Manage Permissions - ZKsync Docs

Permissions define what each role can do within your Prividium network. They control which smart contract functions users can read, write, or call through the Proxy. Administrators configure permissions in the Admin Dashboard under Contract Permissions.

1. Open the Permissions page

Go to the Admin Dashboard at http://localhost:3000.
Select Contract Permissions from the sidebar.
You will see a list of all registered contracts and their function-level access rules.

2. Register a contract

Before you can assign permissions, register the smart contract that needs access control.

Click Add Contract.
Enter:
- Contract Address
- Contract Name
- Description (optional)
- ABI JSON (paste the full ABI or upload the file)
Click Save.

Once registered, the contract’s functions will be available for permission mapping.

3. Add a permission rule

In the Contract Permissions view, find the desired contract.
Click Add Rule.
Select:
- Function name (from ABI)
- Access type: read or write
- Rule type (see table below)
- Roles allowed to call this function
Click Save.

Each function can have its own rule. If a function has no rule, access is denied by default.

4. Permission rule types

Rule Type	Description	Example Use Case
Public	Allows anyone to call this function	Read-only views like `totalSupply()`
Check Role	Requires the caller to hold one of the listed roles	Only users with `Trader` role can call `transfer()`
Restrict Argument	Ensures a function argument matches the caller’s wallet address	User can only `withdraw(address)` to their own wallet
Check Role And Restrict Argument	Requires both a role and an argument match	`Trader` role can `transferFrom()` only for their own address
Check Role Or Restrict Argument	Requires either a role or an argument match	Either admins or self-calls permitted

5. Edit or remove a permission rule

To update: select the rule, modify its parameters, and click Save.
To delete: click the Delete icon next to the rule and confirm.

Tip: Keep function rules minimal and precise. Unused or redundant rules increase maintenance overhead.

6. Default access policy

By design, Prividium uses a deny-by-default model: if a contract or function has no rule, the Proxy blocks all access to it.

This ensures that only explicitly authorized functions can be called, reducing risk of accidental exposure.

7. Testing permissions

After updating permissions:

Open the User Dashboard.
Log in as a user with a specific role.
Interact with the connected dApp or contract through the Proxy.
Verify that allowed functions succeed and restricted ones fail.

If the Proxy returns 403 Forbidden, the user lacks permission for that function.

8. Example configuration

Contract	Function	Access	Rule Type	Allowed Roles
Token	`transfer(address,uint256)`	Write	Check Role	Trader
Token	`approve(address,uint256)`	Write	Restrict Argument	Trader
Token	`balanceOf(address)`	Read	Restrict Argument	Trader, Auditor
Registry	`register(address,string)`	Write	Check Role	Admin

9. Best practices

Keep public rules to a minimum.
Use Restrict Argument for address-sensitive functions.
Review permissions regularly, especially after contract upgrades.
Document your role-to-permission mapping for audits.

Next Step

Continue to Manage Users to add user accounts, link wallets, and assign roles to users.

Manage Roles

Create and manage roles on your Prividium chain.

Manage Users

Create and manage users on your Prividium chain.