Roles

Access control is OpenZeppelin AccessControl on four contracts and Ownable2Step on the registry.

The roles

Role	Contracts	Powers
`DEFAULT_ADMIN_ROLE`	Staking, Executor, Router, Reserve	One-shot router wiring; safety parameters; grant and revoke roles.
`PAUSER_ROLE`	Staking, Executor, Router	Pause and unpause.
`EMERGENCY_ROLE`	Staking	Declare or clear an emergency.
`KEEPER_ROLE`	Executor, Router	Execute a bounded buyback; sweep donations to the reserve.
`GOVERNOR_ROLE`	Reserve	Propose and execute timelocked withdrawals.
`GUARDIAN_ROLE`	Reserve	Veto a pending withdrawal.
`owner`	Registry	Wire the protocol; the one-time token initialization.

Role identifiers are keccak256 of the name, e.g. KEEPER_ROLE = keccak256("KEEPER_ROLE"). DEFAULT_ADMIN_ROLE is bytes32(0).

What no role can do

This list is the point of the page.

Change the split. BUYBACK_BPS, STAKER_BPS, RESERVE_BPS are constant.
Withdraw someone else's principal. No function exists.
Change the registered token. setPloutoTokenOnce is one-way.
Redirect the split. The three destinations are immutable constructor arguments.
Make an arbitrary call. No execute(address,bytes) anywhere.
Mint PLOUTO. The token has no reachable mint entrypoint.
Bypass the reserve timelock. No override exists.
Withdraw from the router. ETH leaves only via the split or the fixed-destination donation sweep.
Force a buyback past its bounds. Every bound is checked on chain.

Keeper, specifically

The keeper is the most-exercised role and the most likely to be a hot key. Its entire surface is:

solidity

BuybackExecutor.executeBuyback(uint256 ethIn, uint256 minTokensOut, uint256 deadline);PloutoRevenueRouter.sweepDonationsToReserve();

The first is bounded by size, share, slippage, deadline and on-chain price impact. The second sends to a fixed address. A compromised keeper can grief; it cannot steal. See keeper constraints.

Current holders

Not deployed Not deployed, so no roles are assigned.

On deployment, every role is granted to the address supplied as PLOUTO_ADMIN. Transferring them to a multisig behind a timelock is step 15 of the launch runbook and a launch blocker.

Role	Intended holder
Registry `owner`	Multisig (TBA)
`DEFAULT_ADMIN_ROLE`	Multisig (TBA)
`PAUSER_ROLE`	Multisig (TBA)
`EMERGENCY_ROLE`	Multisig (TBA)
`KEEPER_ROLE`	Dedicated hot wallet (TBA)
`GOVERNOR_ROLE`	Multisig (TBA)
`GUARDIAN_ROLE`	A different signer (TBA)

Verifying holders

bash

cast call <contract> 'hasRole(bytes32,address)(bool)' \  0x0000000000000000000000000000000000000000000000000000000000000000 <address> \  --rpc-url https://rpc.mainnet.chain.robinhood.com

Or watch RoleGranted and RoleRevoked from deployment onward for the complete history.