Admins and roles
Assign administrative roles for the organisation's system on the selected network.
Admins & roles grants and revokes on-chain roles in the organisation's system access manager on the selected network. These roles authorize privileged contract calls and control access to the corresponding Console features.
The organisation's Owner, Admin, and Member memberships are separate from these on-chain roles. Check both when a person needs access: organisation membership alone does not grant a contract role.
Organisation membership and on-chain roles grant different permissions. Console features can check either, and privileged contract calls require the relevant on-chain role.
The organisation's Audit trail records role grants and revocations. It identifies the account that submitted the change and its role at the time.
Select the role that covers the person's job. Admin grants the system's broadest authority, including the power to grant and revoke every other role. Treat it as the role of last resort, held by as few accounts as practical. System Manager covers day-to-day component configuration, including applying system updates. Gas Manager covers transaction funding and gas sponsorship on Transaction funding. Feeds Manager covers registering and publishing on-chain data feeds. Identity Manager and Claim Issuer both touch KYC and identity records, split between managing identity registration and issuing or revoking specific claims. Compliance Manager configures and scopes compliance modules. Custodian covers custody-detail visibility. Token Manager covers token-level operations like sales and yield schedules. Asset Designer covers asset classes and instrument templates, including their structures, without token minting or contract-upgrade authority. Granting Admin to someone who only ever needs to publish feeds hands them every other role's authority along with it; grant the specific role that matches the job instead.
Steps
Open Admins & roles
Open Organisation settings, then Admins & roles. Confirm the selected network before changing access, since a role change applies only to the system deployed on that network.
Screen equivalent: the page lists administrative role assignments for the organisation system on the selected network.
Change a role
Open the relevant administrator, select the supported role change, and confirm it when the Console asks. A grant or revoke is a single on-chain call: there is no draft state and no separate publish step, so the change is live the moment the transaction confirms.
Troubleshooting
The table is empty or Add admin is disabled
Your account does not have permission to view or grant roles for this organisation's system. Ask a current role holder to check your access rather than looking for a role-name mismatch.
A revoked account can still act
Confirm you revoked the role on the network the account was actually using. A role granted on one network gives no authority on another, and a revocation on the wrong network leaves the original grant untouched.
No account can grant or revoke a role anymore
This is what a last-Admin lockout looks like: a grant or revoke on this page always requires the Admin role. If no account holds Admin on the affected network, the page's own controls cannot fix it. Escalate to a platform administrator rather than looking for another Console path around it.
Choosing which role to grant a new administrator
Match the role to the job rather than defaulting to Admin. Someone managing feed publication needs Feeds Manager, not Admin; someone running KYC review needs Identity Manager or Claim Issuer depending on whether they register identities or issue claims; someone configuring compliance rules needs Compliance Manager. Reserve Admin for the small number of accounts that need to grant and revoke other roles, since every Admin grant is also a grant of every other role's authority by extension.