Module reference · Identity & security
x/roles — Roles
Role-based access control shared across the protocol's modules.
What it does
Inside x/roles
The roles module implements protocol-wide RBAC: named roles with defined capabilities, assignable to accounts, checked by other modules before privileged operations execute. Auditor rights, administrative operations, and specialized marketplace capabilities all resolve through role checks.
Centralizing authorization means access decisions are consistent, queryable, and governable — a role grant is a transaction, not a configuration file on someone's server.
Why it exists
The design rationale
Two dozen modules each inventing its own permission model would be unauditable. One RBAC module gives the protocol a single, inspectable answer to "who may do what" — and one governance surface to change it.
Interactions
How it connects to the rest of the chain
No module stands alone — these are the protocol surfaces this module depends on or serves.
- x/audit
Auditor status is a role that authorizes signing provider attributes.
- x/config
Configuration changes require appropriately-roled accounts.
- x/mfa
Privileged roles can be required to carry stronger authentication.
- x/veidregistry
Role grants can be conditioned on verified identity.
Key concepts
Terms that matter here
- Role
- A named bundle of capabilities assignable to accounts and checked by modules.
- Capability check
- The authorization gate a module runs before executing a privileged message.
Keep exploring