴 | 🔴 | 🔴 | 🔴 |


### Wallets

| Wallets | Owner | Admin | Proposer | Approver | Viewer | Auditor |
|  --- | --- | --- | --- | --- | --- | --- |
| [View wallets](/products/wallet/vaults-and-wallets/wallets/manage-wallets#list-wallets-via-the-console) | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| [Create wallets](/products/wallet/vaults-and-wallets/wallets/manage-wallets#create-a-wallet-via-the-console) | ✅ | ✅ | ✅ | 🔴 | 🔴 | 🔴 |
| Update wallet settings | ✅ | ✅ | ✅ | 🔴 | 🔴 | 🔴 |
| [Refresh wallet balances](/products/wallet/vaults-and-wallets/wallets/understanding-balances#refreshing-balances) | ✅ | ✅ | ✅ | 🔴 | 🔴 | 🔴 |
| [Add tags to wallets](/products/wallet/vaults-and-wallets/wallets/manage-wallets#tag-a-wallet-via-the-console) | ✅ | ✅ | ✅ | 🔴 | 🔴 | 🔴 |
| [Remove tags from wallets](/products/wallet/vaults-and-wallets/wallets/manage-wallets#tag-a-wallet-via-the-console) | ✅ | ✅ | 🔴 | 🔴 | 🔴 | 🔴 |
| [Delete wallets](/products/wallet/vaults-and-wallets/wallets/manage-wallets#delete-a-wallet-via-the-console) | ✅ | ✅ | 🔴 | 🔴 | 🔴 | 🔴 |


### Devices

| Devices | Owner | Admin | Proposer | Approver | Viewer | Auditor |
|  --- | --- | --- | --- | --- | --- | --- |
| View all devices | ✅ | ✅ | 🔴 | 🔴 | 🔴 | ✅ |
| View own devices | ✅ | ✅ | ✅ | ✅ | 🔴 | ✅ |
| [Create devices](/products/wallet/signing-and-key-management/devices/add-a-device#add-a-new-device-via-the-console) | ✅ | ✅ | ✅ | ✅ | 🔴 | 🔴 |
| Update all devices | ✅ | ✅ | 🔴 | 🔴 | 🔴 | 🔴 |
| Update own devices | ✅ | ✅ | ✅ | ✅ | 🔴 | 🔴 |
| Delete all devices | ✅ | ✅ | 🔴 | 🔴 | 🔴 | 🔴 |
| [Delete own devices](/products/wallet/signing-and-key-management/devices/add-a-device#delete-a-device-via-the-console) | ✅ | ✅ | ✅ | ✅ | 🔴 | 🔴 |
| Block all devices | ✅ | ✅ | 🔴 | 🔴 | 🔴 | 🔴 |
| [Block own devices](/products/wallet/signing-and-key-management/devices/add-a-device#disable-a-device-via-the-console) | ✅ | ✅ | ✅ | ✅ | 🔴 | 🔴 |
| [Approve devices](/products/wallet/signing-and-key-management/devices/add-a-device#approve-a-device-via-the-console) | ✅ | ✅ | 🔴 | 🔴 | 🔴 | 🔴 |


### Approval groups

| Approval groups | Owner | Admin | Proposer | Approver | Viewer | Auditor |
|  --- | --- | --- | --- | --- | --- | --- |
| View approval groups | ✅ | ✅ | ✅ | ✅ | 🔴 | ✅ |
| [Create approval groups](/products/wallet/governance-and-controls/approvals/configure-approval-flows#create-an-approval-group-via-the-console) | ✅ | ✅ | 🔴 | 🔴 | 🔴 | 🔴 |
| [Update approval groups](/products/wallet/governance-and-controls/approvals/configure-approval-flows#update-an-approval-group-via-the-console) | ✅ | ✅ | 🔴 | 🔴 | 🔴 | 🔴 |
| [Delete approval groups](/products/wallet/governance-and-controls/approvals/configure-approval-flows#delete-an-approval-group-via-the-console) | ✅ | ✅ | 🔴 | 🔴 | 🔴 | 🔴 |


### MPC

| MPC | Owner | Admin | Proposer | Approver | Viewer | Auditor |
|  --- | --- | --- | --- | --- | --- | --- |
| [View quorums](/products/wallet/signing-and-key-management/mpc-quorums#view-quorum-details-via-the-console) | ✅ | ✅ | ✅ | ✅ | 🔴 | ✅ |
| [Create all quorums](/products/wallet/signing-and-key-management/mpc-quorums#create-a-quorum-via-the-console) | ✅ | ✅ | 🔴 | 🔴 | 🔴 | 🔴 |
| [Update all quorums](/products/wallet/signing-and-key-management/mpc-quorums/key-restructuring#perform-a-restructure-via-the-console) | ✅ | ✅ | 🔴 | 🔴 | 🔴 | 🔴 |
| Delete all quorums | ✅ | ✅ | 🔴 | 🔴 | 🔴 | 🔴 |


### Addresses

| Addresses | Owner | Admin | Proposer | Approver | Viewer | Auditor |
|  --- | --- | --- | --- | --- | --- | --- |
| [View addresses](/products/wallet/governance-and-controls/address-book/manage-address-book#list-addresses-via-the-console) | ✅ | ✅ | ✅ | ✅ | 🔴 | ✅ |
| [Create addresses](/products/wallet/governance-and-controls/address-book/manage-address-book#add-an-address-via-the-console) | ✅ | ✅ | 🔴 | 🔴 | 🔴 | 🔴 |
| [Delete addresses](/products/wallet/governance-and-controls/address-book/manage-address-book#delete-a-counterparty-or-address-via-the-console) | ✅ | ✅ | 🔴 | 🔴 | 🔴 | 🔴 |
| Approve addresses | ✅ | ✅ | ✅ | ✅ | 🔴 | 🔴 |


### Counterparties

| Counterparties | Owner | Admin | Proposer | Approver | Viewer | Auditor |
|  --- | --- | --- | --- | --- | --- | --- |
| [View counterparties](/products/wallet/governance-and-controls/address-book/manage-address-book#list-and-get-counterparties-via-the-console) | ✅ | ✅ | ✅ | ✅ | 🔴 | ✅ |
| [Create counterparties](/products/wallet/governance-and-controls/address-book/manage-address-book#create-a-counterparty-via-the-console) | ✅ | ✅ | 🔴 | 🔴 | 🔴 | 🔴 |
| [Update counterparties](/products/wallet/governance-and-controls/address-book/manage-address-book-api#update-a-counterparty-via-the-api) | ✅ | ✅ | 🔴 | 🔴 | 🔴 | 🔴 |
| [Delete counterparties](/products/wallet/governance-and-controls/address-book/manage-address-book#delete-a-counterparty-or-address-via-the-console) | ✅ | ✅ | 🔴 | 🔴 | 🔴 | 🔴 |


### Policies

| Policies | Owner | Admin | Proposer | Approver | Viewer | Auditor |
|  --- | --- | --- | --- | --- | --- | --- |
| View policy rules | ✅ | ✅ | ✅ | ✅ | 🔴 | ✅ |
| [Create policy rules](/products/wallet/governance-and-controls/policies/manage-policies#create-a-policy-via-the-console) | ✅ | ✅ | 🔴 | 🔴 | 🔴 | 🔴 |
| [Delete policy rules](/products/wallet/governance-and-controls/policies/manage-policies#delete-a-policy-via-the-console) | ✅ | ✅ | 🔴 | 🔴 | 🔴 | 🔴 |
| Approve policy rules | ✅ | ✅ | ✅ | ✅ | 🔴 | 🔴 |


### Transactions

| Transactions | Owner | Admin | Proposer | Approver | Viewer | Auditor |
|  --- | --- | --- | --- | --- | --- | --- |
| [View transactions](/products/wallet/transactions/view-and-track-transactions) | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| [Create transactions](/products/wallet/transactions/send-assets#send-a-payment-via-the-console) | ✅ | ✅ | ✅ | 🔴 | 🔴 | 🔴 |
| [Freeze and unfreeze transactions](/products/wallet/compliance/freeze-and-unfreeze-transactions#freeze-an-individual-transaction-via-the-console) | ✅ | ✅ | 🔴 | 🔴 | 🔴 | ✅ |
| [Approve transactions](/products/wallet/get-started/console/send-your-first-transaction#approve-the-transaction) | ✅ | ✅ | ✅ | ✅ | 🔴 | 🔴 |


### API credentials

| API credentials | Owner | Admin | Proposer | Approver | Viewer | Auditor |
|  --- | --- | --- | --- | --- | --- | --- |
| View credentials | ✅ | ✅ | 🔴 | 🔴 | 🔴 | ✅ |
| [Create credentials](/products/wallet/organization-and-access/api-credentials/manage-api-credentials#create-api-credentials-via-the-console) | ✅ | ✅ | 🔴 | 🔴 | 🔴 | 🔴 |
| [Update credentials](/products/wallet/organization-and-access/api-credentials/manage-api-credentials#view-and-edit-credentials-via-the-console) | ✅ | ✅ | 🔴 | 🔴 | 🔴 | 🔴 |
| Enable credentials | ✅ | ✅ | 🔴 | 🔴 | 🔴 | 🔴 |
| [Disable credentials](/products/wallet/organization-and-access/api-credentials/manage-api-credentials#disable-a-credential-via-the-console) | ✅ | ✅ | 🔴 | 🔴 | 🔴 | 🔴 |
| [Delete credentials](/products/wallet/organization-and-access/api-credentials/manage-api-credentials#delete-a-credential-via-the-console) | ✅ | ✅ | 🔴 | 🔴 | 🔴 | 🔴 |


### Wallet connect

| Wallet connect | Owner | Admin | Proposer | Approver | Viewer | Auditor |
|  --- | --- | --- | --- | --- | --- | --- |
| [View connections](/products/wallet/integrations-and-monitoring/connections#view-connections-via-the-console) | ✅ | ✅ | ✅ | ✅ | 🔴 | ✅ |
| [Create connections](/products/wallet/integrations-and-monitoring/connections#open-a-new-connection-via-the-console) | ✅ | ✅ | ✅ | 🔴 | 🔴 | 🔴 |
| Update connections | ✅ | ✅ | ✅ | 🔴 | 🔴 | 🔴 |
| [Disconnect connections](/products/wallet/integrations-and-monitoring/connections#disconnect-from-a-dapp-or-service-via-the-console) | ✅ | ✅ | ✅ | 🔴 | 🔴 | 🔴 |
| Accept connections | ✅ | ✅ | ✅ | 🔴 | 🔴 | 🔴 |
| Reject connections | ✅ | ✅ | ✅ | 🔴 | 🔴 | 🔴 |


### Webhooks

| Webhooks | Owner | Admin | Proposer | Approver | Viewer | Auditor |
|  --- | --- | --- | --- | --- | --- | --- |
| [Create webhooks](/products/wallet/integrations-and-monitoring/webhooks/manage-webhooks#create-a-webhook-via-the-console) | ✅ | ✅ | 🔴 | 🔴 | 🔴 | 🔴 |
| [View webhooks](/products/wallet/integrations-and-monitoring/webhooks/manage-webhooks#view-webhooks-via-the-console) | ✅ | ✅ | 🔴 | 🔴 | 🔴 | ✅ |
| [Delete webhooks](/products/wallet/integrations-and-monitoring/webhooks/manage-webhooks#delete-a-webhook-via-the-console) | ✅ | ✅ | 🔴 | 🔴 | 🔴 | 🔴 |


### Asset sweeping (workflows)

| Workflows | Owner | Admin | Proposer | Approver | Viewer | Auditor |
|  --- | --- | --- | --- | --- | --- | --- |
| [Create workflows](/products/wallet/vaults-and-wallets/asset-sweeping/configure-asset-sweeping#create-a-sweep-configuration-via-the-console) | ✅ | ✅ | 🔴 | 🔴 | 🔴 | 🔴 |
| [View workflows](/products/wallet/vaults-and-wallets/asset-sweeping/configure-asset-sweeping#monitor-sweep-runs-via-the-console) | ✅ | ✅ | 🔴 | 🔴 | 🔴 | ✅ |
| [Update workflows](/products/wallet/vaults-and-wallets/asset-sweeping/configure-asset-sweeping#update-a-sweep-via-the-console) | ✅ | ✅ | 🔴 | 🔴 | 🔴 | 🔴 |
| [Delete workflows](/products/wallet/vaults-and-wallets/asset-sweeping/configure-asset-sweeping#delete-a-sweep-via-the-console) | ✅ | ✅ | 🔴 | 🔴 | 🔴 | 🔴 |


### Audit configurations

| Audit configurations | Owner | Admin | Proposer | Approver | Viewer | Auditor |
|  --- | --- | --- | --- | --- | --- | --- |
| View audit configurations | ✅ | ✅ | 🔴 | 🔴 | ✅ | ✅ |
| [Update audit configurations](/products/wallet/integrations-and-monitoring/audit-logging#configure-the-firehose-connection-via-the-console) | ✅ | ✅ | 🔴 | 🔴 | 🔴 | 🔴 |