Skip to main content
Wallet and signer policy layers are in early access. Talk to us if you’d like to participate.
Dynamic composes rules in layers. At sign time, the enclave evaluates the layers that apply to a wallet and signer, in this order:
  1. Environment: rules set by the developer for the whole environment. See Creating & Managing Rules for how to configure them.
  2. Account (business accounts only): rules set by a business-account owner or admin; apply to every wallet in that account.
  3. Wallet: rules set on a specific wallet.
  4. Signer: rules set on a specific signer share set.
A transaction must pass every layer. Broader layers enforce org-wide or account-wide guardrails, and narrower layers add further restrictions for individual wallets or signers.

​
Who can set each layer

  • Environment: set by the developer in the Developer Dashboard or through the API. These rules apply to every wallet in the environment.
  • Account: set by a business-account owner or admin through the JavaScript SDK or the Dynamic API. This layer only exists for business accounts.
  • Wallet: set by the wallet owner, or by a business-account owner or admin for business-account wallets. See Managing layers for API examples.
  • Signer: set by the signer through the SDK, or by a business-account owner or admin for any signer in the account. See Managing layers for API examples.
For business-account policy workflows, see the JavaScript SDK business accounts guide.

​
Signer-modifiable rules

A rule on the wallet or signer layer can be marked with modifiableBySigner: true. This makes the rule a recommended default that the signer can later edit or remove, instead of a constraint only an admin or wallet owner can change. Use this when you want signers to manage their own constraints. For example, a business-account owner can set an allow rule with a list of approved addresses and a value limit, and the signer can update those constraint fields as their needs change. A signer can only edit the rule’s constraint fields, such as addresses and valueLimit. They cannot change the rule type, disable Blockaid security checks, or add operation restrictions.
modifiableBySigner cannot be set on environment-scope rules, and it cannot be combined with disableBlockaidSecurityChecks or operationRestrictions.
For API examples, see Managing layers.

​
Next steps

Policies & Rules Overview

Learn the security model, allowlist mode, and value limits.

Creating & Managing Rules

Set environment-wide rules in the dashboard or API.

Managing layers

Set account, wallet, and signer layers through the API.
Last modified on August 13, 2026