{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-products/wallet/sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":["admonition"]},"type":"markdown"},"seo":{"title":"Policy concepts","description":"User guides, API reference, and support resources.","siteUrl":"https://docs.ripple.com/products/custody","lang":"en-US","llmstxt":{"hide":false,"sections":[{"title":"Table of contents","includeFiles":["**/*"],"excludeFiles":[]}],"excludeFiles":[]}},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"policy-concepts","__idx":0},"children":["Policy concepts"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Transaction policies are the security rules that control what funds can leave your wallets. Every wallet in Wallet-as-a-Service (Palisade) is ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["deposit-only by default"]},". You must create at least one policy for an asset before you can send that asset from the wallet."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Think of policies as programmable spending limits. They automatically evaluate every outgoing transaction and block any that would exceed your configured limits. This protects your assets even if someone gains unauthorized access to your API credentials or user accounts."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Policies answer these questions:"]}]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["How much can leave in a single transaction?"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["How much can leave over a period of time?"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["What is the maximum that can ever leave?"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Who can initiate transactions, and to where?"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This page explains the core concepts you need to understand before creating and managing policies."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"policy-scope","__idx":1},"children":["Policy scope"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Policies operate at the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["wallet level only"]},". Each policy applies to a single wallet and controls transactions for a specific asset within that wallet."]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info","name":"No vault-level or organization-level policies"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["You cannot create a policy that applies to multiple wallets simultaneously. If you need the same limit across ten wallets, you must create ten separate policies—one for each wallet."]}]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"warning","name":"Multi-chain EVM wallets"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If your organization uses separate wallets for different EVM chains (for example, one Ethereum wallet and one Arbitrum wallet), policies on one wallet do ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["not"]}," apply to the other—even if both wallets hold the same asset (ETH). You must create policies independently on each wallet."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"limit-types","__idx":2},"children":["Limit types"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Wallet-as-a-Service (Palisade) supports three limit types:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Per transaction (",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["PER_TX"]},")"]}," – Maximum amount for any single transaction"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Rolling duration (",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["ROLLING_DURATION"]},")"]}," – Maximum cumulative amount within a sliding time window"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Max total value (",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["CONSTANT"]},")"]}," – Lifetime cap on total withdrawals"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["You can combine multiple limit types on the same wallet for layered protection."]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info","name":"How rolling windows work"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["When you attempt a transaction, the system calculates how much has already left the wallet within the current window. If your new transaction would push the total over the limit, the system rejects it immediately. As older transactions \"roll off\" the window, capacity becomes available again."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["See ",{"$$mdtype":"Tag","name":"a","attributes":{"href":"/products/wallet/user-interface/policies/policies-reference#limit-types"},"children":["Policy reference"]}," for complete limit type documentation, duration values, and examples."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"policy-uniqueness","__idx":3},"children":["Policy uniqueness"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Each policy must be unique within its wallet. The system identifies a policy by four attributes:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Attribute"},"children":["Attribute"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Description"},"children":["Description"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Wallet ID"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The wallet the policy belongs to"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Limit type"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["PER_TX"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["ROLLING_DURATION"]},", or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["CONSTANT"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Symbol"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The asset symbol (for example, ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["ETH"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["BTC"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["USDC"]},")"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Matchers"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Optional filters that narrow when the policy applies"]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["You can create multiple policies with the same limit type and symbol ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["if they have different matchers"]},". For example:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["PER_TX"]}," + ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["ETH"]}," + no matchers → Applies to all ETH transactions"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["PER_TX"]}," + ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["ETH"]}," + ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["TRANSACTION_TYPE: WITHDRAWAL"]}," → Applies only to ETH withdrawals"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Both policies can coexist because their matcher configurations differ."]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"warning","name":"Duplicate policy error"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If you try to create a policy that matches an existing policy's wallet, limit type, symbol, and matchers, the API returns error ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["PAL006.023: limit policy already exists"]},"."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"policy-immutability","__idx":4},"children":["Policy immutability"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Policies are immutable. You cannot edit an existing policy's limit amount, duration, or matchers."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["To modify a policy:"]}]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Delete the existing policy (see ",{"$$mdtype":"Tag","name":"a","attributes":{"href":"/products/wallet/user-interface/policies/policies-manage#delete-a-policy"},"children":["Manage policies"]},")."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Create a new policy with the updated values."]}]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info","name":"Why policies are immutable"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Immutability provides a clear audit trail. Every policy change creates a new record with its own approval history, making it easy to track who authorized what and when."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"policy-lifecycle","__idx":5},"children":["Policy lifecycle"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Every policy moves through a series of states from creation to deletion."]},{"$$mdtype":"Tag","name":"Mermaid","attributes":{"data-language":"mermaid","diagramSource":"stateDiagram-v2\n direction TB\n\n [*] --> LIMIT_CREATION_APPROVAL_PENDING: Create policy\n\n LIMIT_CREATION_APPROVAL_PENDING --> LIMIT_ENABLED: Approved\n LIMIT_CREATION_APPROVAL_PENDING --> LIMIT_REJECTED: Rejected\n\n LIMIT_ENABLED --> LIMIT_DELETION_APPROVAL_PENDING: Request deletion\n\n LIMIT_DELETION_APPROVAL_PENDING --> LIMIT_DELETED: Approved\n\n LIMIT_REJECTED --> [*]\n LIMIT_DELETED --> [*]\n\n note right of LIMIT_ENABLED: active: true\n note right of LIMIT_DELETION_APPROVAL_PENDING: Still enforcing\n note right of LIMIT_REJECTED: Terminal state\n note right of LIMIT_DELETED: Terminal state\n","diagramHtml":"[object Object]"},"children":["stateDiagram-v2\n direction TB\n\n [*] --> LIMIT_CREATION_APPROVAL_PENDING: Create policy\n\n LIMIT_CREATION_APPROVAL_PENDING --> LIMIT_ENABLED: Approved\n LIMIT_CREATION_APPROVAL_PENDING --> LIMIT_REJECTED: Rejected\n\n LIMIT_ENABLED --> LIMIT_DELETION_APPROVAL_PENDING: Request deletion\n\n LIMIT_DELETION_APPROVAL_PENDING --> LIMIT_DELETED: Approved\n\n LIMIT_REJECTED --> [*]\n LIMIT_DELETED --> [*]\n\n note right of LIMIT_ENABLED: active: true\n note right of LIMIT_DELETION_APPROVAL_PENDING: Still enforcing\n note right of LIMIT_REJECTED: Terminal state\n note right of LIMIT_DELETED: Terminal state\n"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Policies move through five statuses: pending approval, enabled, rejected, pending deletion, and deleted. A policy in ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["LIMIT_DELETION_APPROVAL_PENDING"]}," status continues to enforce transactions until the deletion is approved—this prevents gaps in protection."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["See ",{"$$mdtype":"Tag","name":"a","attributes":{"href":"/products/wallet/user-interface/policies/policies-reference#policy-statuses"},"children":["Policy reference"]}," for the complete status reference."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"approval-requirements","__idx":6},"children":["Approval requirements"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Whether a policy requires approval depends on your organization's approval group configuration."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"with-approval-groups-configured","__idx":7},"children":["With approval groups configured"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If your organization has an approval group for ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Policy rules"]},", new policies enter ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["LIMIT_CREATION_APPROVAL_PENDING"]}," status. Designated approvers must authorize the policy before it takes effect."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The policy activates after the required number of approvers authorize it (for example, 2 of 3 approvers). If the approval threshold becomes mathematically impossible to reach (for example, too many approvers skip), the policy moves to ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["LIMIT_REJECTED"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"without-approval-groups-configured","__idx":8},"children":["Without approval groups configured"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If no approval group exists for Policy rules, the policy ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["automatically activates"]}," immediately after creation. It transitions directly to ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["LIMIT_ENABLED"]}," with ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["active: true"]},"."]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"warning","name":"Security consideration"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Without approval groups, anyone with API credentials that include ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["keylimit:create"]}," scope can instantly enable policies. Consider configuring approval groups to add human oversight."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["See ",{"$$mdtype":"Tag","name":"a","attributes":{"href":"/products/wallet/user-interface/security-controls/approvals"},"children":["Approvals"]}," to configure approval groups for your organization."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"policy-evaluation","__idx":9},"children":["Policy evaluation"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["When you submit a transaction, the policy engine evaluates it against all active policies for that wallet and asset. Policy checks are one stage in the full transaction pipeline."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"where-policies-fit-in-the-transaction-pipeline","__idx":10},"children":["Where policies fit in the transaction pipeline"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Policy evaluation is the first check after a transaction is created. The full pipeline is:"]},{"$$mdtype":"Tag","name":"Mermaid","attributes":{"data-language":"mermaid","diagramSource":"flowchart TD\n TX[Transaction created] --> PC[Policy check]\n PC -->|Pass| AP{Approvals required?}\n PC -->|Fail| REJ[Transaction rejected]\n AP -->|Yes| AG[Approval group review]\n AP -->|No| SIG[MPC signing]\n AG -->|Approved| SIG\n AG -->|Rejected| REJ\n SIG --> BC[Blockchain submission]\n BC --> CONF[Confirmed]\n\n style REJ fill:#ffcccc\n style CONF fill:#ccffcc\n","diagramHtml":"

Pass

Fail

Yes

No

Approved

Rejected

Transaction created

Policy check

Approvals required?

Transaction rejected

Approval group review

MPC signing

Blockchain submission

Confirmed

"},"children":["flowchart TD\n TX[Transaction created] --> PC[Policy check]\n PC -->|Pass| AP{Approvals required?}\n PC -->|Fail| REJ[Transaction rejected]\n AP -->|Yes| AG[Approval group review]\n AP -->|No| SIG[MPC signing]\n AG -->|Approved| SIG\n AG -->|Rejected| REJ\n SIG --> BC[Blockchain submission]\n BC --> CONF[Confirmed]\n\n style REJ fill:#ffcccc\n style CONF fill:#ccffcc\n"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Policy check"]}," – The engine evaluates the transaction against all matching policies. If any policy rejects, the transaction is rejected immediately and never reaches approvers."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Approval check"]}," – If approval groups are configured for transactions, designated approvers must authorize the transaction."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["MPC signing"]}," – The transaction is signed by the wallet's MPC quorum."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Blockchain submission"]}," – The signed transaction is published to the network."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["See ",{"$$mdtype":"Tag","name":"a","attributes":{"href":"/products/wallet/user-interface/security-controls/security-controls-overview"},"children":["Signing & approvals overview"]}," for details on approvals and MPC quorums."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"evaluation-order","__idx":11},"children":["Evaluation order"]},{"$$mdtype":"Tag","name":"Mermaid","attributes":{"data-language":"mermaid","diagramSource":"flowchart TD\n A[Transaction submitted] --> B{Find matching policies}\n B --> C[Policy 1: Check limit]\n B --> D[Policy 2: Check limit]\n B --> E[Policy N: Check limit]\n\n C --> F{All policies pass?}\n D --> F\n E --> F\n\n F -->|Yes| G[Proceed to approvals/signing]\n F -->|No| H[Transaction rejected]\n\n style H fill:#ffcccc\n style G fill:#ccffcc\n","diagramHtml":"

Yes

No

Transaction submitted

Find matching policies

Policy 1: Check limit

Policy 2: Check limit

Policy N: Check limit

All policies pass?

Proceed to approvals/signing

Transaction rejected

"},"children":["flowchart TD\n A[Transaction submitted] --> B{Find matching policies}\n B --> C[Policy 1: Check limit]\n B --> D[Policy 2: Check limit]\n B --> E[Policy N: Check limit]\n\n C --> F{All policies pass?}\n D --> F\n E --> F\n\n F -->|Yes| G[Proceed to approvals/signing]\n F -->|No| H[Transaction rejected]\n\n style H fill:#ffcccc\n style G fill:#ccffcc\n"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["The engine finds all ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["LIMIT_ENABLED"]}," policies that match the transaction's wallet, asset, and attributes."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["For each matching policy, the engine checks whether the transaction would exceed the limit."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["If ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["any"]}," policy rejects the transaction, the entire transaction fails."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["If ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["all"]}," matching policies pass, the transaction proceeds to the next stage (approvals or signing)."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"network-fees-and-policy-limits","__idx":12},"children":["Network fees and policy limits"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Policy limits are checked against the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["transaction amount only"]},". Network fees (gas on EVM chains, transaction fees on XRP Ledger) are ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["not"]}," included in the limit calculation. For example, if you have a PER_TX limit of 10 ETH and send exactly 10 ETH, the policy check passes — the gas cost does not push the transaction over the limit."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"operations-that-bypass-policies","__idx":13},"children":["Operations that bypass policies"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Not all outgoing fund movements are subject to policy checks. ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Asset sweeping bypasses policies entirely."]}," A wallet does not need any policies in place to be swept, and sweep transactions are not evaluated against existing policies."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This means policies alone do not prevent all fund movement from a wallet. If you need to restrict sweeping, manage sweep configurations separately through ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Settings > Workflows"]},". Only owners and administrators can configure sweeping operations."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["See ",{"$$mdtype":"Tag","name":"a","attributes":{"href":"/products/wallet/user-interface/wallets/asset-sweeping"},"children":["Asset sweeping"]}," for details on sweep configuration."]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info","name":"Transaction freeze is separate from policies"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"a","attributes":{"href":"/products/wallet/user-interface/transactions/manage-transactions#freeze-and-unfreeze-transactions"},"children":["Transaction freeze controls"]}," apply to ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["inbound"]}," transactions only (holding incoming funds for compliance review). Policies apply to ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["outbound"]}," transactions only. These two controls operate on different transaction directions and do not interact with each other."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"matcher-evaluation","__idx":14},"children":["Matcher evaluation"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Matchers filter which transactions a policy applies to. A transaction must match ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["all"]}," matchers on a policy for that policy to apply. If a policy has no matchers, it applies to ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["all"]}," transactions for that asset."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Matcher types include: ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["TRANSACTION_TYPE"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["USER"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["API_CREDENTIAL"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["ADDRESS_ID"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["COUNTERPARTY_ID"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["WALLET_ID"]},", and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["SIGN_FOR"]},"."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["See ",{"$$mdtype":"Tag","name":"a","attributes":{"href":"/products/wallet/user-interface/policies/policies-reference#matchers"},"children":["Policy reference"]}," for detailed matcher documentation and examples."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"monitoring-policy-checks-with-webhooks","__idx":15},"children":["Monitoring policy checks with webhooks"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If you have webhooks configured for the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["TRANSACTION"]}," domain, you receive notifications as transactions move through the policy check stage. The relevant statuses are:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Status"},"children":["Status"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Description"},"children":["Description"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["POLICY_CHECK_PENDING"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Transaction is being evaluated against policies"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["POLICY_CHECK_PASSED"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Transaction passed all policy checks"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["REJECTED"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Transaction was rejected (by policy or approval)"]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["These webhooks allow you to build automated monitoring for policy enforcement — for example, alerting on rejected transactions or tracking policy check latency."]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info","name":"No policy lifecycle webhooks"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Webhook notifications cover ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["transaction"]}," status changes only. There are no webhook events for policy creation, approval, or deletion. To track policy lifecycle changes, use the ",{"$$mdtype":"Tag","name":"a","attributes":{"href":"/products/wallet/user-interface/integrations/overview#approval-domain"},"children":["Approval domain"]}," webhooks, which notify when approval requests for policy rules are created or resolved."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["See ",{"$$mdtype":"Tag","name":"a","attributes":{"href":"/products/wallet/user-interface/integrations/overview"},"children":["Webhooks overview"]}," for setup instructions and payload format."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"what-to-read-next","__idx":16},"children":["What to read next"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"a","attributes":{"href":"/products/wallet/user-interface/policies/policies-reference"},"children":["Policy reference"]}," – Complete reference for all limit types, matchers, and configuration options"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"a","attributes":{"href":"/products/wallet/user-interface/policies/policies-manage"},"children":["Manage policies"]}," – Step-by-step guide to create, modify, and delete policies"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"a","attributes":{"href":"/products/wallet/user-interface/policies/policies-best-practices"},"children":["Policy best practices"]}," – Recommended patterns and common configurations"]}]}]},"headings":[{"value":"Policy concepts","id":"policy-concepts","depth":1},{"value":"Policy scope","id":"policy-scope","depth":2},{"value":"Limit types","id":"limit-types","depth":2},{"value":"Policy uniqueness","id":"policy-uniqueness","depth":2},{"value":"Policy immutability","id":"policy-immutability","depth":2},{"value":"Policy lifecycle","id":"policy-lifecycle","depth":2},{"value":"Approval requirements","id":"approval-requirements","depth":2},{"value":"With approval groups configured","id":"with-approval-groups-configured","depth":3},{"value":"Without approval groups configured","id":"without-approval-groups-configured","depth":3},{"value":"Policy evaluation","id":"policy-evaluation","depth":2},{"value":"Where policies fit in the transaction pipeline","id":"where-policies-fit-in-the-transaction-pipeline","depth":3},{"value":"Evaluation order","id":"evaluation-order","depth":3},{"value":"Network fees and policy limits","id":"network-fees-and-policy-limits","depth":3},{"value":"Operations that bypass policies","id":"operations-that-bypass-policies","depth":3},{"value":"Matcher evaluation","id":"matcher-evaluation","depth":3},{"value":"Monitoring policy checks with webhooks","id":"monitoring-policy-checks-with-webhooks","depth":2},{"value":"What to read next","id":"what-to-read-next","depth":2}],"frontmatter":{"title":"Policy concepts","seo":{"title":"Policy concepts"}},"lastModified":"2026-04-07T14:25:06.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/products/wallet/user-interface/policies/policies-concepts","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}