Governance and permissions
A vault’s trust model includes both investment rules and the authorities that can change or pause supported operations. “Non-custodial” does not mean that all actions are permissionless or that the deployed program can never be upgraded.
Vault roles
The admin configures a draft vault and queues supported changes after activation. The executor moves assets through approved paths. The guardian can reduce risk and restrict operations. Anyone can submit particular permissionless instructions, such as eligible funding or execution of a matured change, when all checks pass.
The role table describes actions. These roles are separate from a wallet signing a depositor transaction.
Delayed changes
Supported live changes can be queued on-chain and become executable after the applicable delay. Adding a leg or re-pinning an upgraded adapter can use a separate delay from other settings. Read the selected vault’s settings rather than assuming one common duration.
A delay makes a pending change visible before it executes. It does not guarantee that every depositor can finish an exit during that time: liquidity, coverage and incident restrictions still apply.
Immediate restrictions
Supported reductions can lower caps and weights, close a position to new money, remove an executor or mark a position impaired. Pause scopes can stop deposits, allocations or withdrawal funding. These powers can be useful during an incident and can also prevent an action you intended to perform.
The guardian cannot unpause or raise limits. Resuming and raising risk have their own rules. Saying “the guardian can only reduce risk” should not be read as “the guardian cannot interrupt withdrawals.”
Admin handover
Admin transfer uses proposal and acceptance by the new admin. This can transfer control to a multisig, but the existence of a two-step handover does not prove that the current admin is a multisig or that its threshold is appropriate.
Registry and upgrade authority
Adapter approval at the global registry is distinct from adding that adapter to your vault. Removing approval and re-pinning are also separate events. Read these controls at the relevant layer.
The Solana program’s upgrade authority is distinct from ordinary vault roles. A claim that a vault admin cannot set prices does not prove that an upgrade authority cannot change program logic. Check who controls upgrades, whether that authority is retained, and what evidence supports its governance process.
Investor review
Identify current roles, delays, pending changes, pause status and upgrade authorities. Examine whether your planned exit relies on an operator that can become unavailable. Review due diligence before treating contract limits as a complete description of trust.