Operator

The role for the team doing the work. It initiates operations and manages the contacts that get paid, but it does not sign or approve other people’s operations.

Can / cannot

Can

View everything: transactions, balances, reports
Initiate payments, withdrawals, and conversions
Create payment links
Create and edit contacts, and those contacts’ accounts
Send notifications to customers
Create their passkey and use it to sign their own operations

Cannot

Sign another person’s operations
Approve or reject pending operations
Manage the company’s own accounts and wallets
Invite users or change roles
Change the approval policy rules

Contact accounts yes, the company's own accounts no

An Operator user can add the bank account of a supplier they are going to pay, but cannot touch the company’s accounts: that belongs to Treasury Manager.

When to use it

For most of the team. An Operator user can get everything ready and set up, and have another person sign or approve it — which is exactly the control you want.

Still, signing with a passkey is not the same as approving: an Operator user signs their own operations to confirm them, but cannot authorize someone else’s. Keep this in mind when you define the rules: if you list an Operator user as an approver, the operation waits forever.

Next steps

Viewer — the step below, read-only.
Treasury Manager — who approves what an Operator user initiates.
The two ways to sign — signing your own is not approving someone else’s.