# Who signs, what connects, and what runs on its own

URL: https://www.orla.finance/en/product/space
Markdown twin of that page. Append `.md` to any Orla page URL to get one.

Roles and rules that say who signs what, and bank feeds and exchange keys that only read.

#### Team and signing rules

Who may do what, and what needs a signature?

- Roles: owner, admin, member, viewer, accountant. A role is where a person starts; nineteen switches on their card decide, and whole sections can be hidden from a member.
- The key is the only lock: every action that changes the book asks for its own key, not for the role, in the services and in the Telegram and Slack bots alike. Two keys are never handed below admin: inviting and managing the team, and the space's settings.
- A hidden section is a lock, not a missing button: it leaves the rail and the menu, its address opens a page that says it is hidden for you, every call under it is refused, its card leaves the home, and the assistant is not given its tools and says so if asked.
- Signing rules: a threshold, the number of signatures, address book only, a monthly allowance per person counted across every door.
- A table of how protected each entry is, the space's machines, invitations.
- A rule switched off still blocks what it would have matched; muting is no bypass.
- Every section has a short tour of its own, two to five steps on the page itself, opened from the ? beside the page's action or from the command palette by name.

For: Founder, Finance lead, Accountant.

#### Security

Where am I signed in, and who can move money?

- Devices, the space journal, an IP allowlist, and It was me or Not me on every sign-in from a new device.
- The authority map: who in this book can move money, and what holds each of them.
- A monthly oversight report frozen the day after the month ends, with the exceptions to the approval rules listed, so an auditor reads one page instead of the log.
- An emailed token opens a 30-minute door when your own allowlist locks you out.

For: Founder, Finance lead, Treasury.

#### Agents

What did a machine do with our money?

- Every dollar an agent moved, with a receipt that says which agent, whose it is, how much, to whom, and who decided it: the agent, a human, or a decision still pending on it.
- A fence per agent: a daily ceiling, a term and the x402 hosts its wallet may pay; its own wallet and card, so the worst case is the deposit.
- On a card issued to an agent now, the balance loaded onto it is the whole limit: the card carries no merchant rules and no ceiling per payment, Orla refuses to save rules nobody would enforce, and an agent whose access carries a daily cap is not given such a card.
- Watch mode by default. An agent never signs for your accounts: it spends on its own only from its own wallet, inside the limits you set, and proposes everything else for a person to sign.
- Freeze an agent and even its reads refuse; its rights are recomputed on every call.

For: Founder, Treasury, Team member.

#### Connections

What can we connect, and is it healthy?

- Sorted by why you connect: balances, sales, payouts, paper, clients, chats.
- Connection health, and a wishlist for what is not there yet.
- A daily rule names connections that quietly broke; one press re-syncs a row.
- Your own bank as a payout rail: Revolut Business, Airwallex, Mercury or Slash, with access you grant yourself and exactly the rights the form lists, checked at the bank before it is saved, kept encrypted and never shown again. A Safe is read from the chain, and Orla can only propose to it.
- Live bank and exchange sync is on every plan. The plan counts the rows synced in a month, not the connections, and the Connections page shows how many are used and when the count renews.
- The assistant connects a service from the conversation: say connect my Binance and a Connect button opens that service's panel over the chat. Keys are typed into the panel, never into the chat.

For: Founder, Office manager, Finance lead.

#### Automations

What watches the books while I do not?

- Rules that watch the books and tell a person: a balance below the line, a budget nearly spent, an invoice due, a loan payment coming, a connection that stopped syncing while you slept.
- The last run is shown as facts, not as a log.
- A rule never fires twice for a period; a broken rule cannot take the others down.
- A low balance rule can look ahead: with Look ahead, days set, it reads the cash forecast for that account and says USD Main runs below 5 000 on the 23rd, a week before rather than the morning after. It says a prediction once, and again only when the day moves closer.
- An arrival rule speaks at the moment money reaches the book, by bank feed, chain, import or hand: Acme paid 4 000, thirty per cent of it is 1 200, move it to Tax. It moves nothing and books nothing. The same rule can watch an invoice paid in full, a payment waiting for signatures or a payment that did not go out, and none of the three carries a button: signing stays on the payments screen.

For: Founder, Office manager, Finance lead.