1. How the Permission System Is Designed

Understanding OSL Institutional's permission system comes down to two dimensions: which Portfolios a role can access, and what actions that role can perform within the Portfolios it can access.

Access Level: Determines "Whose Books You Can See"

Every role belongs to one of two Access Levels:

• Institution level: Automatically has access to every Portfolio under the organization (including ones created in the future), without needing to specify individual Portfolios. Suited to roles with organization-wide responsibilities, such as company leadership or compliance/audit staff.

• Portfolio level: Can only access Portfolios that have been explicitly granted. When inviting a member with this type of role, you'll need to select which specific Portfolios they can access. Suited to day-to-day trading roles that only need to touch specific funding accounts.

In short: Institution level sees everything; Portfolio level sees only the specific books it's been granted.

Base Permissions: Determine "What You Can Do Where You Can See"

Within the Portfolios a role is authorized to access, what it can actually do is determined by its base permissions — there are 4 in total:

Each role has its own combination of base permissions, shown in the table below.

2. Role Overview

Role Details

Administrator — Institution level Has full access across the institution, including team management and security settings. This is the highest-privilege role. Suited to founders or the most senior person in the organization — it's best to keep the number of people holding this role to a minimum.

Trading Admin — Portfolio level Has full trading permissions within the Portfolios they're authorized for — can place trades themselves, and can also initiate withdrawals, strategy changes, and similar operations. Suited to whoever is fully responsible for managing a specific funding account.

Trader — Portfolio level Can execute trades and view data within the Portfolios they're authorized for, but cannot initiate withdrawals or change account settings. Suited to day-to-day trade execution staff who don't need access to move funds.

Approver — Institution level This role does not, by itself, grant approval authority — whether someone can approve depends on whether they've been added to the relevant Approval Group. The Approver role mainly exists as a convenient label to identify "the people on our team primarily responsible for approvals." To actually grant approval authority, add the person to the applicable Approval Group separately.

Initiator — Institution level Can initiate withdrawals, strategy changes, and similar operations; once initiated, these go to the members of the relevant Approval Group for review. Suited to people responsible for submitting requests that others will review and sign off on.

Auditor — Institution level Read-only access — can view data across all Portfolios in the institution and download statements and reports, but cannot perform any actions. Suited to compliance and audit staff who need oversight and a paper trail, not operational involvement.

Team Manager — Institution level Responsible for team member management (inviting, editing roles, disabling accounts), and can view organization-level data, but doesn't participate in trading or approvals. Suited to whoever owns account and access governance, typically an administrative role.

A member can hold more than one role at the same time: when inviting or editing a team member, you can select multiple roles at once (for example, both Trading Admin and Approver), and the system automatically merges the permissions from all selected roles — there's no need to invite the same person more than once.

3. How to Invite a Team Member

Go to Setting → Team Members and click "+ Invite Member" in the top right, then complete the following 4 steps.

Step 1: Provide Information

Enter the invitee's email address.

Step 2: Configure Access

Select one or more roles to grant this member:

• Selecting an Institution-level role (Administrator, Team Manager, Initiator, Auditor, Approver) requires no further configuration — it automatically applies to every Portfolio under the institution.

• Selecting a Portfolio-level role (Trading Admin, Trader) expands a "Select portfolios for this role" dropdown, where you need to search and select which specific Portfolios this role should apply to for this member. If the member needs this role across multiple Portfolios, you can select several at once here.

Step 3: Review & Confirm

Review the email address, selected role(s), and the associated Portfolio access, then submit once everything looks correct.

Step 4: Complete

After submitting, the system sends an invitation email to the invitee. The invitee needs to accept the invitation and complete account registration before they officially join the team. Until then, the invitation appears under the Team Members → Invitation tab, where you can view and manage it.

4. Managing Existing Members and Pending Invitations

4.1 Editing or Disabling Existing Members

On the Team Members page, go to the Members tab. Each member's Role column lists all the role tags they currently hold; Portfolio-level role tags are followed by a number (e.g. "Trading Admin·3"), indicating that role has been granted access to 3 Portfolios.

The list can be filtered by Roles and Portfolios, and you can search directly by member email. On the right of each row, you can Edit (change roles and Portfolio access) or Disable/Enable (deactivate or reactivate the account).

4.2 Managing Invitations

Go to the Invitation tab to see every invitation that's been sent and its current status, and Resend or Cancel any invitation that hasn't been completed yet, as needed.