> For the complete documentation index, see [llms.txt](https://docs.familio.trade/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.familio.trade/the-product/roles-and-permissions.md). # Roles and permissions Four on-chain roles. The product never shows the contract's old internal name for co-pilot on the site; see [Contracts](/developers/contracts-and-addresses.md) for that once. ## Head Opens the family. Trades. Sets rules. Names co-pilots and mods. Can evict (which pays the member their full slice). Can transfer the head seat. Can lock the crew (one-way). Can lower the performance fee, never raise it. The head is allow-listed through their own door at creation, so they can always deposit and top up without a special unlock transaction. ## Co-pilot Extra wallets the head names **at creation** or later (unless the crew is locked). A co-pilot can: * buy and sell for the family, * distribute payouts, * pin a thesis note, * switch **trading** and **joins** off or on (`setLocks`). Turbo mode arms a swap-only browser **session key** for popup-free trading (works with a locked crew). See [Trading](/the-product/trading.md#turbo-mode-popup-free-trading). A co-pilot **cannot** change rules (door mode, caps, fee, ignored bags, tracked tokens, meta), evict anyone, name or remove crew, lock the crew, claim the head's fees, or work the door. They cannot stop anyone leaving — nobody except the protocol's 72-hour emergency pause can. ## Mod Door duty only. A mod can approve or decline escrowed join requests and manage the allow-list. Mods have no trading power. They sit outside crew lock: the head can still add or remove mods after the crew is frozen. ## Member Any address with shares > 0. Deposit (or top up), ride every trade pro-rata, claim payouts, toggle auto-send, leave with an in-kind slice. Members do not trade the pool. Existing members can top up even when the door is closed to newcomers (allow-list and current members skip the join-mode check). Joins-locked and the protocol trading pause still apply. ## Permissions matrix | Action | Head | Co-pilot | Mod | Member | | ----------------------------------------- | :------------: | :------------: | :------------: | :----------: | | Buy / sell (`swap`) | yes | yes | — | — | | Distribute payouts | yes | yes | — | — | | Pin a note | yes | yes | — | — | | Lock / unlock joins and trading | yes | yes | — | — | | Change door mode, caps, fee, ignored bags | yes | — | — | — | | Track an airdropped token | yes | — | — | — | | Name / remove co-pilots | yes\* | — | — | — | | Lock the crew (one-way) | yes | — | — | — | | Transfer head | yes\* | — | — | — | | Name / remove mods | yes | — | — | — | | Approve / decline joins, allow-list | yes | — | yes | — | | Evict a member (full slice paid) | yes | — | — | — | | Claim head fees | yes | — | — | — | | Join / top up | if door allows | if door allows | if door allows | yes (top up) | | Leave / `leaveWith` | yes | yes | yes | yes | | Claim payouts, auto-send | yes | yes | yes | yes | \* After **crew lock**, the head cannot add a new co-pilot and can only pass the head seat to a current co-pilot. Removing co-pilots stays allowed. ## Crew lock **Crew** = head + co-pilots (+ mods). **Crew lock** is a one-way switch, set at creation or later by the head (`lockCrew`). Once on: * nobody new can be granted co-pilot, * `transferHead` only accepts an address that is already a co-pilot, * removing co-pilots is still allowed, * mods are unaffected. If you lock the crew with **no** co-pilots, the head seat can never be handed over. Members see the lock on the door. The create wizard defaults to **locked** for every kind of family. Members join on the names they read on the door, so a crew that can change after the fact is the exception, not the norm. Turning the lock off is a deliberate choice: the wizard spells out what it means, the door shows **open crew** in gold with a line saying the head can hand the wheel to anyone at any time, and the head can still lock later from manage. ### Open crews give notice (v2 families) In a family from the second factory with an unlocked crew, naming a co-pilot does not hand them the wheel on the spot. The name is announced on the door, in the feed and in Telegram, and takes effect **48 hours later**; until then they cannot trade, arm turbo, pin, lock or pay out. Removing a co-pilot is still immediate. Naming them again does not restart the clock; withdrawing the name before it lands leaves no trace. Locking the crew while a name is pending cancels it — the lock's promise covers pending names too. Co-pilots named at creation are immediate, as before. ## Head transfer `transferHead(newHead)`. The new head needs their own shares if `minHeadShareBps` is set — the skin check reads `shares[head]`, so an empty new head cannot trade until they deposit. The old head's shares stay theirs unless they leave. In v2 families the outgoing head stays bound by the crew exit rule for 7 days (see [How a family works](/the-product/how-a-family-works.md#the-crew-leaves-last-v2-families)), and the new head is bound from the moment they take the seat. ## What nobody can do * The head cannot withdraw a member's funds. * The head cannot block an exit. * A co-pilot cannot become a backdoor admin. * Shares cannot be transferred to another wallet in v1. To change wallets, leave and rejoin from the new address (door rules apply). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.familio.trade/the-product/roles-and-permissions.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.