Policies

Apply account-wide, wallet, and signer policy rules to business-account wallets.

Business Accounts are in early access. See the overview for the model.

Business-account wallets use Dynamic’s policy composition feature. Rules are evaluated in layers, from the broadest to the narrowest:

• Environment-Layer: rules set by the developer for the whole environment. For how to set environment-wide rules, see Creating & Managing Rules in the general Policies & Rules guide.
• Account-Layer: one policy that applies to every wallet in the business account. Only a business-account owner or admin can edit it.
• Wallet-Layer: rules for a specific wallet. On a business-account wallet, only a business-account owner or admin can edit it.
• Signer-Layer: rules for an individual signer. A signer can edit their own layer; a business-account owner or admin can edit any signer’s layer.

A transaction must pass every layer.

For the rule types and security model, see Policies & Rules.

JavaScript SDK helpers

For account, wallet, and signer layers, the JavaScript SDK provides sugar helpers that work with a PolicyRules map. They handle rule IDs and batch updates for you.

import {
  createPolicy,
  getPolicy,
  removePolicyRules,
} from '@dynamic-labs-sdk/client/waas';

Account-Layer

Use scope: { businessAccountId } to apply rules to every wallet in the business account.

const businessAccountId = businessAccount.id;

// Set or replace account-wide rules
const layer = await createPolicy({
  scope: { businessAccountId },
  chain: 'EVM',
  chainIds: [1],
  rules: {
    allowAddresses: ['0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48'],
    maxPerTransaction: { amount: '100000000000' },
  },
});

// Read the account-Layer back into the sugar map
const { rules, layerId, updatedAt } = await getPolicy({
  scope: { businessAccountId },
});

// Remove account-wide rules by their sugar keys
await removePolicyRules({
  scope: { businessAccountId },
  chain: 'EVM',
  chainIds: [1],
  rules: ['maxPerTransaction'],
});

Wallet-Layer

Use scope: { walletId }, where walletId is the wallet’s verifiedCredentialId.

const walletId = walletAccount.verifiedCredentialId;

// Set or replace rules by key
const layer = await createPolicy({
  scope: { walletId },
  chain: 'EVM',
  chainIds: [1],
  rules: {
    allowAddresses: ['0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48'],
    maxPerTransaction: { amount: '100000000000' },
  },
});

// Read the layer back into the sugar map
const { rules, layerId, updatedAt } = await getPolicy({
  scope: { walletId },
});
// rules.allowAddresses, rules.maxPerTransaction, etc.

// Remove rules by their sugar keys
await removePolicyRules({
  scope: { walletId },
  chain: 'EVM',
  chainIds: [1],
  rules: ['maxPerTransaction'],
});

Signer-Layer

Use scope: { walletId, shareSetId } to target a specific signer. For the caller’s own signer, scope: { shareSetId } also works if the wallet account is in the client’s state.

// Set or replace signer rules
const layer = await createPolicy({
  scope: { walletId, shareSetId },
  chain: 'EVM',
  chainIds: [1],
  rules: { denyAddresses: ['0x...'] },
});

// Read signer rules
const { rules } = await getPolicy({
  scope: { walletId, shareSetId },
});

// Remove signer rules by key
await removePolicyRules({
  scope: { walletId, shareSetId },
  chain: 'EVM',
  chainIds: [1],
  rules: ['denyAddresses'],
});

Signer-modifiable defaults

When you set modifiableBySigner: true on a wallet or signer-layer rule, the signer can later edit or remove that rule. This is useful for recommended defaults, such as an approved address list or a spending limit, that a signer can adjust without contacting an admin or owner.

A signer can only modify the rule’s constraint fields, such as addresses and valueLimit. They cannot change the rule type, disable Blockaid security checks, or add operation restrictions.

modifiableBySigner cannot be set on environment-scope rules, and it cannot be combined with disableBlockaidSecurityChecks or operationRestrictions.

For API examples, see Managing layers.

Rule fields

A WaasPolicyRule has the following fields:

Field	Description
name	Human-readable rule name.
ruleType	allow or deny.
chain	Chain the rule applies to, e.g. EVM, SOL, BTC.
chainIds	Array of chain IDs the rule applies to.
addresses	Array of addresses the rule applies to.
valueLimit.maxPerCall	Maximum value per transaction, in the asset’s smallest unit.
operationRestrictions.blockExport	When true on a deny rule, blocks private key export.
modifiableBySigner	When true, the signer the rule applies to can edit or remove the rule. Only valid on wallet and signer layers.

For allowlist semantics, address evaluation, and value limits, see Policies & Rules.

Next steps

Manage signers

Add and remove signers on a business-account wallet.

Sign transactions

Sign with a business-account wallet.