Access Control Admin Facet

Allows setting administrative roles for specific roles within a diamond.

Key Features

• Manages role-to-admin-role mappings in diamond storage.
• Guards admin updates by checking the caller has the role's current admin role.
• Exposes selector export for diamond cuts.

Initialization Requirement

setRoleAdmin checks the caller against adminRole[_role] before updating it.
If a role has never had an admin set, adminRole[_role] is bytes32(0), so the caller must already hold role bytes32(0).

Storage

State Variables

Property	Type	Description
STORAGE_POSITION	bytes32	Diamond storage slot position for this module (Value: keccak256("compose.accesscontrol"))

Access Control Storage

Definition

/** storage-location: erc8042:compose.accesscontrol */
struct AccessControlStorage {
  mapping(address account => mapping(bytes32 role => bool hasRole)) hasRole;
  mapping(bytes32 role => bytes32 adminRole) adminRole;
}

Functions

setRoleAdmin

Updates the admin role for _role.

function setRoleAdmin(bytes32 _role, bytes32 _adminRole) external;

Authorization flow:

1. Require caller has the previous admin role over the _role
2. Update the admin role
3. Emit RoleAdminChanged(_role, previousAdminRole, _adminRole)

Parameters:

Property	Type	Description
_role	bytes32	The role to set the admin for.
_adminRole	bytes32	The new admin role to set.

Events

Emitted when the admin role for a role is changed.

Signature:

event RoleAdminChanged(bytes32 indexed _role, bytes32 indexed _previousAdminRole, bytes32 indexed _newAdminRole);

Parameters:

Property	Type	Description
_role	bytes32	The role that was changed.
_previousAdminRole	bytes32	The previous admin role.
_newAdminRole	bytes32	The new admin role.

Errors

Thrown when the account does not have a specific role.

Signature:

error AccessControlUnauthorizedAccount(address _account, bytes32 _role);

Best Practices

• Bootstrap role ownership/admins at initialization so trusted accounts can pass the first admin checks.
• Treat bytes32(0) as a privileged role in your access model when relying on default admin mappings.
• When rotating admin roles, grant the new admin role first, then switch adminRole, then revoke old permissions.
• Keep facet storage layout compatible (erc8042:compose.accesscontrol) across upgrades.

Was this helpful?

Last updated:March 13, 2026