Roles & Access

Wallet access follows the same relationships the rest of the workspace already runs on. There's no separate permission system to configure, and no dedicated "sharing" step where one person grants another visibility into their wallet.

Member

Sees their own wallet, their own pockets, their own withdrawal history. Requests withdrawals. Nothing about another member's finances is visible, not even a sponsor's.

Team Leader

Sees every wallet that belongs to their workspace, the members whose leader_email points to them. From there, a leader credits income, approves or rejects withdrawal requests, and reviews payout receipts as they come in. A leader's authority stops at their own workspace. They don't see wallets that belong to someone else's team.

Director

Gets workspace-level access across every workspace assigned to them, not just one. That covers everything a team leader can do, plus the one action a leader can't take: resolving a dispute once a withdrawal lands in Needs review. If a leader flags a receipt mismatch and isn't sure how to close it out, a director makes the final call.

Why it's structured this way

There's no wallet_access_grants table to manage. Access comes from the relationship that already exists, workspace ownership for leaders, workspace assignment for directors, checked on every request rather than cached in a permissions table that could drift out of date. If someone's role changes, their wallet access changes with it automatically.