> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dynamic.xyz/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Policies

> How the policy layers apply to business-account wallets and who can edit each one.

> [!NOTE]
>
> Business Accounts are in **early access**. See [Business Accounts](https://docs.dynamic.xyz/docs/business-accounts/accounts.md) for the model.

Members and signers decide who can act, and **policies** decide what they are allowed to do. A business-account wallet uses the same policy engine as any Dynamic embedded wallet, described in [Policies & Rules](https://docs.dynamic.xyz/docs/embedded-wallets/mpc/policies/overview.md). A business account adds one more layer, the Account layer, on top of the layers that every embedded wallet uses.

An owner or admin is a member with that role, as set out on [Members and roles](https://docs.dynamic.xyz/docs/business-accounts/members-and-roles.md), and a signer approves transactions and messages for one wallet, as set out on [Wallets and signers](https://docs.dynamic.xyz/docs/business-accounts/wallets-and-signers.md).

## Layers

Rules are evaluated in layers from the broadest to the narrowest, and a request must pass every layer that applies. Rules combine by tightening: a narrower layer can only make a rule stricter, never loosen a rule set at a broader layer. For example, with an Account value cap of 100 USDC and a Wallet value cap of 50 USDC, a 75 USDC payment is above the wallet cap, so the stricter cap applies. A request that a layer rejects is never signed. If the wallet also requires approvals, a rejected request never becomes an approval proposal either, and [Approvals](https://docs.dynamic.xyz/docs/business-accounts/approvals.md#approvals-for-signing) describes the order of the checks.

| Layer | Applies to | Who can edit it |
| - | - | - |
| Environment | Every wallet in the environment. | The developer, through the console or API. |
| Account | Every wallet in the business account. | A [business-account owner or admin](https://docs.dynamic.xyz/docs/business-accounts/members-and-roles.md). |
| Wallet | One wallet. | A [business-account owner or admin](https://docs.dynamic.xyz/docs/business-accounts/members-and-roles.md). |
| Signer | One signer on one wallet. | The signer, for their own layer, or a [business-account owner or admin](https://docs.dynamic.xyz/docs/business-accounts/members-and-roles.md) for any signer. |

The Account layer is the only layer that exists just for business accounts, and it covers only the wallets in a business account. The Wallet and Signer layers are in early access.

A signer can edit or remove the rules on their own signer layer. For a rule that someone else created, such as one an admin set, the signer can make changes only when the rule is marked `modifiableBySigner`. Even then, the signer can change only constraint fields, such as addresses and value limits, and cannot change the rule type or the security settings, such as Blockaid checks or export blocking.

See [Policy Layers](https://docs.dynamic.xyz/docs/embedded-wallets/mpc/policies/policy-layers.md) for how the layers combine and how a signer can be allowed to modify a rule.

## What a rule can do

Each rule below can be set on the Account, Wallet or Signer layer.

| Rule | Example |
| - | - |
| Allow addresses | The wallet can only interact with addresses on an approved list. |
| Deny addresses | A transfer to a blocked address is rejected. |
| Value cap | Each transaction is limited to 100 USDC. |
| Block export | The wallet's private key cannot be exported. |
| Approvals | A payment waits for 2 approvals before the wallet signs. |

The approval rule is a [quorum policy](https://docs.dynamic.xyz/docs/business-accounts/approvals.md#approvals-for-signing). It depends on the account's members and roles, so it only makes sense for business accounts.

## How policies differ from approvals

Policies limit what a wallet can sign. [Approvals](https://docs.dynamic.xyz/docs/business-accounts/approvals.md) cover two things: changes to the account, such as adding a member or linking a wallet, and signing.

## Next steps

In the JavaScript SDK, the [business account policies guide](https://docs.dynamic.xyz/docs/javascript/reference/business-accounts/policies/overview.md) shows how to set the account layer, and [Manage policies](https://docs.dynamic.xyz/docs/embedded-wallets/mpc/policies/manage-policies.md) shows how to set the wallet and signer layers. Without an SDK, set any of these layers through the [Dynamic API](https://docs.dynamic.xyz/docs/embedded-wallets/mpc/policies/managing-layers.md). The Dynamic Console sets only environment-wide rules.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.