Policy best practices

This page provides recommended patterns for planning, configuring, and maintaining transaction policies.

Start restrictive, then expand. Begin with conservative limits and increase them as you understand your transaction patterns. It's easier to raise limits than to recover from unauthorized transactions.

Layer your limits. Combine multiple limit types for defense in depth:

For example, a hot wallet holding ETH might use three policies together:

{"limitType": "PER_TX", "symbol": "ETH", "limitQty": "10"}
{"limitType": "ROLLING_DURATION", "symbol": "ETH", "limitQty": "50", "duration": "86400s"}
{"limitType": "CONSTANT", "symbol": "ETH", "limitQty": "500"}

This ensures no single transaction exceeds 10 ETH, no more than 50 ETH leaves in any 24-hour period, and the wallet can never send more than 500 ETH total.

Enable approval groups. Without approval groups, anyone with policy:create or keylimit:create API permissions can instantly enable policies. See Approvals to add human oversight.

Avoid common mistakes:

• Don't use zero or negative limits, they block all transactions or behave unpredictably.
• Don't rely on a single high-limit policy without matchers—it provides minimal protection.
• Don't rely solely on per-transaction limits—combine with rolling limits to catch accumulation attacks.
• Don't leave assets without policies—transactions will fail with No transaction limit configured for <asset>.

The following examples show common policy configurations for different wallet types.

Hot wallet – Process many small transactions automatically with tight limits:

{"limitType": "PER_TX", "symbol": "ETH", "limitQty": "1"}
{"limitType": "ROLLING_DURATION", "symbol": "ETH", "limitQty": "50", "duration": "86400s"}

Cold storage – Hold long-term reserves with strict, manually-approved withdrawals. Use low per-transaction limits and combine with mobile-only MPC quorums and transaction approval groups.

Treasury wallet – Handle large transfers to trusted counterparties while restricting other destinations:

{"limitType": "PER_TX", "symbol": "ETH", "limitQty": "1000", "matchers": [{"type": "COUNTERPARTY_ID", "values": ["trusted-uuid"]}]}
{"limitType": "PER_TX", "symbol": "ETH", "limitQty": "10"}

Role-based limits – Use USER matchers to set different limits for different team members:

{"limitType": "PER_TX", "symbol": "ETH", "limitQty": "5", "matchers": [{"type": "USER", "values": ["ops-user-uuid"]}]}
{"limitType": "PER_TX", "symbol": "ETH", "limitQty": "100", "matchers": [{"type": "USER", "values": ["finance-user-uuid"]}]}

API credential isolation – Use API_CREDENTIAL matchers to limit each integration's authority:

{"limitType": "PER_TX", "symbol": "ETH", "limitQty": "1", "matchers": [{"type": "API_CREDENTIAL", "values": ["trading-bot-uuid"]}]}
{"limitType": "ROLLING_DURATION", "symbol": "ETH", "limitQty": "100", "duration": "86400s", "matchers": [{"type": "API_CREDENTIAL", "values": ["settlement-uuid"]}]}

Review policies regularly. Schedule periodic reviews to check whether limits are still appropriate for current transaction volumes, whether unused policies should be removed, and whether new assets need policies.

Monitor transaction rejections. Frequent rejections may indicate limits set too low, attempted unauthorized access, or misconfigured policies. Use the transaction list to filter by REJECTED status and review the rejection reasons.

Document your policy strategy. Record why each policy exists, who approved it, and when it was last reviewed. This helps during audits and when onboarding new team members.

Upgrade to scoped matchers. If you have existing policies without matchers, you can add more granular policies alongside them. When a policy with matchers matches a transaction, it replaces the policies without matchers for that transaction, including rolling and max-total-value policies. Add matching rolling or lifetime policies with the same matchers if you want those caps to keep applying:

{"limitType": "PER_TX", "symbol": "ETH", "limitQty": "10"}
{"limitType": "PER_TX", "symbol": "ETH", "limitQty": "100", "matchers": [{"type": "COUNTERPARTY_ID", "values": ["trusted-uuid"]}]}

Replace policies safely. Policies are immutable. To change a policy's limits, create the new policy first, then delete the old one after the new policy is active. See Manage policies via the console for the step-by-step process.

• Policies – Core concepts and lifecycle
• Policy reference – Complete API reference
• Manage policies via the console – Step-by-step guide
• Approvals – Configure approval groups