Permissions & the allow kit

A role’s permissions decide exactly which contracts, functions, and parameter ranges its members can call. Everything else reverts onchain. You express them with the allow kit — a typed API generated from the contracts in your zodiac.config.ts.

Generating the kit

The kit only knows about contracts listed in zodiac.config.ts. Add an address under its chain prefix, then regenerate:

// zodiac.config.ts
import { defineConfig } from '@zodiac-os/sdk/cli/config'
 
export default defineConfig({
  contracts: {
    eth: {
      weth: '0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2',
    },
  },
})

zodiac pull-contracts

This produces allow.eth.weth.*, typed against the contract’s real ABI.

Writing permissions

Each entry scopes the role to a contract and function, optionally with parameter constraints:

export default [
  allow.eth.weth.deposit({ send: true }),
  allow.eth.weth.withdraw(),
] satisfies Permissions

satisfies Permissions keeps full type inference while enforcing the array’s shape.

DeFi presets with defi-kit

For common protocols, defi-kit ships ready-made presets so you don’t have to hand-scope every function:

import { allow as allowAction } from 'defi-kit/eth'
 
export default [
  allowAction.aave_v3.deposit({
    market: 'Core',
    targets: ['WETH'],
  }),
] satisfies Permissions

Parameter constraints with c

The c helper (re-exported from zodiac-roles-sdk) builds parameter-level conditions — value ranges, allowed addresses, spending allowances, and more:

import { c } from '@zodiac-os/sdk'
 
export default [
  allow.eth.usdc.transfer(
    undefined, // any recipient
    c.withinAllowance(usdc_payouts.key),
  ),
] satisfies Permissions

Spending allowances

An allowance is a refillable budget enforced onchain. Define it once and reference it from permissions and the Roles node:

import { encodeKey } from 'zodiac-roles-sdk'
 
const USDC_DECIMALS = 6n
const DAILY = 10_000n * 10n ** USDC_DECIMALS
 
export const usdc_payouts = {
  key: encodeKey('usdc_payouts'),
  refill: DAILY,
  maxRefill: DAILY,
  period: 60n * 60n * 24n, // one day
  balance: DAILY,
  timestamp: 0n,
}

Register it on the Roles node via the allowances field so the budget is deployed alongside the role. See Constellation as Code for the full wiring.

Members

A role’s members are anything that resolves to an address — raw addresses, user accessors, or node references:

export default [
  '0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045',
  eth.user['alice'],
  eth.safe['Trading Bot'],
] satisfies Members