Team Roles & Governance

In Lipafy workspaces, permissions are strictly enforced at the API layer. Hiding a button in the UI is never the security boundary. Team members can be assigned granular roles based on operational responsibilities:

👥 Workspace Roles & Permissions Matrix

Permission	Owner	Administrator	Finance Manager	Approver	Operator	Auditor
Manage Workspace & Billing	✅	❌	❌	❌	❌	❌
Invite / Remove Team Members	✅	✅	❌	❌	❌	❌
Create & Edit Spending Policies	✅	✅	❌	❌	❌	❌
Manage API Keys & Scoping	✅	✅	❌	❌	❌	❌
Register & Verify Beneficiaries	✅	✅	✅	❌	❌	❌
Create Payment Intents (Drafts)	✅	✅	✅	❌	✅	❌
Approve Requests Within Limit	✅	❌	✅	✅	❌	❌
Sign Dual-Custody Multi-Sig	✅	❌	✅	✅	❌	❌
View Audit Logs & Telemetry	✅	✅	✅	✅	✅	✅
Export Financial CSV / Receipts	✅	✅	✅	✅	❌	✅

🛡️ Separation of Duties

When separation of duties is active for an organization:

No Self-Approval: An Operator or Agent who drafts a payment intent cannot sign off or approve that same intent, even if they hold elevated credentials on another system.
Dual-Custody Thresholds: High-value payouts (e.g. above KES 50,000) require two distinct authorized signatures from different individuals (e.g. Finance Manager + Workspace Owner).
Immutable Snapshots: Approvers review a sealed, cryptographic snapshot of the payment intent (amount, destination, fee, narrative). If any detail changes between review and signature, the approval is automatically invalidated.
Auditor View: Auditors have complete read-only access to all payment histories, webhook delivery logs, fee breakdowns, and IP/user agent records without the capability to move funds or alter policy configurations.