> For the complete documentation index, see [llms.txt](https://docs.trilobyte.finance/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.trilobyte.finance/overview/vault-types.md).

# Vault Types

Trilobyte supports two types of vaults that determine who can invest in a loan. This is independent of the [tranche structure](/overview/tranches-and-the-waterfall.md) — a vault of either type still splits its investors into senior and junior.

## Permissionless Vaults

In a **permissionless vault**, any address can deposit funds during the RaisingFunds phase (subject to the tranche it's depositing into being open, and to the per-deposit minimum). This is a future capability — today every vault in production use is permissioned; the flag exists on-chain and is enforced, but the broader permissionless investor base has not yet been enabled end-to-end.

## Permissioned Vaults

In a **permissioned vault**, only addresses that have been **allowlisted** by the Pool Manager can deposit funds, in either tranche. This enables managers to restrict participation to specific investors — for example, those who have completed KYC/AML verification or who meet certain accreditation requirements.

### Managing the Allowlist

The Pool Manager controls the allowlist using two functions:

* `add_to_allowlist(caller, investor)` — Add an investor address
* `remove_from_allowlist(caller, investor)` — Revoke an investor address

Only the vault's Pool Manager can modify the allowlist. Investors not on the list will be rejected when attempting to deposit. The allowlist itself is paginated on-chain (`get_allowlist(start, count)`) so it scales to a large investor base without a cost that grows with the list.

### The compliance gate, separately

Whether or not a vault is permissioned, the protocol can optionally point Globals at a **compliance gate** contract. When set, every deposit (either tranche), the borrower's disbursement, and the manager's vault creation are additionally checked against it — see [Covenants, Exposure and Compliance](/protocol-mechanics/covenants-exposure-and-compliance.md). A permissioned vault's allowlist and the protocol-wide compliance gate are independent checks; both must pass when both are active.

### When to Use Permissioned Vaults

Permissioned vaults are appropriate when:

* **Regulatory compliance** requires investor verification (KYC/AML)
* The loan involves **sensitive deal terms** that should only be visible to approved parties
* The Pool Manager wants to **curate the investor base** for a specific deal
* **Institutional investors** require controlled access to the vault

{% hint style="info" %}
The `permissioned` flag is set at vault creation and cannot be changed afterwards. A vault is either permissioned or permissionless for its entire lifecycle.
{% endhint %}

*As of September 2026.*