> ## Documentation Index
> Fetch the complete documentation index at: https://docs.redpotion.finance/llms.txt
> Use this file to discover all available pages before exploring further.

# Protocol participants

> Red Potion coordinates several distinct actors. Knowing who does what — and what each one can and cannot do — is the clearest way to understand the protocol's trust model.

Red Potion coordinates several distinct actors. Knowing who does what — and what each one can and cannot do — is the clearest way to understand the protocol's trust model.

## The protocol operator

The Red Potion team deploys and runs the [FundManagerDeployer](/developers/contract-reference/fund-manager-deployer), the single protocol root. The protocol operator onboards tenants, publishes the canonical contract implementations, and sets the protocol-wide fee recipient. It does **not** run individual funds or hold their assets.

## The tenant (fund house)

A tenant is an organization that runs one or more funds. Each tenant gets its own [FundManager](/developers/contract-reference/fund-manager) and controls the **upgrade authority** for all of its funds' contracts. Tenants are isolated: one tenant cannot touch another's funds.

## The fund operator

Within a tenant, the fund operator is the party that actually manages a fund day to day. This is not a single role but a set of them, all granted on the [Fund](/developers/contract-reference/fund):

* **Reporter** submits NAV price reports after each batch closes (`SUBMIT_REPORT_ROLE`).
* **Report acceptor** accepts a reviewed report and settles the batch (`ACCEPT_REPORT_ROLE`).
* **Reviewer** can veto a suspicious or wrong report before it settles (`REJECT_REPORT_ROLE`).
* **Allocator** moves capital between the Fund and its strategies (`PUSH_TO_STRATEGY_ROLE` / `PULL_FROM_STRATEGY_ROLE`) and funds settled redemptions (`FUND_REDEEM_ROLE`).
* **Configurators** set fees, risk limits, allowed assets, and price-safety bounds through their respective roles.

Crucially, these roles can be split across different parties or keys — the reporter need not be the acceptor, and neither need be the allocator. See [Access Control & Roles](/developers/access-control-and-roles) for the full table.

## The strategy operator

Capital leaves the Fund only into [Strategy](/developers/contract-reference/strategy) wallets. A strategy has its **own** admin and its own `CALLER_ROLE` operators, separate from the fund's roles — so the party executing trades can be different from the party running the fund. A strategy operator can only make calls that have been explicitly **allowlisted** (by exact caller, target contract, function selector, and optionally pinned arguments), and can never call the Fund itself. The Fund can always pull assets back from a Strategy, so an operator can deploy capital but can never lock the fund out of it.

## The investor

Investors deposit assets into a fund's [DepositQueue](/developers/contract-reference/deposit-queue), receive [FundShare](/developers/contract-reference/fund-share) tokens once their batch settles, and redeem those shares through the [RedeemQueue](/developers/contract-reference/redeem-queue). Investors interact only with the queues and the share token — everything else happens behind the scenes.

## Trust boundaries at a glance

| Actor             | Can                                                               | Cannot                                                   |
| ----------------- | ----------------------------------------------------------------- | -------------------------------------------------------- |
| Protocol operator | Onboard tenants, set canonical code & protocol fee recipient      | Run funds or move fund assets                            |
| Tenant            | Create funds, control upgrade authority for its funds             | Touch another tenant's funds                             |
| Fund operator     | Report/accept prices, allocate capital, configure fees & risk     | Change settled batch payouts; bypass the risk manager    |
| Strategy operator | Execute allowlisted calls with pushed capital                     | Call the Fund; refuse a pull; make non-allowlisted calls |
| Investor          | Deposit, cancel before settlement, claim, redeem, transfer shares | Change price or settlement; jump the batch               |

## Where assets live

At any moment a fund's assets are in one of a few places: idle in the **Fund** contract, deployed in a **Strategy** wallet, or pushed to a whitelisted **external wallet** (for example a custodian or CEX deposit address). Strategy assets can always be pulled back on-chain; external-wallet assets are returned by the wallet's controller (operational trust) — the Fund cannot pull them. Capital deployed cross-chain via a [StandaloneStrategy](/developers/contract-reference/standalone-strategy) is bridged back the same way.