Roles and permissions

Who can sign in, and what they are allowed to do. This page is for operators and administrators.

How access works

1. The identity provider assigns roles when a person signs in.
2. Each role grants permissions.
3. The wallet shows a screen only when the account has the permission that screen requires. Other screens stay hidden.

Which organization a person belongs to is set in Company settings.

Default roles

These are the default roles. A deployment can:

• Rename any role to match your organization’s terminology
• Create new custom roles with specific permission combinations
• Modify which permissions are assigned to each role
• Adjust the configuration to fit your organizational needs

If this deployment changed the defaults, the lists below will not match what people see. The Helm rolesPermissions values are the source for that deployment.

ADMIN

• Full system access to all companies and features
• Permissions: ADMIN (grants all other permissions)

COMPANY_ADMIN

• Company management for your own company
• Complete DID and key operations
• Credential issuance and management
• Permissions:
  • CREATE_DID - Create new DIDs
  • CREATE_KEY - Generate new keys
  • CREATE_CREDENTIAL - Issue credentials
  • SIGN_CREDENTIAL- Sign credentials (mandatory for creating as well)
  • READ_DID - View DIDs
  • READ_KEY - View keys
  • READ_CREDENTIAL - View credentials
  • UPDATE_CREDENTIAL - Revoke, suspend, or modify credentials
  • UPDATE_DID - Modify DIDs
  • UPDATE_KEY - Change key settings
  • EXPORT_KEY - Export a key
  • DELETE_KEY - Delete a key
  • CREATE_CREDENTIAL_TEMPLATE - Create credential templates
  • UPDATE_CREDENTIAL_TEMPLATE - Edit credential templates
  • DELETE_CREDENTIAL_TEMPLATE - Delete credential templates
  • UPDATE_COMPANY - Edit company settings
  • READ_AUDIT - View audit log

KEY_OPERATOR

• Key settings and credential signing
• Read access to keys and the audit log
• With these default permissions the Identities and Generic Credentials menu items stay hidden, because those screens require READ_DID and READ_CREDENTIAL. An administrator can add the read permissions if this role should open those screens.
• Permissions:
  • CREATE_CREDENTIAL - Issue credentials
  • SIGN_CREDENTIAL - Sign credentials with keys (also required to issue)
  • UPDATE_KEY - Modify key settings
  • READ_KEY - View keys
  • READ_AUDIT - View audit log

CREDENTIAL_MANAGER

• Credential lifecycle management
• Signing credentials with existing keys
• Permissions:
  • SIGN_CREDENTIAL - Sign credentials (needed for status changes like revocation)
  • UPDATE_CREDENTIAL - Revoke, suspend, or modify credentials
  • READ_CREDENTIAL - View credentials
  • READ_AUDIT - View audit log

AUDITOR

• Read-only access to all wallet data
• Cannot make changes to any resources
• Permissions:
  • READ_DID - View DIDs
  • READ_KEY - View keys
  • READ_CREDENTIAL - View credentials
  • READ_AUDIT - View audit log

How permissions are applied

The wallet uses a permission-based authorization system:

1. Roles are assigned to users by your authentication system (OAuth/OIDC)
2. Roles grant permissions according to your system’s configuration
3. Permissions control access to specific operations and UI features

What people see:

• A button or menu item is shown only when the account can use it
• Everything else stays hidden
• Some actions need more than one permission. Issuing a credential needs both CREATE_CREDENTIAL and SIGN_CREDENTIAL
• The role decides what that person can do

Example with default roles:

• A CREDENTIAL_MANAGER can revoke, suspend, and co-sign credentials. Creating a new credential also needs CREATE_CREDENTIAL, which this role does not have by default.
• A KEY_OPERATOR can sign and update keys. Opening Identities or Generic Credentials also needs the matching read permission.
• Only COMPANY_ADMIN and ADMIN can save company settings

Checking an account:

1. Open the account menu (person icon) and choose Profile
2. The assigned role is displayed
3. The role and permissions shown there are what that account can do

Customizing roles

The wallet’s permission system is fully configurable. System administrators can customize roles through the Helm values configuration (rolesPermissions section):

What can be customized:

• Role names: Rename any role to match your organization’s terminology (e.g., “SUPERVISOR” instead of “KEY_OPERATOR”)
• Permission assignments: Add or remove permissions from any role
• New roles: Create entirely new roles with custom permission combinations
• Permission combinations: Mix and match the available permissions to fit your workflow

Available permissions to assign:

• ADMIN - Master permission granting all other permissions
• CREATE_DID, READ_DID, UPDATE_DID - DID operations
• CREATE_KEY, READ_KEY, UPDATE_KEY, EXPORT_KEY, DELETE_KEY - Key operations
• CREATE_CREDENTIAL, READ_CREDENTIAL, UPDATE_CREDENTIAL - Credential operations
• CREATE_CREDENTIAL_TEMPLATE, UPDATE_CREDENTIAL_TEMPLATE, DELETE_CREDENTIAL_TEMPLATE - Credential templates
• SIGN_CREDENTIAL - Sign credentials with keys
• SIGN_PRESENTATION - Sign a presentation of credentials (assign it to a role if that flow should be used)
• CREATE_COMPANY - Create companies (included with ADMIN; not granted to other default roles)
• UPDATE_COMPANY - Modify company settings
• READ_AUDIT - View audit log

Example custom configuration:

rolesPermissions:
  SUPERVISOR:  # Custom role name
    - CREATE_DID
    - CREATE_KEY
    - CREATE_CREDENTIAL
    - SIGN_CREDENTIAL
    - READ_AUDIT
  COMPLIANCE_OFFICER:  # Another custom role
    - READ_DID
    - READ_KEY
    - READ_CREDENTIAL
    - READ_AUDIT

This flexibility allows you to adapt the wallet to your organization’s specific security policies and operational workflows.

Permissions

A role is a set of these permissions:

• ADMIN - Full system access across all companies
• CREATE_DID - Create new organizational identifiers
• CREATE_KEY - Generate cryptographic keys
• CREATE_CREDENTIAL - Issue new credentials
• SIGN_CREDENTIAL - Sign credentials with keys
• SIGN_PRESENTATION - Sign a presentation. None of the default roles include this
• READ_DID - Read identifiers
• READ_KEY - Read keys
• READ_CREDENTIAL - Read credentials
• UPDATE_DID - Update identifiers
• UPDATE_KEY - Update keys
• UPDATE_CREDENTIAL - Revoke, suspend, or reactivate credentials, and change whether a credential is public
• CREATE_CREDENTIAL_TEMPLATE - Create credential templates
• UPDATE_CREDENTIAL_TEMPLATE - Update credential templates
• DELETE_CREDENTIAL_TEMPLATE - Delete credential templates
• CREATE_COMPANY - Create companies. The default ADMIN role includes this through ADMIN
• UPDATE_COMPANY - Edit company settings
• READ_AUDIT - View the audit log

Note: Some operations require multiple permissions. For example, issuing a credential requires both CREATE_CREDENTIAL and SIGN_CREDENTIAL.

Default permission matrix

Choosing a role

Choose AUDITOR when:

• User only needs to review/inspect wallet data
• Compliance or security audit requirements
• Read-only access is sufficient

Choose CREDENTIAL_MANAGER when:

• User revokes, suspends, or co-signs credentials
• No need to create DIDs, keys, or new credentials
• Focus on credential status

Choose KEY_OPERATOR when:

• User manages cryptographic keys
• Needs to issue credentials frequently
• Trusted with key operations

Choose COMPANY_ADMIN when:

• User manages all aspects of a single company
• Needs full control within their organization
• Should not access other companies

Choose ADMIN only for:

• System administrators
• Multi-company management
• Full system access required

What each action needs

Create your first identity

Required: CREATE_DID (ADMIN, COMPANY_ADMIN)

1. Go to Identities
2. Click Add default, or Add identity and enter a domain
3. Confirm the resulting did:web
4. Click Add Key on that identity

Issue a credential

Required: CREATE_CREDENTIAL + SIGN_CREDENTIAL (ADMIN, COMPANY_ADMIN, KEY_OPERATOR)

1. Go to Generic Credentials
2. Click Issue credential
3. Choose a template, or fill the credential fields
4. Select the signing identity and signing key
5. Upload your key file if this key uses one
6. Finish signing. If the key has several controller groups, the other groups approve from the bell

Revoke a Credential

Required: UPDATE_CREDENTIAL (ADMIN, COMPANY_ADMIN, CREDENTIAL_MANAGER)

1. Go to Generic Credentials
2. Find the credential
3. Open its actions and choose Revoke
4. Enter reason (optional)
5. Confirm revocation

Add a key with controller groups

Required to start: CREATE_KEY (ADMIN, COMPANY_ADMIN). Other people only need to be listed and provide their own secret.

1. Go to Identities
2. Click Add Key on an identity
3. Choose Generate, or Import an exported key
4. Choose the key type and purposes. An import takes the type from the file
5. On Setup, choose Complex setup
6. Add controller groups and the people in each group
7. Generate your key file, or use the service secret, and finish
8. The other people approve from the bell and set up their own secrets

Export a key

Required to start: EXPORT_KEY (ADMIN, COMPANY_ADMIN). Controllers approve with their secrets and do not need this permission. The person who starts it does not need to hold a part of the key.

1. Go to Identities
2. Open the key menu and choose Export Key
3. Set a passphrase of at least 12 characters and confirm it
4. Submit the request and provide your secret if you hold a part that uses a key file
5. Download the file from the finished request before it expires. The name starts with exported-key-

Delete a key

Required to start: DELETE_KEY (ADMIN, COMPANY_ADMIN). Controllers approve with their secrets and do not need this permission.

1. Go to Identities
2. Open the key menu and choose Delete Key
3. Read the warning. Credentials signed with the key can no longer be verified
4. Submit the deletion and provide your secret if you hold a part that uses a key file

View Audit Log

Required: READ_AUDIT (ADMIN, COMPANY_ADMIN, KEY_OPERATOR, CREDENTIAL_MANAGER, AUDITOR)

1. Go to Audit Log
2. Review recent operations
3. Use filters to narrow results
4. Click entries for details

Edit Company Settings

Required: UPDATE_COMPANY (ADMIN, COMPANY_ADMIN)

1. Open the account menu and choose Company Settings
2. Modify the company name, domains, or users
3. Click Save changes
4. Verify changes applied

Reviewing and removing access

Principle of Least Privilege

Only grant permissions needed for each person’s role. Assign the most restrictive role that allows users to perform their job duties:

Permission Grant Strategy:

• Start restrictive: Begin with AUDITOR or CREDENTIAL_MANAGER
• Promote as needed: Grant higher permissions when justified
• Separate duties: Don’t give everyone COMPANY_ADMIN access
• Review regularly: Quarterly access reviews (see below)

Reviewing User Access

Monthly access review:

1. List all users with wallet access
2. Verify each person still needs access
3. Check their role assignments are appropriate
4. Remove access for departed employees
5. Adjust permissions for role changes

Questions to ask:

• Does this person still work here?
• Is their role still the same?
• Have they used the wallet recently?
• Do they need all the permissions they have?

Removing Access

When someone leaves the organization:

Immediate (same day):

1. Remove from OAuth/OIDC user list
2. Remove from company users list
3. Verify they cannot log in

Within 24 hours:

4. Rotate any keys they controlled
5. Review credentials they issued
6. Check audit log for recent activity
7. Document access removal

Within 1 week:

8. Review multi-controller keys they participate in
9. Add new controller if needed
10. Ensure business continuity