# Actors: Roles & Permissions All authorization resolves through `RiverAccessControls`, an external role module queried by every contract. Roles live in `src/types/Roles.sol`; eligibility (KYC) is separate, via per-token gates. ## Lender Deposits into classes and holds class tokens or the accumulating wrapper. Lenders interact only with the lender-facing surfaces (`requestDeposit`, `requestRedeem`, `claimCoupon`, `wrap`, `requestUnwrap`, claims and cancels). No role required — eligibility is enforced by gates. ## Servicer / Keeper (`KEEPER_ROLE`) The operational actor: services deposits, processes exit queues, accrues and funds coupon, moves capital between the deal's cash and strategies, and keeps reporter attestations fresh. The contracts treat the keeper as **compromisable** — every keeper action is bounded on-chain (pinned pricing, value-neutrality checks, covenant enforcement, no arbitrary recipients). See the [Security Model](/security). ## Structure Admin (`STRUCTURE_ADMIN_ROLE`) Deal-level configuration: registering classes and strategies, wiring exit queues, rotating reporters (value-neutrally — the swap settles first and re-baselines), setting subordination floors, gates, and the wrapper's optimism dial. Governance holds this role. ## Upgrader (`UPGRADER_ROLE`) Authorizes UUPS implementation upgrades on every upgradeable contract. Held by the timelocked governance authority. See [Proxies & Upgradeability](/technical/proxies). ## Pauser `RiverPause` provides the emergency stop, gated by its own authority. Pause is for incident response; claims of already-owed funds are designed to survive governance and gate changes. ## Gates and eligibility Each class token and wrapper consults an `IGate` module per action: | Action id | Checked on | When | | --- | --- | --- | | `DEPOSIT` | The share-receiving controller | Class deposit request | | `WRAP` | The wrapper-share receiver | Wrapper entry | | `REDEEM` | The initiator | Class redeem / wrapper unwrap request | | `RECEIVE` | The transfer recipient | Any share transfer | **Ungated paths**: claims, cancels, and queue processing. Queued or owed capital stays reachable through eligibility changes. A zero gate address disables gating for that token. ## Trust summary | Actor | Can | Cannot | | --- | --- | --- | | Keeper | Delay servicing, choose exit order (selective queue), under-fund coupon (haircuts that interval) | Misprice entries/exits, extract value via movements, redirect funds, forge valuations past the attestation checks | | Structure admin | Reconfigure modules, rotate reporters | Seize NAV, skip conservation, freeze owed claims | | Upgrader (timelocked) | Replace implementations after the delay | Act instantly; bypass the timelock | | Gate operator | Block new deposits/exits/transfers for an address | Freeze claims, cancels, or queued capital |