Roles & permissions

OnlyTons has two account types and, for organizations, three capability flags. Together they decide what you can see and do. Every permission is enforced on the server — the UI hides what you can't do, but the rules live in the API, so they can't be bypassed.

The two account types

Broker

The broker (Alessio, plus any future coordinators) has god-mode:

• Sees every organization, supply entry, demand entry, and deal.
• Runs the matching workspace and creates deals.
• Drives every deal through its pipeline.
• Curates the commodity catalog.
• Verifies organizations and approves certifications.
• Invites new users (into organizations, or other brokers).
• Sees the revenue dashboard.
• Posts internal notes on deals that organizations never see.

Organization user

An organization user belongs to exactly one organization and acts on its behalf. Within the org they have a role:

• Owner — manages the organization profile and certifications.
• Member — participates; a lighter role.

What an organization user can post depends on the organization's capabilities (below), not on owner/member.

Organization capabilities

Every organization has five independent capability flags, one per operator type the platform recognises. An organization can be any combination, but must have at least one by the time it submits itself for review:

• To publish supply, the org must be a producer, processor or trader.
• To publish demand, the org must be a buyer, processor or trader.
• An advisor publishes nothing. Advisory accounts exist to look at the market, not to trade in it, and the flag is never shown to another operator.

If you try to post something your organization can't, the server refuses with a clear message ("Your organization can't post supply…").

The approval gate

Capabilities decide what you may publish. Whether you may publish at all is a separate question, answered by your organization's onboarding state:

The Visitor column is the public tier: anybody, with no account. It shows only aggregated availability — ranges, months and broad areas, never a price and never a seller. See Public browsing for exactly where the line falls. A visitor is not a weaker signed-in user; it is a different, coarser view of the same market.

Two things worth spelling out. Submitting earns you the catalog — you can browse while the broker reviews you, which is the point of finishing the form. And a suspension never strands a live contract: an organization suspended mid-deal keeps full access to that deal and can still withdraw its own listings.

Full detail in Registration & approval.

This is separate again from verification status, which is a graded trust signal used by matching. "Unverified" is a perfectly ordinary steady state for a real, active operator; "not approved" is not. See Certifications & verification.

Deal visibility (who sees a deal)

Deal access isn't a role — it's about being a party to that specific deal. For any deal, you are one of:

• Broker — sees everything, including internal notes.
• Buyer — the organization whose demand started the deal. Sees the deal, the shared timeline, and provenance — but not internal notes, and not other suppliers' private line details beyond what's shared.
• Supplier — an organization supplying a line. Sees the deal and its own lines. On a deal supplied by several producers, a supplier sees itself and the buyer only — never a co-supplier. See Operator privacy.

Anyone who is not a party to a deal simply cannot open it. This is checked on every read and write of a deal.

Other organizations' profiles

You can open your own organization's profile, at any time, in full. You cannot open another organization's profile, and you cannot browse a directory of operators — that view belongs to the broker alone.

Another operator reaches you as an operator handle and an area (OP-7K3QMD · Puglia), never as a company name, and inside a deal as a per-deal alias ("Supplier A"). The underlying details — address, coordinates, certifier name, certificate number, listing notes, team members — are not available to any counterparty at all. Operator privacy explains the whole rule.

What each role sees — at a glance

(A producer/processor/buyer only sees deals its own organization is a party to.)

On-request pricing & masking

Supply can be priced "on request". That price is visible only to the broker and the owning organization; every other organization sees "On request". This keeps price negotiation flowing through the broker rather than around them.

---

Under the hood: the API enforces this with a layered ladder — public → authenticated → any in-app user → organization user → broker — plus a per-deal party check on every deal operation. Capability checks and price masking happen in the data layer, never only in the UI.

---

Next: Commodities · Back to index