> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dynamic.xyz/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Managing layers

> Create, read, update, and remove policy rules on account, wallet, and signer layers through the Dynamic API.

> [!NOTE]
>
> Wallet and signer policy layers are in **early access**. [Talk to us](https://www.dynamic.xyz/talk-to-us) if you'd like to participate.

Rules are composed in layers. Environment-wide rules are set in the [Dynamic Console](https://docs.dynamic.xyz/docs/platform/console/general.md) or through the [environment policy API](https://docs.dynamic.xyz/docs/embedded-wallets/mpc/policies/creating-rules.md). Account, wallet, and signer layers are set with the Dynamic SDK API or JavaScript SDK helpers.

For JavaScript SDK helpers, see [Manage Policies](https://docs.dynamic.xyz/docs/embedded-wallets/mpc/policies/manage-policies.md) for wallet and signer layers on any embedded wallet, or the [business accounts policies guide](https://docs.dynamic.xyz/docs/javascript/reference/business-accounts/policies/overview.md) for the account layer.

> [!NOTE]
>
> A layer holds either legacy rules (the "Legacy rules" tabs on the layer pages) or [declarative rules](https://docs.dynamic.xyz/docs/embedded-wallets/mpc/policies/declarative-rules.md) (the "Declarative rules" tabs), never both. A write that would mix them is refused with `composition_layer_edit_mixed_rule_syntax`. Declarative rules are in early access and must be enabled for your environment; until they are, a declarative write returns 403 with `rule_syntax_disabled`. For ready-made rules, see [Rule examples](https://docs.dynamic.xyz/docs/embedded-wallets/mpc/policies/rule-examples.md).

## Before you start

The layer pages use `https://app.dynamicauth.com/api/v0` as the base URL and your environment ID. Account, wallet, and signer layer calls go to `/sdk/<environment_id>/...` and authenticate with the signed-in end user's JWT (`<user_jwt>`), not an environment API token. Environment-wide rules use a developer API token instead; see [Creating & Managing Rules](https://docs.dynamic.xyz/docs/embedded-wallets/mpc/policies/creating-rules.md).

* For business-account layers, the caller must be a business-account owner or admin.
* For wallet and signer layers, the caller must be the wallet owner. A business-account owner or admin can also manage layers for wallets and signers in their account.

## Layers

| Layer | Applies to | Page |
| - | - | - |
| Account | Every wallet in a business account | [Account layer](https://docs.dynamic.xyz/docs/embedded-wallets/mpc/policies/account-layer.md) |
| Wallet | A single wallet | [Wallet layer](https://docs.dynamic.xyz/docs/embedded-wallets/mpc/policies/wallet-layer.md) |
| Signer | A single signer share set on a wallet | [Signer layer](https://docs.dynamic.xyz/docs/embedded-wallets/mpc/policies/signer-layer.md) |

Each page shows how to read the layer, add or update a rule, remove a rule, and replace the whole rule list.

## Signer-modifiable rules

To let a signer edit or remove a wallet or signer-layer rule later, set `modifiableBySigner: true` when you create or update the rule. The signer can only modify the rule's constraint fields, such as `addresses` and `valueLimit`. They cannot change the rule type or security settings.

Declarative rules also accept `modifiableBySigner`; the examples below use legacy rules. `modifiableBySigner` cannot be used on environment-scope rules, and it cannot be combined with `disableBlockaidSecurityChecks` or `operationRestrictions`.

### Wallet-layer example

```bash theme={"system"}
curl -X PATCH \
"https://app.dynamicauth.com/api/v0/sdk/<environment_id>/waas/<wallet_id>/policy-layer" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer <user_jwt>" \
-d '{
  "op": "upsert",
  "rule": {
    "name": "Allow USDC with signer-editable limit",
    "ruleType": "allow",
    "chain": "EVM",
    "chainIds": [1],
    "addresses": ["0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48"],
    "valueLimit": { "maxPerCall": "100000000000" },
    "modifiableBySigner": true
  }
}'
```

### Signer-layer example

```bash theme={"system"}
curl -X PATCH \
"https://app.dynamicauth.com/api/v0/sdk/<environment_id>/waas/<wallet_id>/signers/self/policy-layer" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer <user_jwt>" \
-d '{
  "op": "upsert",
  "rule": {
    "name": "Signer-editable allowlist",
    "ruleType": "allow",
    "chain": "EVM",
    "chainIds": [1],
    "addresses": ["0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48"],
    "modifiableBySigner": true
  },
  "shareSetId": "<share_set_id>"
}'
```

## Legacy rule fields

The legacy rule fields (`ruleType`, `addresses`, `valueLimit`, and so on) apply to legacy layers only. For the fields used in the legacy examples, see [Rule fields](https://docs.dynamic.xyz/docs/embedded-wallets/mpc/policies/overview.md#rule-fields) on the Policies overview page.

## Next steps

> [card] [Account layer](https://docs.dynamic.xyz/docs/embedded-wallets/mpc/policies/account-layer.md)
>
> Rules that apply to every wallet in a business account.

> [card] [Wallet layer](https://docs.dynamic.xyz/docs/embedded-wallets/mpc/policies/wallet-layer.md)
>
> Rules that apply to a single wallet.

> [card] [Signer layer](https://docs.dynamic.xyz/docs/embedded-wallets/mpc/policies/signer-layer.md)
>
> Rules that apply to a single signer share set.

> [card] [Rule examples](https://docs.dynamic.xyz/docs/embedded-wallets/mpc/policies/rule-examples.md)
>
> Ready-made declarative rules.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.