Roles and permissions
Who can see and do what: the fifteen roles, the eight levels of access, how an organisation narrows them, and who performs key actions such as account resets, review chains, import promotion, fund migrations, LP emails and messages, data-room sharing, and wire instructions.
How access is decided
Every screen and every action asks the same question before it runs: does this person’s role hold enough authority over this kind of record? The answer comes from a permission matrix — a grid of roles down one side and areas of the product along the other — and it is consulted again on every request. Nothing is decided once at sign-in and trusted afterwards.
That matters for two reasons an auditor will care about. Removing someone’s access takes effect on their next click rather than at their next sign-in. And a link copied out of one person’s browser and pasted into another’s does not carry their authority with it: the second person is asked the same question and gets their own answer.
The eight levels
Authority is graded rather than on-or-off. Each level includes everything below it, so a role that may approve may also read.
| Level | What it allows |
|---|---|
| None | No access. The area does not appear, and a direct link is refused. |
| Metadata | That a record exists, and little else — a document’s name and date without its contents. |
| Read | See the records, but change nothing. |
| Contribute | Add new records without altering what is already there. |
| Edit | Create and change records. |
| Review | Put work forward for approval, and send it back. |
| Approve | Sign off. This is the level that makes a figure official. |
| Administer | Configure the area itself, including who else may use it. |
The roles
Fifteen roles ship as defaults. The first eleven work inside the firm; the last four are outside it and see only their own records.
| Role | Who it is for |
|---|---|
| Platform admin | The operator of the platform itself. Scoped to the life cycle of an organisation, not to its contents. |
| Org admin | Configures the firm: users, roles, integrations, and security settings. |
| Fund manager | The general partner’s decision-maker. Approves capital activity and fund economics. |
| Fund controller | Reviews the numbers before they are approved, and owns the close. |
| Fund accountant | Prepares the work: entries, accruals, allocations, reconciliations. |
| Fund administrator | An outsourced administrator working inside the firm’s books, with the same preparation duties. |
| Investor relations | Owns the investor relationship: the register, communications and the portal, with read access to the numbers. |
| Tax advisor | Reads what tax work requires, limited to the funds they are engaged on. |
| Auditor | Reads what an audit requires, limited to the funds and periods they are engaged on. Changes nothing. |
| Legal counsel | Works the legal record — clauses, side letters, consents, transfers, holds — within their engagement. |
| LPAC member | A limited partner sitting on the advisory committee, who sees committee material alongside their own investor record. |
| Limited partner | Sees their own commitments, capital account, statements and documents. |
| LP signatory | The person at an investor who signs. Executing a subscription requires this role. |
| LP finance | The finance contact at an investor, who needs the numbers but does not sign subscriptions. |
| Portfolio company user | Someone at a portfolio company submitting their own reporting, who sees nothing of the fund. |
Narrowing a role for your firm
The defaults are a starting point, not a ceiling. An organisation can narrow what a role holds in a given area, and the narrowed answer is the one every screen and action uses from then on — including the navigation, so a person is not shown a door that will refuse them.
Narrowing is recorded per organisation. Another firm on the platform is unaffected, and the change is written to the audit trail like any other.
Who does what in key workflows
Some actions belong to particular roles, usually with a condition that the role alone cannot satisfy. These are the defaults; narrowing a role narrows the action with it.
| Action | Who, by default | Also required |
|---|---|---|
| Send a member a password reset email | Org admin | Another active member whose email is confirmed, and an authenticator code from the last ten minutes. |
| Reset a member’s two-factor sign-in | Org admin | Another active member, and an authenticator code from the last ten minutes. Not within 72 hours of the member’s own password reset: NAVdryx support handles that case, and an organisation whose only admin is locked out. |
| Configure a fund’s subscription review chain | Fund manager | — |
| Decide a subscription review stage | The roles the packet’s review chain names for that stage | Legal counsel and tax advisors only on funds they are engaged on. Where the stage requires a separate reviewer, someone who neither created the packet nor decided an earlier stage. |
| Waive a subscription review stage | Fund manager | A stage the chain makes waivable, and a recorded reason. GP approval is never waived. |
| Activate a commitment | Fund manager | GP approval of the packet. |
| Promote an import | Fund controller | Not whoever uploaded the file, saved its column mapping, or validated it. |
| Open a fund migration | Fund accountant, fund administrator, or fund controller | — |
| Approve or void a migrated fund’s imported history | Fund manager or fund controller | Not whoever uploaded it. |
| Approve a migrated fund’s opening balances | Fund controller | Not whoever uploaded them. |
| Lock or abandon a fund migration | Fund controller | Locking needs an approved opening that ties out to the approved history; abandoning is refused once commitments have been recorded from the register. |
| Change a fund’s LP email settings, or manage LP groups | Org admin, fund manager, fund controller, fund accountant, investor relations, or fund administrator | Access to the investor registry across the whole organisation, so engagement-scoped roles have none. |
| Read the LP messages inbox | Org admin, fund controller, fund accountant, or fund administrator, and the two roles that can reply | — |
| Reply to, assign, close, or reopen an LP message thread | Fund manager or investor relations | A thread can be assigned only to someone who can reply on its fund. |
| Share a document into LP data rooms, or revoke a share | Investor relations | Able to open the document in the vault. A document bound to a fund goes only to that fund’s investors, and a document that belongs to one investor only to that investor. |
| Request a new or changed wire instruction | Fund manager, fund controller, or fund administrator | From the fund’s page: a receiving account for that fund, or a payout account for one of its investors. It starts pending verification. Org admins and investor relations have no access to wire instructions, and a fund accountant sees only that they exist. |
| Verify a wire instruction by call-back | Fund manager, fund controller, or fund administrator | Not the requester. For an LP payout account, a call to a number on file from before the request. |
| Approve and activate a wire instruction, including an LP payout account | Fund manager or fund controller | Neither the requester nor the verifier, and an authenticator code from the last ten minutes. A newly active payout account is then held for 72 hours. |
| Propose or approve a change of call-back number | Fund manager or fund controller | The approver is not the proposer, and each enters an authenticator code from the last ten minutes. Either role can reject a proposal. |
| Release a payment to an LP payout account | Org admin, fund manager, or fund controller | Not whoever initiated the payment, and not while the account’s 72-hour hold runs. |
Auditors, tax advisors, and legal counsel can’t read LP messages. On the investor side, the LP roles write messages only on their own investor’s threads, and a suspicious-email report is visible there only to the person who filed it.
See Security and trust for account recovery, Onboard an investor for review chains, Migrate an existing fund for migrations, Set up LP emails for LP email settings and groups, and Issue a distribution for payout accounts and call-back numbers.
Where more than a role is required
Some decisions need more than authority. Three rules sit on top of the matrix and cannot be satisfied by a role alone.
- Separation of duties. The person who prepares a capital event or a calculation run cannot approve it, and an import is promoted by someone other than whoever uploaded, mapped, or validated it. The second signature has to be a different one. A subscription packet follows its fund’s review chain, which can require each stage to be decided by someone who has not yet acted on the packet — see Onboard an investor.
- Engagement scope. An auditor, a tax advisor and legal counsel see only the funds and periods they are engaged on. The engagement is a record, not a setting on the person.
- Entitlement. An investor-side role is scoped to that investor. Holding the limited-partner role does not show you limited partners in general; it shows you the investor you are attached to.
Emergency access exists for the case where nobody who should be able to act is available. It is time-boxed, it announces itself, and everything done under it is marked as such in the audit trail. See Security and trust.