> For the complete documentation index, see [llms.txt](https://docs.lagoon.finance/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.lagoon.finance/vault/roles-and-capacities/super-operator.md).

# Super Operator

The Super Operator is a compliance and security role. It is a single privileged address that can act on any holder's shares without their approval, and that always bypasses access list restrictions, regardless of the active access mode.

It exists to solve a specific problem: access control alone cannot remove a user who already holds shares. If a holder is blacklisted, fails a KYC review, is added to a sanctions list, or is removed from the whitelist, the access list stops them from making new requests but their existing position stays where it is. The Super Operator is the mechanism that lets the vault operator act on that position: it can transfer the holder's shares to another address, and it can request a redemption of those shares on the holder's behalf. Neither requires the holder's approval.

{% hint style="warning" %}
The Super Operator can transfer and redeem any holder's shares without their consent, and chooses the receiving address. Only set it when your product genuinely requires it, hold it in a robust custody setup, and disclose it to users.
{% endhint %}

### Responsibilities

The Super Operator is responsible for:

* Enforcing the vault's compliance policy on holders who are no longer authorized to participate
* Acting on positions that access control alone cannot reach
* Operating within a documented mandate agreed with the vault operator, and only in the cases that mandate covers

### What the Super Operator can do

<table data-view="cards"><thead><tr><th></th><th></th></tr></thead><tbody><tr><td><mark style="color:$primary;"><strong>Act on held shares</strong></mark></td><td><ul><li>Transfer a holder's shares to another address (<code>transferFrom</code>), without any prior token approval</li><li>Request a redemption of a holder's shares on their behalf (<code>requestRedeem</code>)</li><li>Move a position that would otherwise be frozen in place by the access list</li></ul></td></tr><tr><td><mark style="color:$primary;"><strong>Act on pending and settled requests</strong></mark></td><td><ul><li>Claim settled shares for a user (<code>deposit</code>, <code>mint</code>)</li><li>Claim settled assets for a user (<code>redeem</code>, <code>withdraw</code>)</li><li>Cancel a user's pending deposit or redeem request</li></ul></td></tr><tr><td><mark style="color:$primary;"><strong>Bypass access control</strong></mark></td><td><ul><li>Operate regardless of the active access mode, in whitelist and blacklist mode alike</li><li>Complete or unwind operations for users who are no longer on the access list</li><li>The Super Operator address itself is always treated as allowed</li></ul></td></tr></tbody></table>

{% hint style="info" %}
The Super Operator cannot enter the vault for someone: requesting a deposit and depositing synchronously are the only user operations it cannot perform on behalf of a holder.
{% endhint %}

### Typical use cases

* Removing a sanctioned or blacklisted holder from the vault's cap table
* Force-exiting a holder who fails an ongoing KYC or KYB review
* Responding to a legal or regulatory order affecting a specific holder
* Recovering positions during a vault closure or a migration into a new Lagoon vault

{% hint style="info" %}
Routine operations do not need the Super Operator. Claiming settled shares for users in the normal course of business is done by the [Vault Curator](/vault/roles-and-capacities/curator.md) — see [Claim shares on behalf of users](/vault/how-to/claim-shares-on-behalf-of-users.md).
{% endhint %}

### Setting, disabling and locking the role

The Super Operator address is set by the [Vault Admin](/vault/roles-and-capacities/vault-admin.md). A vault can run without one: setting the address to the zero address disables the role entirely, and vaults with no compliance requirement should do exactly that.

The Vault Admin can also permanently lock the Super Operator address. Once locked, the address can never be changed again. This lets an operator commit publicly and irreversibly to a fixed Super Operator, or to no Super Operator at all.

See [`updateSuperOperator`](/developer-hub/smart-contract-reference.md#updatesuperoperator) and [`lockSuperOperator`](/developer-hub/smart-contract-reference.md#locksuperoperator) in the smart contract reference.

### Recommended custody setup

Given its scope, the Super Operator should be held by:

* A Safe multisig with a clear signer policy, ideally requiring compliance sign-off
* An institutional MPC setup
* A contract encoding a narrow, auditable mandate

### What this means for users

Users can verify on-chain whether a vault has a Super Operator, which address holds it, and whether it has been locked or disabled. Where one is set, holders should understand that the operator can move or redeem their position without their consent, and should treat this as part of the vault's compliance terms.