{"templateId":"markdown","versions":[{"version":"v1.43","label":"v1.43 LTS","link":"/products/custody/governance/policies/manage-policies","default":true,"active":false,"folderId":"c15a2701"},{"version":"v1.42","label":"v1.42 STS","link":"/products/custody/v1.42/governance/policies/manage-policies","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.41","label":"v1.41 STS","link":"/products/custody/v1.41/governance/policies/manage-policies","default":false,"active":true,"folderId":"c15a2701"},{"version":"v1.34","label":"v1.34 LTS","link":"/products/custody/v1.34/governance/policies/manage-policies","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.26","label":"v1.26 LTS","link":"/products/custody/v1.26/governance/policies/manage-policies","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.19","label":"v1.19 LTS","link":"/products/custody/v1.19/governance/policies/manage-policies","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.15","label":"v1.15 LTS","link":"/products/custody/v1.15/governance/policies/manage-policies","default":false,"active":false,"folderId":"c15a2701"}],"sharedDataIds":{"sidebar":"sidebar-products/custody/@v1.15/sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":[]},"type":"markdown"},"seo":{"title":"Manage policies","description":"User guides, API reference, and support resources.","siteUrl":"https://docs.ripple.com","lang":"en-US"},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"manage-policies","__idx":0},"children":["Manage policies"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Use this page for post-genesis policy operations. For policy mechanics, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.41/governance/policies"},"children":["Policies"]},". For launch design, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.41/governance/genesis/design-your-policies"},"children":["Design your policies"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"policy-actions","__idx":1},"children":["Policy actions"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Action"},"children":["Action"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"UI procedure"},"children":["UI procedure"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"API procedure"},"children":["API procedure"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Create a policy"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"#create-a-policy-in-the-ui"},"children":["Create a policy in the UI"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"#create-a-policy-with-the-api"},"children":["Create a policy with the API"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Create a system-signed policy"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Use the API procedure."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"#create-a-policy-for-system-signed-intents-with-the-api"},"children":["Create a policy for system-signed intents with the API"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Update a policy"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"#update-a-policy-in-the-ui"},"children":["Update a policy in the UI"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"#update-a-policy-with-the-api"},"children":["Update a policy with the API"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Lock and unlock a policy"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"#lock-or-unlock-a-policy-in-the-ui"},"children":["Lock or unlock a policy in the UI"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"#lock-or-unlock-a-policy-with-the-api"},"children":["Lock or unlock a policy with the API"]}]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"api-reference-and-shared-process","__idx":2},"children":["API reference and shared process"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Task"},"children":["Task"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"API reference"},"children":["API reference"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Propose a policy intent"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.41/reference/api/openapi/intents/createintent"},"children":["Propose an intent"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Dry run a policy intent"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.41/reference/api/openapi/intents/intentdryrun"},"children":["Perform a dry run"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["List policies"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.41/reference/api/openapi/policies/getpolicies"},"children":["List policies"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Get policy details"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.41/reference/api/openapi/policies/getpolicy"},"children":["Get policy details"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Check remaining approvers"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.41/reference/api/openapi/intents/getremainingusers"},"children":["Get remaining users"]}]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Policy changes use the standard intent flow. For signing, approval, and status checks, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.41/governance/intents/manage-intents-and-approvals"},"children":["Manage intents and approvals"]},", ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.41/identity-and-access/authentication/authenticate-api-requests#signing-intents-state-mutation-operations"},"children":["Sign intents"]},", and ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.41/governance/intents/manage-intents-and-approvals#check-state"},"children":["Check updates"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"common-operations","__idx":3},"children":["Common operations"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Operation"},"children":["Operation"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Intent type"},"children":["Intent type"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Use when"},"children":["Use when"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Create policy"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_CreatePolicy"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Add a new approval rule."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Update policy"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_UpdatePolicy"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Change matching, condition, workflow, scope, rank, or metadata."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Lock policy"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_LockPolicy"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Disable a policy without deleting it."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Unlock policy"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_UnlockPolicy"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Re-enable a locked policy."]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"create-a-policy-in-the-ui","__idx":4},"children":["Create a policy in the UI"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Go to ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Policies"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Create a policy"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Complete the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["General information"]},", ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Conditions"]},", ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Workflow"]},", and ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Summary"]}," pages."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Submit for approval"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Sign the operation with the mobile app."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The policy is created after the intent is approved and executed."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"general-information","__idx":5},"children":["General information"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Enter a policy name, an optional description of up to 200 characters that states the rule the policy enforces, and the policy rank. Optionally, add custom properties as name-value pairs. The policy ID is generated and cannot be changed. For help choosing a rank, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.41/governance/policies/reference#rank-guidance"},"children":["Rank guidance"]},"."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The initial lock status is ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Unlocked"]},", so the policy starts matching intents as soon as it is created. Turn on the lock to create the policy in a locked state instead."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"conditions","__idx":6},"children":["Conditions"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Conditions"]}," page defines which intents the policy can match:"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Select the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Governing scope"]},": ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Self"]}," applies the policy to intents in the current domain, ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Descendants"]}," applies it to intents in its subdomains, and ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Self and Descendants"]}," applies it to both."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Select the intent types managed by the policy. Choose ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["All intent types"]}," to create a catch-all policy, or choose ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Specific intent types"]}," and select the operations and administration intent types that the policy manages. For all selectable intent types, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.41/governance/policies/reference#intent-types-in-the-ui"},"children":["Intent types in the UI"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Under ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Additional conditions"]},", keep ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Without"]}," if intent type and scope are the only matching criteria, or select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["With"]}," to add conditions that the intent must also fulfill."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["To add a condition, select a condition type, complete its fields, and click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Add condition"]},". Combine conditions with ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["AND"]}," (the intent must fulfill both) or ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["OR"]}," (the intent can fulfill either). Use the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Preview"]}," tab to review the conditions in JSON format, and click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Clear"]}," to remove all conditions and start over."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For all condition types, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.41/governance/policies/reference#condition-types-in-the-ui"},"children":["Condition types in the UI"]},". For the JavaScript syntax used in custom conditions, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.41/governance/policies/reference#javascript-rules-for-conditions"},"children":["JavaScript rules for conditions"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"workflow","__idx":7},"children":["Workflow"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["On the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Workflow"]}," page, select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Approval workflow"]}," to require approvals in one or more steps, ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Always reject"]}," to reject matching intents without user intervention, or ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Always approve"]}," to approve them without user approvals. For how each option maps to the policy's ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["workflow"]}," field, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.41/governance/policies/reference#workflow-options-in-the-ui"},"children":["Workflow options in the UI"]},"."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["To build an approval workflow, enter the number of required approvals and select the user role that provides them. Click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Add condition"]}," to add another approval group to the step, and combine the groups with ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["AND"]}," (both groups must approve) or ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["OR"]}," (either group can approve). Click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Add step"]}," to add a sequential step."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The intent submitter counts as the first approver, so include the submitter's user role in the first step. For all workflow rules, including system-signed behavior, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.41/governance/policies/reference#workflow-objects"},"children":["Workflow objects"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"summary","__idx":8},"children":["Summary"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Summary"]}," page shows the policy details, conditions, and approval workflow. Click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["See more"]}," to expand each workflow step. Review the policy, then click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Submit for approval"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"create-a-policy-with-the-api","__idx":9},"children":["Create a policy with the API"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Create a policy by submitting a ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_CreatePolicy"]}," intent. The following dry-run request body matches the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.41/reference/api/openapi/intents/intentdryrun"},"children":["Perform a dry run"]}," operation and can be signed and submitted with the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.41/reference/api/openapi/intents/createintent"},"children":["Propose an intent"]}," operation after review."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Before you create a policy, prepare a new policy ID and a new intent ID in standard UUID format. Also confirm the role names, intent types, scope, condition paths, workflow, and rank."]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","header":{"controls":{"copy":{}}},"source":"{\n  \"author\": {\n    \"id\": \"6ac20654-450e-29e4-65e2-1bdecb7db7c4\",\n    \"domainId\": \"9067d363-6411-498b-a32b-15d230a86706\"\n  },\n  \"expiryAt\": \"2026-06-30T15:30:00.000Z\",\n  \"targetDomainId\": \"9067d363-6411-498b-a32b-15d230a86706\",\n  \"id\": \"7d256a32-812e-4a66-9a56-42ebfac5426a\",\n  \"payload\": {\n    \"id\": \"5b440ba5-d013-11eb-8cd0-dcfb48cfb3cb\",\n    \"alias\": \"policy-governance\",\n    \"rank\": 700,\n    \"intentTypes\": [\n      \"v0_CreatePolicy\",\n      \"v0_UpdatePolicy\",\n      \"v0_LockPolicy\",\n      \"v0_UnlockPolicy\"\n    ],\n    \"scope\": \"Self\",\n    \"scriptingEngine\": \"Javascript_v0\",\n    \"condition\": {\n      \"expression\": \"context.references.users[context.request.author.id].roles.includes('policy-operator')\",\n      \"type\": \"Expression\"\n    },\n    \"workflow\": [\n      {\n        \"left\": {\n          \"role\": \"policy-operator\",\n          \"quorum\": 2,\n          \"type\": \"RoleQuorum\"\n        },\n        \"right\": {\n          \"role\": \"compliance\",\n          \"quorum\": 1,\n          \"type\": \"RoleQuorum\"\n        },\n        \"type\": \"And\"\n      }\n    ],\n    \"lock\": \"Unlocked\",\n    \"description\": \"Controls policy lifecycle operations in the root domain.\",\n    \"customProperties\": {},\n    \"type\": \"v0_CreatePolicy\"\n  },\n  \"description\": \"Create policy governance policy\",\n  \"customProperties\": {},\n  \"type\": \"Propose\"\n}\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Dry run before submitting:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"sh","header":{"controls":{"copy":{}}},"source":"curl -X POST \"${CUSTODY_API_URL}/v1/intents/dry-run\" \\\n  -H \"Authorization: Bearer ${JWT_TOKEN}\" \\\n  -H \"Content-Type: application/json\" \\\n  -d @create-policy-intent.json\n","lang":"sh"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Submit the signed intent:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"sh","header":{"controls":{"copy":{}}},"source":"curl -X POST \"${CUSTODY_API_URL}/v1/intents\" \\\n  -H \"Authorization: Bearer ${JWT_TOKEN}\" \\\n  -H \"Content-Type: application/json\" \\\n  -H \"requestId: 8b6571b9-493c-49fb-9d92-e19b6f39f7cf\" \\\n  -d @signed-create-policy-intent.json\n","lang":"sh"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"update-a-policy","__idx":10},"children":["Update a policy"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Use ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_UpdatePolicy"]}," to replace the mutable policy fields. Include the current policy ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["reference.id"]}," and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["reference.revision"]},", then provide the updated alias, rank, scope, scripting engine, condition, workflow, description, and custom properties."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"update-a-policy-in-the-ui","__idx":11},"children":["Update a policy in the UI"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["You can update only the approval workflow or update the full policy:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Update"},"children":["Update"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"UI steps"},"children":["UI steps"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Approval workflow only"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Go to ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Policies"]},", open the contextual menu at the end of the policy row, select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Edit policy approval workflow"]},", update the workflow settings, click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Submit for approval"]},", and sign with the mobile app."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["All policy details"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Go to ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Policies"]},", open the contextual menu at the end of the policy row, select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Edit policy approval workflow"]},", update the policy fields, click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Submit for approval"]},", and sign with the mobile app."]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"update-a-policy-with-the-api","__idx":12},"children":["Update a policy with the API"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","header":{"controls":{"copy":{}}},"source":"{\n  \"payload\": {\n    \"reference\": {\n      \"id\": \"5b440ba5-d013-11eb-8cd0-dcfb48cfb3cb\",\n      \"revision\": 3\n    },\n    \"alias\": \"policy-governance\",\n    \"rank\": 750,\n    \"intentTypes\": [\n      \"v0_CreatePolicy\",\n      \"v0_UpdatePolicy\",\n      \"v0_LockPolicy\",\n      \"v0_UnlockPolicy\"\n    ],\n    \"scope\": \"Self\",\n    \"scriptingEngine\": \"Javascript_v0\",\n    \"condition\": {\n      \"expression\": \"context.references.users[context.request.author.id].roles.includes('policy-operator')\",\n      \"type\": \"Expression\"\n    },\n    \"workflow\": [\n      {\n        \"left\": {\n          \"role\": \"policy-operator\",\n          \"quorum\": 2,\n          \"type\": \"RoleQuorum\"\n        },\n        \"right\": {\n          \"role\": \"compliance\",\n          \"quorum\": 2,\n          \"type\": \"RoleQuorum\"\n        },\n        \"type\": \"And\"\n      }\n    ],\n    \"description\": \"Controls policy lifecycle operations in the root domain.\",\n    \"customProperties\": {},\n    \"type\": \"v0_UpdatePolicy\"\n  }\n}\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Treat policy updates as high-risk operations. A policy update can change the policy that governs future policy updates."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"create-a-policy-for-system-signed-intents-with-the-api","__idx":13},"children":["Create a policy for system-signed intents with the API"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["System-signed intents are API-only proposals from service callers. They are submitted without a client-side payload signature and are matched only by policies whose ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["intentOrigin"]}," is ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["SystemSigned"]},"."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Use this pattern only for tightly scoped automation. At minimum:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Set ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["intentOrigin"]}," to ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["SystemSigned"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Specify the exact ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["intentTypes"]}," the service caller can submit."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Use a condition that checks the service submitter. For defense in depth, combine ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["context.submitter.custodyRoles.includes(...)"]}," with a ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["context.submitter.subject"]}," check for the expected service account."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Omit ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["workflow"]}," only when automatic execution is intentional. If you include a workflow, user-signed approvers must satisfy it."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The following example allows a service caller with the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["gas-station-service"]}," custody role and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["gas-station-svc"]}," subject to submit transaction order proposals. Replace both values with the role and subject issued by your identity provider."]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","header":{"controls":{"copy":{}}},"source":"{\n  \"author\": {\n    \"id\": \"6ac20654-450e-29e4-65e2-1bdecb7db7c4\",\n    \"domainId\": \"9067d363-6411-498b-a32b-15d230a86706\"\n  },\n  \"expiryAt\": \"2026-06-30T15:30:00.000Z\",\n  \"targetDomainId\": \"9067d363-6411-498b-a32b-15d230a86706\",\n  \"id\": \"7d256a32-812e-4a66-9a56-42ebfac5426a\",\n  \"payload\": {\n    \"id\": \"af1d2e33-9a94-4456-bcb3-895bba820d38\",\n    \"alias\": \"gas-station-system-signed\",\n    \"rank\": 420,\n    \"intentTypes\": [\"v0_CreateTransactionOrder\"],\n    \"intentOrigin\": \"SystemSigned\",\n    \"scope\": \"SelfAndDescendants\",\n    \"scriptingEngine\": \"Javascript_v0\",\n    \"condition\": {\n      \"expression\": \"context.submitter.type === 'Service' && context.submitter.custodyRoles.includes('gas-station-service') && context.submitter.subject === 'gas-station-svc'\",\n      \"type\": \"Expression\"\n    },\n    \"lock\": \"Unlocked\",\n    \"description\": \"Allows Gas Station service-submitted transaction orders.\",\n    \"customProperties\": {},\n    \"type\": \"v0_CreatePolicy\"\n  },\n  \"description\": \"Create system-signed Gas Station policy\",\n  \"customProperties\": {},\n  \"type\": \"Propose\"\n}\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Submit this policy with the normal user-signed policy creation flow. The policy itself is a governance change and should be created, approved, and audited by users with authority to manage policies."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"lock-and-unlock-a-policy","__idx":14},"children":["Lock and unlock a policy"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Lock a policy when it should stop matching new intents without being removed from the environment."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"lock-or-unlock-a-policy-in-the-ui","__idx":15},"children":["Lock or unlock a policy in the UI"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Go to ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Policies"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Open the contextual menu at the end of the policy row."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Lock policy"]}," or ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Unlock policy"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Submit for approval"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Sign the operation with the mobile app."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"lock-or-unlock-a-policy-with-the-api","__idx":16},"children":["Lock or unlock a policy with the API"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Submit ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_LockPolicy"]}," or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_UnlockPolicy"]}," with the current policy reference:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","header":{"controls":{"copy":{}}},"source":"{\n  \"payload\": {\n    \"reference\": {\n      \"id\": \"5b440ba5-d013-11eb-8cd0-dcfb48cfb3cb\",\n      \"revision\": 3\n    },\n    \"type\": \"v0_LockPolicy\"\n  }\n}\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Use ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_UnlockPolicy"]}," with the same ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["reference"]}," shape to re-enable the policy."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"safe-rollout-sequence","__idx":17},"children":["Safe rollout sequence"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Policy changes can change the rules that govern future policy changes. Use a controlled sequence:"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Confirm domain read access and required roles."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Confirm enough users exist for the intended quorum."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Deploy operational policies before policy-governance policies."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Deploy policy-governance policies after the users and fallback path exist."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Deploy emergency \"break-glass\" policies, high-privilege policies used only during incidents, only after their scope and intent types are explicit."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Dry run representative intents."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"pre-flight-checks","__idx":18},"children":["Pre-flight checks"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Check"},"children":["Check"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Why it matters"},"children":["Why it matters"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["intentTypes"]}," are explicit"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Prevents accidental catch-all behavior."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["intentOrigin"]}," is intentional"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Prevents a user-signed policy from being confused with a system-signed automation policy."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Condition paths are valid"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Prevents policy selection errors."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Workflow is satisfiable"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Prevents governance lockout."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["User-signed first workflow step includes maker role"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Lets the intent creator count as first approval. For system-signed policies, confirm the workflow can be satisfied by user approvers."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Rank is intentional"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Ensures the expected policy wins."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Scope is narrow enough"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Prevents parent-domain policies applying too broadly."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Fallback exists"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Gives legitimate unexpected workflows a controlled path."]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"common-policy-mistakes","__idx":19},"children":["Common policy mistakes"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Mistake"},"children":["Mistake"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Problem"},"children":["Problem"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Fix"},"children":["Fix"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Empty ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["workflow: []"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Matching intents are rejected."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Omit workflow for auto-approval or define explicit approval steps."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Missing ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["intentTypes"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Policy can match all intents."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Specify intent types except for deliberate fallback policies."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Missing ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["intentOrigin"]}," on an automation policy"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Policy matches only user-signed proposals."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Set ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["intentOrigin: \"SystemSigned\""]}," when the policy is meant for system-signed API proposals."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["High-rank catch-all"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Specific policies may never apply."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Give fallback policies low rank."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Required role has no users"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Workflow cannot complete."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Create users before deploying the policy."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Role names do not match"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Approvers cannot satisfy workflow."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Keep role names consistent across users and policies."]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"operational-checklist","__idx":20},"children":["Operational checklist"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Before submitting a policy intent:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Confirm the target domain and policy scope."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Confirm the policy's intent types are deliberate."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Confirm the condition is null-safe and uses the correct payload paths for each intent type."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Confirm every workflow role exists in the target domain."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Confirm quorum can be satisfied by independent users."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["For user-signed policies, confirm the first workflow step includes the maker role."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["For system-signed policies, confirm the workflow can be satisfied by user approvers, or that automatic execution is intentional."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Confirm rank relative to other matching policies."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Dry run representative intents before and after the policy change."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"troubleshooting","__idx":21},"children":["Troubleshooting"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["When a policy does not behave as expected:"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Check intent type."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Check target domain and scope."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Check condition expression."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Check rank against other matching policies."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Check workflow roles and quorum."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Check lock state."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For field details, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.41/governance/policies/reference"},"children":["Policy reference"]},". For reusable models, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.41/governance/policies/examples"},"children":["Policy examples"]},"."]}]},"headings":[{"value":"Manage policies","id":"manage-policies","depth":1},{"value":"Policy actions","id":"policy-actions","depth":2},{"value":"API reference and shared process","id":"api-reference-and-shared-process","depth":2},{"value":"Common operations","id":"common-operations","depth":2},{"value":"Create a policy in the UI","id":"create-a-policy-in-the-ui","depth":2},{"value":"General information","id":"general-information","depth":3},{"value":"Conditions","id":"conditions","depth":3},{"value":"Workflow","id":"workflow","depth":3},{"value":"Summary","id":"summary","depth":3},{"value":"Create a policy with the API","id":"create-a-policy-with-the-api","depth":2},{"value":"Update a policy","id":"update-a-policy","depth":2},{"value":"Update a policy in the UI","id":"update-a-policy-in-the-ui","depth":3},{"value":"Update a policy with the API","id":"update-a-policy-with-the-api","depth":3},{"value":"Create a policy for system-signed intents with the API","id":"create-a-policy-for-system-signed-intents-with-the-api","depth":2},{"value":"Lock and unlock a policy","id":"lock-and-unlock-a-policy","depth":2},{"value":"Lock or unlock a policy in the UI","id":"lock-or-unlock-a-policy-in-the-ui","depth":3},{"value":"Lock or unlock a policy with the API","id":"lock-or-unlock-a-policy-with-the-api","depth":3},{"value":"Safe rollout sequence","id":"safe-rollout-sequence","depth":2},{"value":"Pre-flight checks","id":"pre-flight-checks","depth":2},{"value":"Common policy mistakes","id":"common-policy-mistakes","depth":2},{"value":"Operational checklist","id":"operational-checklist","depth":2},{"value":"Troubleshooting","id":"troubleshooting","depth":2}],"frontmatter":{"seo":{"title":"Manage policies"}},"lastModified":"2026-10-23T14:40:23.908Z","pagePropGetterError":{"message":"","name":""}},"slug":"/products/custody/v1.41/governance/policies/manage-policies","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}