> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.lipafy.xyz/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.lipafy.xyz/_mcp/server.

# Team Roles & Governance

> Role-based access control, separation of duties, and approval authorities in your Lipafy workspace.

In Lipafy workspaces, permissions are strictly enforced at the API layer. Hiding a button in the UI is never the security boundary. Team members can be assigned granular roles based on operational responsibilities:

---

## 👥 Workspace Roles & Permissions Matrix

| Permission                          | Owner | Administrator | Finance Manager | Approver | Operator | Auditor |
| :---------------------------------- | :---: | :-----------: | :-------------: | :------: | :------: | :-----: |
| **Manage Workspace & Billing**      |   ✅   |       ❌       |        ❌        |     ❌    |     ❌    |    ❌    |
| **Invite / Remove Team Members**    |   ✅   |       ✅       |        ❌        |     ❌    |     ❌    |    ❌    |
| **Create & Edit Spending Policies** |   ✅   |       ✅       |        ❌        |     ❌    |     ❌    |    ❌    |
| **Manage API Keys & Scoping**       |   ✅   |       ✅       |        ❌        |     ❌    |     ❌    |    ❌    |
| **Register & Verify Beneficiaries** |   ✅   |       ✅       |        ✅        |     ❌    |     ❌    |    ❌    |
| **Create Payment Intents (Drafts)** |   ✅   |       ✅       |        ✅        |     ❌    |     ✅    |    ❌    |
| **Approve Requests Within Limit**   |   ✅   |       ❌       |        ✅        |     ✅    |     ❌    |    ❌    |
| **Sign Dual-Custody Multi-Sig**     |   ✅   |       ❌       |        ✅        |     ✅    |     ❌    |    ❌    |
| **View Audit Logs & Telemetry**     |   ✅   |       ✅       |        ✅        |     ✅    |     ✅    |    ✅    |
| **Export Financial CSV / Receipts** |   ✅   |       ✅       |        ✅        |     ✅    |     ❌    |    ✅    |

---

## 🛡️ Separation of Duties

When separation of duties is active for an organization:

1. **No Self-Approval:** An Operator or Agent who drafts a payment intent cannot sign off or approve that same intent, even if they hold elevated credentials on another system.
2. **Dual-Custody Thresholds:** High-value payouts (e.g. above KES 50,000) require two distinct authorized signatures from different individuals (e.g. Finance Manager + Workspace Owner).
3. **Immutable Snapshots:** Approvers review a sealed, cryptographic snapshot of the payment intent (amount, destination, fee, narrative). If any detail changes between review and signature, the approval is automatically invalidated.
4. **Auditor View:** Auditors have complete read-only access to all payment histories, webhook delivery logs, fee breakdowns, and IP/user agent records without the capability to move funds or alter policy configurations.