{"templateId":"markdown","versions":[{"version":"v1.40","label":"v1.40 STS","link":"/products/custody/governance/policies/reference","default":true,"active":true,"folderId":"c15a2701"},{"version":"v1.39","label":"v1.39 STS","link":"/products/custody/v1.39/governance/policies/reference","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.38","label":"v1.38 STS","link":"/products/custody/v1.38/governance/policies/reference","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.34","label":"v1.34 LTS","link":"/products/custody/v1.34/governance/policies/reference","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.26","label":"v1.26 LTS","link":"/products/custody/v1.26/governance/policies/reference","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.19","label":"v1.19 LTS","link":"/products/custody/v1.19/governance/policies/reference","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.15","label":"v1.15 LTS","link":"/products/custody/v1.15/governance/policies/reference","default":false,"active":false,"folderId":"c15a2701"}],"sharedDataIds":{"sidebar":"sidebar-products/custody/@v1.15/sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":[]},"type":"markdown"},"seo":{"title":"Policy reference","description":"User guides, API reference, and support resources.","siteUrl":"https://docs.ripple.com","lang":"en-US","llmstxt":{"hide":false,"sections":[{"title":"Table of contents","includeFiles":["**/*"],"excludeFiles":[]}],"excludeFiles":[]}},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"policy-reference","__idx":0},"children":["Policy reference"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This page is the canonical reference for policy fields, JavaScript conditions, workflow objects, and policy-writing rules. For the concept, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/governance/policies"},"children":["Policies"]},". For operations, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/governance/policies/manage-policies"},"children":["Manage policies"]},". For reusable patterns, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/governance/policies/examples"},"children":["Policy examples"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"api-reference","__idx":1},"children":["API reference"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Task"},"children":["Task"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"API reference"},"children":["API reference"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Create, update, lock, or unlock a policy"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/reference/api/openapi/intents/createintent"},"children":["Propose an intent"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Test a policy intent"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/reference/api/openapi/intents/intentdryrun"},"children":["Perform a dry run"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Query policies"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/reference/api/openapi/policies/getpolicies"},"children":["List policies"]},", ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/reference/api/openapi/policies/getpolicy"},"children":["Get policy details"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Check the full schema"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/reference/api/openapi"},"children":["OpenAPI specification"]}]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"create-policy-fields","__idx":2},"children":["Create policy fields"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["These fields are used in a ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_CreatePolicy"]}," payload and in genesis policy entries. Genesis policy entries are embedded in a domain's ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["policies"]}," array and do not include the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["type"]}," field."]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Field"},"children":["Field"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Type"},"children":["Type"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Required"},"children":["Required"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Rules"},"children":["Rules"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["id"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["UUID string"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Yes"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Unique policy ID."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["alias"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["string"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Yes"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["1-75 characters. Use a stable operational name."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["rank"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["integer"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Yes"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["0-1000. Higher rank wins among matching policies."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["intentTypes"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["string array"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["No"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["If omitted, the policy can match all intent types. Use only for deliberate fallback or emergency policies."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["intentOrigin"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["enum"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["No"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["UserSigned"]}," or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["SystemSigned"]},". If omitted, the policy matches user-signed proposals only."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["scope"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["enum"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Yes"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Self"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Descendants"]},", or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["SelfAndDescendants"]},"."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["scriptingEngine"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["enum"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Yes"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Javascript_v0"]},"."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["condition"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["object"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["No"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["If omitted, the condition behaves as always true."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["workflow"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["array"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["No"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["If omitted or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["null"]},", matching intents are auto-approved. An empty array rejects matching intents."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["lock"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["enum"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Yes"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Unlocked"]}," or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Locked"]},"."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["description"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["string"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["No"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["0-250 characters."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["customProperties"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["object"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Yes"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["String key-value metadata. Use ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["{}"]}," when empty."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["type"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["string"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Yes for intent payloads"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_CreatePolicy"]},". Omit inside genesis policy entries."]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"update-and-lock-fields","__idx":3},"children":["Update and lock fields"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_UpdatePolicy"]}," uses a ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["reference"]}," instead of ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["id"]}," so the update targets a specific policy revision."]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","header":{"controls":{"copy":{}}},"source":"{\n  \"payload\": {\n    \"reference\": {\n      \"id\": \"5b440ba5-d013-11eb-8cd0-dcfb48cfb3cb\",\n      \"revision\": 3\n    },\n    \"alias\": \"policy-governance\",\n    \"rank\": 750,\n    \"intentTypes\": [\"v0_CreatePolicy\", \"v0_UpdatePolicy\"],\n    \"intentOrigin\": \"UserSigned\",\n    \"scope\": \"Self\",\n    \"scriptingEngine\": \"Javascript_v0\",\n    \"condition\": {\n      \"expression\": \"context.references.users[context.request.author.id].roles.includes('policy-operator')\",\n      \"type\": \"Expression\"\n    },\n    \"workflow\": [\n      {\n        \"role\": \"policy-operator\",\n        \"quorum\": 2,\n        \"type\": \"RoleQuorum\"\n      }\n    ],\n    \"description\": \"Controls policy lifecycle operations.\",\n    \"customProperties\": {},\n    \"type\": \"v0_UpdatePolicy\"\n  }\n}\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_LockPolicy"]}," and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_UnlockPolicy"]}," use only ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["reference"]}," and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["type"]},"."]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","header":{"controls":{"copy":{}}},"source":"{\n  \"payload\": {\n    \"reference\": {\n      \"id\": \"5b440ba5-d013-11eb-8cd0-dcfb48cfb3cb\",\n      \"revision\": 3\n    },\n    \"type\": \"v0_LockPolicy\"\n  }\n}\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"policy-selection","__idx":4},"children":["Policy selection"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["When an intent is submitted, policy evaluation:"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Finds policies in the target domain and any applicable parent or child domains."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Filters by ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["intentTypes"]},". A policy with omitted ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["intentTypes"]}," can match any intent type."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Filters by ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["scope"]}," and domain governing strategy."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Filters by ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["intentOrigin"]},". A policy with omitted ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["intentOrigin"]}," matches user-signed proposals only."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Evaluates ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["condition"]},". A condition must return ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["true"]}," for the policy to remain eligible."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Selects the highest-ranked eligible policy."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["If two eligible policies have the same rank, the older policy wins."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Applies the selected policy's workflow."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If no policy matches, the intent cannot execute."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"scope-values","__idx":5},"children":["Scope values"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Value"},"children":["Value"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Applies to"},"children":["Applies to"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Self"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Intents targeting the policy's own domain."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Descendants"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Intents targeting descendant domains only."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["SelfAndDescendants"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Intents targeting the policy's own domain and descendant domains."]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Domain governing strategy changes how parent and child policies interact:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Governing strategy"},"children":["Governing strategy"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Policy effect"},"children":["Policy effect"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["ConsiderDescendants"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Parent and child policies can both be considered. Highest-rank eligible policy wins."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["CoerceDescendants"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Matching parent policies override matching child policies."]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"intent-origin-values","__idx":6},"children":["Intent origin values"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["intentOrigin"]}," controls whether a policy matches a normal user-signed proposal or an API-only system-signed proposal."]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Value"},"children":["Value"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Applies to"},"children":["Applies to"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Omitted"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["User-signed proposals."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["UserSigned"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["User-signed proposals."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["SystemSigned"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["System-signed proposals submitted through the API."]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Existing policies that omit ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["intentOrigin"]}," do not match system-signed proposals. To allow a service caller to submit an intent without a client-side payload signature, create or update a policy with ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["intentOrigin: \"SystemSigned\""]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"rank-guidance","__idx":7},"children":["Rank guidance"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Range"},"children":["Range"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Typical use"},"children":["Typical use"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["900-1000"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Explicit emergency or breakglass controls with narrow intent types and high quorum."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["500-800"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["High-risk governance such as policy, domain, user, and root administration."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["100-500"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Standard operational policies."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["1-99"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Catch-all or fallback policies that should lose to specific policies."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["0"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Last-resort behavior or intentionally lowest priority."]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"condition-object","__idx":8},"children":["Condition object"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["A condition is either an ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Expression"]},", an ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["And"]},", or an ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Or"]},"."]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","header":{"controls":{"copy":{}}},"source":"{\n  \"condition\": {\n    \"expression\": \"context.references.users[context.request.author.id].roles.includes('transaction-operator')\",\n    \"type\": \"Expression\"\n  }\n}\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["And"]}," and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Or"]}," use a binary tree. Use ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["left"]}," and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["right"]},", not arrays."]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","header":{"controls":{"copy":{}}},"source":"{\n  \"condition\": {\n    \"left\": {\n      \"expression\": \"context.request.payload.rank >= 700\",\n      \"type\": \"Expression\"\n    },\n    \"right\": {\n      \"expression\": \"context.references.users[context.request.author.id].roles.includes('policy-operator')\",\n      \"type\": \"Expression\"\n    },\n    \"type\": \"And\"\n  }\n}\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["You can also use JavaScript logical operators inside one expression when that is clearer."]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","header":{"controls":{"copy":{}}},"source":"{\n  \"condition\": {\n    \"expression\": \"context.request.payload.rank >= 700 && context.references.users[context.request.author.id].roles.includes('policy-operator')\",\n    \"type\": \"Expression\"\n  }\n}\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"condition-context","__idx":9},"children":["Condition context"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Condition expressions can use the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["context"]}," object. System-signed policy conditions can also use ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["context.submitter"]}," and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["intentOrigin"]},"."]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Object"},"children":["Object"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Contains"},"children":["Contains"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["context.request"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The intent being evaluated."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["context.references"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Entities explicitly referenced by the intent. You cannot query arbitrary entities from a policy condition."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["context.submitter"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Identity of the user or service caller that submitted the proposal."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["intentOrigin"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Proposal origin, either ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["UserSigned"]}," or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["SystemSigned"]},"."]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Common ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["context.request"]}," paths:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Path"},"children":["Path"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Contains"},"children":["Contains"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["context.request.author.id"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["User ID that created the intent."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["context.request.author.domainId"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Author's domain ID."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["context.request.targetDomainId"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Domain targeted by the intent."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["context.request.payload"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Intent-specific payload."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["context.request.payload.type"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Intent type, such as ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_CreatePolicy"]},"."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["context.request.payload.customProperties"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Custom metadata supplied in the payload, when present."]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For system-signed proposals, ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["context.request.author"]}," is not present. Use ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["context.submitter"]}," to check the service caller instead."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Submitter paths:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Path"},"children":["Path"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Contains"},"children":["Contains"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["context.submitter.type"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["User"]}," or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Service"]},"."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["context.submitter.reference.id"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["User ID for user-signed proposals."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["context.submitter.reference.domainId"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["User domain ID for user-signed proposals."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["context.submitter.subject"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Service subject for system-signed proposals."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["context.submitter.custodyRoles"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Roles from the service caller token for system-signed proposals. If the configured roles claim is absent, this is an empty array."]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["System-signed condition example:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","header":{"controls":{"copy":{}}},"source":"{\n  \"condition\": {\n    \"expression\": \"context.submitter.type === 'Service' && context.submitter.custodyRoles.includes('gas-station-service')\",\n    \"type\": \"Expression\"\n  }\n}\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Useful payload paths by intent type:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Intent type"},"children":["Intent type"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Useful paths"},"children":["Useful paths"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_CreateUser"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["context.request.payload.roles"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["context.request.payload.alias"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["context.request.payload.loginIds"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_UpdateUser"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["context.request.payload.reference.id"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["context.request.payload.roles"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["context.request.payload.loginIds"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_CreatePolicy"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["context.request.payload.rank"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["context.request.payload.intentTypes"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["context.request.payload.scope"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["context.request.payload.workflow"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_UpdatePolicy"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["context.request.payload.reference.id"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["context.request.payload.rank"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["context.request.payload.intentTypes"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["context.request.payload.scope"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["context.request.payload.workflow"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_CreateDomain"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["context.request.payload.alias"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["context.request.payload.governingStrategy"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["context.request.payload.permissions"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["context.request.payload.childrenDomainIds"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_UpdateDomainPermissions"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["context.request.payload.reference.id"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["context.request.payload.permissions.readAccess"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_CreateTransactionOrder"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["context.request.payload.accountId"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["context.request.payload.ledgerId"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["context.request.payload.parameters"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_ReleaseQuarantinedTransfers"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Payload fields for the quarantine release request. Use existence checks before accessing optional fields."]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Common ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["context.references"]}," collections:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Collection"},"children":["Collection"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Access pattern"},"children":["Access pattern"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Use when"},"children":["Use when"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Users"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["context.references.users[userId]"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Check the author's current roles or target user state."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Accounts"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["context.references.accounts[accountId]"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Check ledger, account metadata, or account custom properties."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Endpoints"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["context.references.endpoints[endpointId]"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Check endpoint trust score or endpoint metadata."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Vaults"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["context.references.vaults[vaultId]"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Check vault properties for account or vault operations."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Tickers"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["context.references.tickers[tickerId]"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Check ticker or asset metadata when referenced."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Domains"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["context.references.domains[domainId]"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Check domain metadata when referenced."]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The following diagram shows how a condition can navigate from an intent payload to a referenced account's custom properties:"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"img","attributes":{"src":"/assets/context-references.69067cf7957fdbb8bc88302907817d2c6d7411eb1edade8a45e5ee83b87f36cc.592c7941.png","alt":"Context references"},"children":[]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"javascript-rules-for-conditions","__idx":10},"children":["JavaScript rules for conditions"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Conditions are JavaScript expressions. Write one expression that evaluates to ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["true"]}," or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["false"]},"."]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Rule"},"children":["Rule"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Guidance"},"children":["Guidance"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Use ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Javascript_v0"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["This is the supported scripting engine."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Return a boolean"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The expression should evaluate to ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["true"]}," or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["false"]}," for every matching intent."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Prefer strict paths"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Check the actual payload shape for each intent type in the API reference before writing paths."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Check optional fields"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Use ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["hasOwnProperty"]},", null checks, or array length checks before accessing optional nested fields."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Use role names exactly"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Role names are case-sensitive and must match user roles."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Keep expressions deterministic"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Avoid relying on external state. Policies cannot call APIs or query arbitrary entities."]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Supported JavaScript patterns:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Pattern"},"children":["Pattern"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Example"},"children":["Example"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Comparison"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["context.request.payload.rank >= 700"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Logical operators"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["a && b"]},", `a"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Array includes"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["roles.includes('compliance')"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Array some/every/filter"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["outputs.some(output => BigInt(output.amount) > 100000000n)"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Array reduce"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["outputs.reduce((sum, output) => sum + BigInt(output.amount), 0n)"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["String methods"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["alias.startsWith('prod-')"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["alias.includes('treasury')"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Object checks"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["payload.hasOwnProperty('parameters')"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["JSON methods"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["JSON.parse(rawTx)"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["JSON.stringify(roles)"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Date methods"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["new Date().getHours()"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["new Date().getDay()"]}]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Amount handling:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Use BigInt for amount comparisons."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Use an ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["n"]}," suffix for integer literals, such as ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["50000000000n"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["When the payload value is a string, wrap it with ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["BigInt(...)"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["For multi-output payloads, sum amounts with ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["reduce"]},"."]}]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","header":{"controls":{"copy":{}}},"source":"{\n  \"condition\": {\n    \"expression\": \"context.request.payload.parameters.outputs.reduce((sum, output) => sum + BigInt(output.amount), 0n) >= 500000000n\",\n    \"type\": \"Expression\"\n  }\n}\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Null-safe nested access:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","header":{"controls":{"copy":{}}},"source":"{\n  \"condition\": {\n    \"expression\": \"context.request.payload.hasOwnProperty('parameters') && context.request.payload.parameters != null && context.request.payload.parameters.hasOwnProperty('destination') && context.request.payload.parameters.destination.type == 'Endpoint'\",\n    \"type\": \"Expression\"\n  }\n}\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"condition-examples","__idx":11},"children":["Condition examples"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"high-risk-bitcoin-transaction","__idx":12},"children":["High-risk Bitcoin transaction"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This condition matches when the author is an ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["operator"]},", the transaction parameters are Bitcoin, and either the amount is at least 1 BTC or the source account has a custom property named ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["escalatePolicy"]}," set to ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["true"]},"."]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","header":{"controls":{"copy":{}}},"source":"{\n  \"expression\": \"context.references.users[context.request.author.id].roles.includes('operator') && context.request.payload.hasOwnProperty('parameters') && context.request.payload.parameters != null && context.request.payload.parameters.type == 'Bitcoin' && (context.request.payload.parameters.outputs.reduce((sum, output) => sum + BigInt(output.amount), 0n) >= 100000000n || context.references.accounts[context.request.payload.accountId].metadata.customProperties.escalatePolicy == 'true')\",\n  \"type\": \"Expression\"\n}\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"medium-risk-bitcoin-transaction","__idx":13},"children":["Medium-risk Bitcoin transaction"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This condition matches operator-created Bitcoin transactions below 1 BTC where the account is not escalated and the destination is either an unknown address or an endpoint with a trust score of 50 or lower."]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","header":{"controls":{"copy":{}}},"source":"{\n  \"left\": {\n    \"expression\": \"context.references.users[context.request.author.id].roles.includes('operator') && context.request.payload.hasOwnProperty('parameters') && context.request.payload.parameters != null && context.request.payload.parameters.type == 'Bitcoin' && context.request.payload.parameters.outputs.reduce((sum, output) => sum + BigInt(output.amount), 0n) <= 100000000n && context.references.accounts[context.request.payload.accountId].metadata.customProperties.escalatePolicy != 'true' && context.request.payload.parameters.outputs[0].destination.type == 'Address'\",\n    \"type\": \"Expression\"\n  },\n  \"right\": {\n    \"expression\": \"context.references.users[context.request.author.id].roles.includes('operator') && context.request.payload.hasOwnProperty('parameters') && context.request.payload.parameters != null && context.request.payload.parameters.type == 'Bitcoin' && context.request.payload.parameters.outputs.reduce((sum, output) => sum + BigInt(output.amount), 0n) <= 100000000n && context.references.accounts[context.request.payload.accountId].metadata.customProperties.escalatePolicy != 'true' && context.request.payload.parameters.outputs[0].destination.type == 'Endpoint' && context.references.endpoints[context.request.payload.parameters.outputs[0].destination.endpointId].trustScore <= 50\",\n    \"type\": \"Expression\"\n  },\n  \"type\": \"Or\"\n}\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"low-risk-bitcoin-transaction","__idx":14},"children":["Low-risk Bitcoin transaction"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This condition matches operator-created Bitcoin transactions below 1 BTC where the account is not escalated and the destination is either an internal account or an endpoint with a trust score of 50 or higher."]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","header":{"controls":{"copy":{}}},"source":"{\n  \"left\": {\n    \"expression\": \"context.references.users[context.request.author.id].roles.includes('operator') && context.request.payload.hasOwnProperty('parameters') && context.request.payload.parameters != null && context.request.payload.parameters.type == 'Bitcoin' && context.request.payload.parameters.outputs.reduce((sum, output) => sum + BigInt(output.amount), 0n) <= 100000000n && context.references.accounts[context.request.payload.accountId].metadata.customProperties.escalatePolicy != 'true' && context.request.payload.parameters.outputs[0].destination.type == 'Account'\",\n    \"type\": \"Expression\"\n  },\n  \"right\": {\n    \"expression\": \"context.references.users[context.request.author.id].roles.includes('operator') && context.request.payload.hasOwnProperty('parameters') && context.request.payload.parameters != null && context.request.payload.parameters.type == 'Bitcoin' && context.request.payload.parameters.outputs.reduce((sum, output) => sum + BigInt(output.amount), 0n) <= 100000000n && context.references.accounts[context.request.payload.accountId].metadata.customProperties.escalatePolicy != 'true' && context.request.payload.parameters.outputs[0].destination.type == 'Endpoint' && context.references.endpoints[context.request.payload.parameters.outputs[0].destination.endpointId].trustScore >= 50\",\n    \"type\": \"Expression\"\n  },\n  \"type\": \"Or\"\n}\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"create-or-update-privileged-users","__idx":15},"children":["Create or update privileged users"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This condition matches user creation or update intents when the target user has the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["admin"]}," or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["compliance"]}," role."]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","header":{"controls":{"copy":{}}},"source":"{\n  \"expression\": \"context.request.payload.roles.includes('admin') || context.request.payload.roles.includes('compliance')\",\n  \"type\": \"Expression\"\n}\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This condition matches user creation or update intents when the target user does not have either privileged role."]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","header":{"controls":{"copy":{}}},"source":"{\n  \"expression\": \"!context.request.payload.roles.includes('admin') && !context.request.payload.roles.includes('compliance')\",\n  \"type\": \"Expression\"\n}\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Avoid these patterns:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Avoid"},"children":["Avoid"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Reason"},"children":["Reason"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["fetch"]},", imports, network calls, or database calls"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Conditions cannot call external systems."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["DOM, browser APIs, timers, or process APIs"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Policy evaluation is server-side."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Statements that require a block"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The field expects an expression. Prefer array methods and logical operators."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Missing optional-field checks"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Undefined nested paths can make condition evaluation fail."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Comparing large amounts as normal numbers"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["JavaScript numbers can lose precision."]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"workflow-objects","__idx":16},"children":["Workflow objects"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["A workflow is an ordered array of approval steps. Each step must be satisfied before the next step is active."]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Type"},"children":["Type"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Shape"},"children":["Shape"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Use when"},"children":["Use when"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["RoleQuorum"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["{ \"role\": \"operator\", \"quorum\": 2, \"type\": \"RoleQuorum\" }"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["A number of users with one role must approve."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["And"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["{ \"left\": {...}, \"right\": {...}, \"type\": \"And\" }"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Multiple approval groups are required in the same step."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Or"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["{ \"left\": {...}, \"right\": {...}, \"type\": \"Or\" }"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Either approval group can satisfy the step."]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Example workflow:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","header":{"controls":{"copy":{}}},"source":"{\n  \"workflow\": [\n    {\n      \"role\": \"transaction-operator\",\n      \"quorum\": 1,\n      \"type\": \"RoleQuorum\"\n    },\n    {\n      \"left\": {\n        \"role\": \"compliance\",\n        \"quorum\": 1,\n        \"type\": \"RoleQuorum\"\n      },\n      \"right\": {\n        \"role\": \"risk\",\n        \"quorum\": 1,\n        \"type\": \"RoleQuorum\"\n      },\n      \"type\": \"And\"\n    }\n  ]\n}\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Workflow rules:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["For user-signed proposals, the intent submitter counts as the first approval."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["For user-signed proposals, the submitter must have a role compatible with the first workflow step."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["For system-signed proposals, the service submitter does not count as a user approval. If a system-signed policy includes a workflow, user-signed approvers must satisfy it."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["If quorum is not reached, the step remains open and users can change their decision. Once a step is executed, it cannot be changed."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["A user can count only once in the complete approval workflow."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Duplicate approvals are checked at public-key level."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["If a user has roles on both sides of an ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["And"]}," or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Or"]},", the engine uses one approval on the quickest valid path."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["RoleQuorum.quorum"]}," must be at least ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["1"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["And"]}," and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Or"]}," use ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["left"]}," and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["right"]},", not arrays."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["An omitted or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["null"]}," workflow auto-approves a matching intent."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["An empty workflow array rejects a matching intent."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"workflow-examples","__idx":17},"children":["Workflow examples"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"operator-followed-by-supervisor-or-supervisor-bot","__idx":18},"children":["Operator followed by supervisor or supervisor bot"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Step 1 is satisfied by the submitter with the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["operator"]}," role. Step 2 is satisfied by one ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["supervisor"]}," or one ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["supervisor-bot"]},"."]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","header":{"controls":{"copy":{}}},"source":"[\n  {\n    \"role\": \"operator\",\n    \"quorum\": 1,\n    \"type\": \"RoleQuorum\"\n  },\n  {\n    \"left\": {\n      \"role\": \"supervisor\",\n      \"quorum\": 1,\n      \"type\": \"RoleQuorum\"\n    },\n    \"right\": {\n      \"role\": \"supervisor-bot\",\n      \"quorum\": 1,\n      \"type\": \"RoleQuorum\"\n    },\n    \"type\": \"Or\"\n  }\n]\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"operator-compliance-or-risk-alternatives-then-ciso","__idx":19},"children":["Operator, compliance or risk alternatives, then CISO"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Step 1 is satisfied by the submitter with the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["operator"]}," role. Step 2 requires compliance or compliance-bot approval and risk or risk-bot approval. Step 3 requires one ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["ciso"]}," approval."]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","header":{"controls":{"copy":{}}},"source":"[\n  {\n    \"role\": \"operator\",\n    \"quorum\": 1,\n    \"type\": \"RoleQuorum\"\n  },\n  {\n    \"left\": {\n      \"left\": {\n        \"role\": \"compliance\",\n        \"quorum\": 1,\n        \"type\": \"RoleQuorum\"\n      },\n      \"right\": {\n        \"role\": \"compliance-bot\",\n        \"quorum\": 1,\n        \"type\": \"RoleQuorum\"\n      },\n      \"type\": \"Or\"\n    },\n    \"right\": {\n      \"left\": {\n        \"role\": \"risk\",\n        \"quorum\": 1,\n        \"type\": \"RoleQuorum\"\n      },\n      \"right\": {\n        \"role\": \"risk-bot\",\n        \"quorum\": 1,\n        \"type\": \"RoleQuorum\"\n      },\n      \"type\": \"Or\"\n    },\n    \"type\": \"And\"\n  },\n  {\n    \"role\": \"ciso\",\n    \"quorum\": 1,\n    \"type\": \"RoleQuorum\"\n  }\n]\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"ui-policy-builder-mapping","__idx":20},"children":["UI policy builder mapping"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Create a policy"]}," wizard in the UI builds a ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_CreatePolicy"]}," payload. This section lists every option the wizard offers and the payload field it sets. For the procedure, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/governance/policies/manage-policies#create-a-policy-in-the-ui"},"children":["Create a policy in the UI"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"intent-types-in-the-ui","__idx":21},"children":["Intent types in the UI"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Conditions"]}," page groups the selectable intent types into ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Operations"]}," and ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Administration"]},". Each selection adds an entry to ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["intentTypes"]},". Choosing ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["All intent types"]}," omits ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["intentTypes"]}," so the policy can match any intent type."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Operations:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"UI intent type"},"children":["UI intent type"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"API intent type"},"children":["API intent type"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Add Account Ledgers"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_AddAccountLedgers"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Create Account"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_CreateAccount"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Lock Account"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_LockAccount"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Unlock Account"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_UnlockAccount"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Update Account"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_UpdateAccount"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Attempt Transaction Order Cancellation"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_AttemptTransactionOrderCancellation"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Create Transaction Order"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_CreateTransactionOrder"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Create Transfer Order"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_CreateTransferOrder"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Release Quarantined Transfers"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_ReleaseQuarantinedTransfers"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Create Endpoint"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_CreateEndpoint"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Lock Endpoint"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_LockEndpoint"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Unlock Endpoint"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_UnlockEndpoint"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Update Endpoint"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_UpdateEndpoint"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Sign Manifest"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_SignManifest"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Execute Extension"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_ExecuteExtension"]}]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Administration:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"UI intent type"},"children":["UI intent type"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"API intent type"},"children":["API intent type"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Create Policy"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_CreatePolicy"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Lock Policy"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_LockPolicy"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Unlock Policy"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_UnlockPolicy"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Update Policy"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_UpdatePolicy"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Create User"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_CreateUser"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Lock User"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_LockUser"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Unlock User"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_UnlockUser"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Update User"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_UpdateUser"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Create Domain"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_CreateDomain"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Lock Domain"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_LockDomain"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Unlock Domain"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_UnlockDomain"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Update Domain"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_UpdateDomain"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Update Domain Permissions"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_UpdateDomainPermissions"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Create Vault"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_CreateVault"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Lock Vault"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_LockVault"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Unlock Vault"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_UnlockVault"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Update Vault"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_UpdateVault"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Lock Ticker"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_LockTicker"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Unlock Ticker"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_UnlockTicker"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Update Ticker"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_UpdateTicker"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Validate Assets"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_ValidateTickers"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Notarize Data"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_NotarizeData"]}]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The following intent types have no UI selector and can be referenced in ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["intentTypes"]}," only through the API: ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_AcknowledgeBackup"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_AddTrustedPublicKeysForMigration"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_CreateBackup"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_CreateLedger"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_CreateTicker"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_RegisterTrustedPublicKey"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_RewrapVaultKeyMaterial"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_SetSystemProperty"]},", and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_UpdateLedger"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"condition-types-in-the-ui","__idx":22},"children":["Condition types in the UI"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Under ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Additional conditions"]},", the wizard offers these condition types. Each condition you add becomes part of the policy's ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["condition"]}," object, and the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["AND"]}," and ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["OR"]}," selectors between conditions become ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["And"]}," and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Or"]}," nodes. The ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Preview"]}," tab shows the resulting JSON."]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"UI condition type"},"children":["UI condition type"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Inputs"},"children":["Inputs"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Matches when"},"children":["Matches when"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Custom condition"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["JavaScript expression"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The expression evaluates to ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["true"]},"."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["If intent's custom properties is"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Label, value"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The intent has a custom property that exactly matches the label and value."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["If intent's custom properties contains"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Label, value"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The intent has a custom property with the label whose value contains the entered text."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["If intent author belongs to domain"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Domain or domain ID"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The intent author belongs to the domain."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["If intent author does not belong to domain"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Domain or domain ID"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The intent author does not belong to the domain."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["If intent author is"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["User or user ID"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The intent author is the user."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["If intent author is not"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["User or user ID"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The intent author is not the user."]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"workflow-options-in-the-ui","__idx":23},"children":["Workflow options in the UI"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Workflow"]}," page offers three options that map to the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["workflow"]}," field:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"UI option"},"children":["UI option"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Resulting workflow"},"children":["Resulting ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["workflow"]}]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Behavior"},"children":["Behavior"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Approval workflow"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Array with one step per wizard step"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Each step must be satisfied in order."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Always reject"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Empty array ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["[]"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Matching intents are rejected without user intervention."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Always approve"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Omitted"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Matching intents are approved without user approvals."]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["In an approval workflow step, each approval group becomes a ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["RoleQuorum"]}," object with the entered approval count as ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["quorum"]}," and the selected user role as ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["role"]},". Adding another group to a step with ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Add condition"]}," nests the groups in an ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["And"]}," or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Or"]}," object, and ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Add step"]}," appends another entry to the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["workflow"]}," array."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"summary-page-fields","__idx":24},"children":["Summary page fields"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Summary"]}," page shows the policy before submission:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Section"},"children":["Section"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Fields"},"children":["Fields"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Payload fields"},"children":["Payload fields"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Policy details"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Policy name, policy ID, description, rank (shown as rank/1000), custom properties, status"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["alias"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["id"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["description"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["rank"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["customProperties"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["lock"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Conditions"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Governing scope, intent types, additional conditions"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["scope"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["intentTypes"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["condition"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Approval workflow"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["One row per step. Click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["See more"]}," to expand a step's approval groups."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["workflow"]}]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"role-rules","__idx":25},"children":["Role rules"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Role names used in users, read access, conditions, and workflows must match exactly."]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Valid"},"children":["Valid"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Avoid"},"children":["Avoid"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["policy-operator"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["PolicyOperator"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["transaction-operator"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["transaction_operator"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["compliance"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Compliance Team"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["platform-admin"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["platform admin"]}]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The API schema accepts role names that match ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["[a-z0-9\\-]+"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"minimal-create-policy-example","__idx":26},"children":["Minimal create-policy example"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","header":{"controls":{"copy":{}}},"source":"{\n  \"id\": \"c35fa005-1640-42ee-a8a5-c43aaae6eb87\",\n  \"alias\": \"operator-approval\",\n  \"rank\": 100,\n  \"scope\": \"Self\",\n  \"intentTypes\": [\"v0_CreateTransactionOrder\"],\n  \"scriptingEngine\": \"Javascript_v0\",\n  \"condition\": {\n    \"expression\": \"context.references.users[context.request.author.id].roles.includes('transaction-operator')\",\n    \"type\": \"Expression\"\n  },\n  \"workflow\": [\n    {\n      \"role\": \"transaction-operator\",\n      \"quorum\": 2,\n      \"type\": \"RoleQuorum\"\n    }\n  ],\n  \"lock\": \"Unlocked\",\n  \"description\": \"Requires transaction operator quorum.\",\n  \"customProperties\": {},\n  \"type\": \"v0_CreatePolicy\"\n}\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"common-mistakes","__idx":27},"children":["Common mistakes"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Mistake"},"children":["Mistake"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Result"},"children":["Result"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Fix"},"children":["Fix"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Empty ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["workflow: []"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Matching intents are rejected."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Omit workflow or use ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["null"]}," for auto-approval, or define approval steps."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Omitted ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["intentTypes"]}," on a high-rank policy"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Policy can match unexpectedly broad workflows."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Specify intent types unless the policy is a deliberate fallback."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["customProperties: null"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Payload validation can fail."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Use ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["{}"]}," when empty."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Role names with uppercase, underscores, spaces, or padding"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Workflows cannot be satisfied by expected roles."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Use lowercase hyphenated role names, such as ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["policy-operator"]},"."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["And"]}," or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Or"]}," written as arrays"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Payload validation fails."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Use ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["left"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["right"]},", and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["type"]},"."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Amount compared as a JavaScript number"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Precision loss or mismatched comparisons."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Use ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["BigInt(...)"]}," and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["n"]}," literals."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Missing optional-field checks"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Condition can fail for intent types with different payload shapes."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Check existence before accessing nested fields."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Required quorum has too few users"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Intent cannot be approved."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Create enough users before deploying the policy."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["First workflow step excludes maker role for a user-signed policy"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Intent fails at submission or cannot progress."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Include the maker role in the first workflow step. For system-signed policies, make sure user approvers can satisfy the workflow."]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For implementation patterns, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/governance/policies/examples"},"children":["Policy examples"]},"."]}]},"headings":[{"value":"Policy reference","id":"policy-reference","depth":1},{"value":"API reference","id":"api-reference","depth":2},{"value":"Create policy fields","id":"create-policy-fields","depth":2},{"value":"Update and lock fields","id":"update-and-lock-fields","depth":2},{"value":"Policy selection","id":"policy-selection","depth":2},{"value":"Scope values","id":"scope-values","depth":2},{"value":"Intent origin values","id":"intent-origin-values","depth":2},{"value":"Rank guidance","id":"rank-guidance","depth":2},{"value":"Condition object","id":"condition-object","depth":2},{"value":"Condition context","id":"condition-context","depth":2},{"value":"JavaScript rules for conditions","id":"javascript-rules-for-conditions","depth":2},{"value":"Condition examples","id":"condition-examples","depth":2},{"value":"High-risk Bitcoin transaction","id":"high-risk-bitcoin-transaction","depth":3},{"value":"Medium-risk Bitcoin transaction","id":"medium-risk-bitcoin-transaction","depth":3},{"value":"Low-risk Bitcoin transaction","id":"low-risk-bitcoin-transaction","depth":3},{"value":"Create or update privileged users","id":"create-or-update-privileged-users","depth":3},{"value":"Workflow objects","id":"workflow-objects","depth":2},{"value":"Workflow examples","id":"workflow-examples","depth":2},{"value":"Operator followed by supervisor or supervisor bot","id":"operator-followed-by-supervisor-or-supervisor-bot","depth":3},{"value":"Operator, compliance or risk alternatives, then CISO","id":"operator-compliance-or-risk-alternatives-then-ciso","depth":3},{"value":"UI policy builder mapping","id":"ui-policy-builder-mapping","depth":2},{"value":"Intent types in the UI","id":"intent-types-in-the-ui","depth":3},{"value":"Condition types in the UI","id":"condition-types-in-the-ui","depth":3},{"value":"Workflow options in the UI","id":"workflow-options-in-the-ui","depth":3},{"value":"Summary page fields","id":"summary-page-fields","depth":3},{"value":"Role rules","id":"role-rules","depth":2},{"value":"Minimal create-policy example","id":"minimal-create-policy-example","depth":2},{"value":"Common mistakes","id":"common-mistakes","depth":2}],"frontmatter":{"seo":{"title":"Policy reference"}},"lastModified":"2026-08-07T15:50:52.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/products/custody/governance/policies/reference","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}