# Who signs, what connects, and what runs on its own.

URL: https://orla.finance/en/product/space
Markdown twin of that page. Append `.md` to any Orla page URL to get one.

Roles and rules that say who signs what, and connections that only read.

#### Team and signing rules

Who may do what, and what needs a signature?

- Roles: owner, admin, member, viewer, accountant. A role is where a person starts; nineteen switches on their card decide, and whole sections can be hidden from a member.
- Signing rules: a threshold, the number of signatures, address book only, a monthly allowance per person counted across every door.
- A table of how protected each entry is, the space's machines, invitations.
- A rule switched off still blocks what it would have matched; muting is no bypass.

For: Founder, Finance lead, Accountant.

#### Security

Where am I signed in, and who can move money?

- Devices, the space journal, an IP allowlist, and It was me or Not me on every sign-in from a new device.
- The authority map: who in this book can move money, and what holds each of them.
- A monthly oversight report frozen the day after the month ends, with the exceptions to the approval rules listed, so an auditor reads one page instead of the log.
- An emailed token opens a 30-minute door when your own allowlist locks you out.

For: Founder, Finance lead, Treasury.

#### Agents

What did a machine do with our money?

- Every dollar an agent moved, with a receipt that says which agent, whose it is, how much, to whom, and who decided it: the agent, a human, or a decision still pending on it.
- A fence per agent: a daily ceiling, a term, the x402 hosts it may pay, the merchants its card accepts; its own wallet and card, so the worst case is the deposit.
- Watch mode by default; an agent never signs.
- Freeze an agent and even its reads refuse; its rights are recomputed on every call.

For: Founder, Treasury, Team member.

#### Connections

What can we connect, and is it healthy?

- Sorted by why you connect: balances, sales, payouts, paper, clients, chats.
- Connection health, and a wishlist for what is not there yet.
- A daily rule names connections that quietly broke; one press re-syncs a row.

For: Founder, Office manager, Finance lead.

#### Automations

What watches the books while I do not?

- Rules that watch the books and tell a person: a balance below the line, a budget nearly spent, an invoice due, a loan payment coming, a connection that stopped syncing while you slept.
- The last run is shown as facts, not as a log.
- A rule never fires twice for a period; a broken rule cannot take the others down.

For: Founder, Office manager, Finance lead.