Skip to main content

Setting the First Policy

Once policy-svc is part of your stack, every signing request is evaluated against the policy of the group the user belongs to. Every new user joins the default-policy group, and that group is seeded with a policy that has no rules.

A request that matches no rule is denied. Until an admin saves a policy with at least one matching allow rule, every signature is rejected.

The admin dashboard is a small web app for authoring the default policy.

Before you start

  • The stack from Running the Server, which already includes both policy-svc and the dashboard.
  • An Auth0 user holding the admin role from Auth0.

1. Sign in

Open the dashboard at http://localhost:3000 and click Sign in with Auth0.

Make sure the user you log-in with, holds the admin role assigned in Auth0.

2. Open the default policy

Policies lists one row per group. Groups cannot be created or deleted, so on a fresh stack there is exactly one — default-policy, which applies to every user. Open it.

The group page shows the rules on the left and a read-only JSON preview of the whole policy on the right. On a fresh stack the rule list is empty and the preview shows a policy with no rules — the state that denies every signature.

3. Add a rule

A rule has a Description, an Issuers list, an Action, a Chain, a Combine conditions setting, and one or more conditions. A condition has a Transaction type, an Attribute, an Operator, and a Value, plus an optional ABI fragment under Advanced.

Issuers is locked to Anyone (*) on the default policy, so the only decisions you make are the action, the chain, and the conditions.

The simplest rule that unblocks native ETH transfers is Action Allow, Chain Ethereum, transaction type Native transfer, attribute nativeValue, operator greater than, value 0.

Amounts are written in the chain's smallest unit — wei for ETH, lamports for SOL. 0.00001 ETH is 10000000000000, and 1 SOL is 1000000000.

4. Review and save

Saving opens a Review changes before saving dialog showing the JSON diff of what you changed. Confirming replaces the group's policy and applies it to every member immediately.

Adding an Allow Eth rule to the default policy, then saving it

The recording is from the Duo sandbox, whose policy already has five rules — so its diff reads Rule 6 added. On a fresh stack yours is the first rule.

5. Signing now works

auth-svc evaluates every signing request against the saved policy and allows anything a rule matches. Nothing has to be restarted — policy-svc reads the policy on each request.

If a signing request was rejected before you saved this, retry it now.

A rule only applies to the traffic it describes, so most rules fail on any given request and that is normal — one passing allow is enough. For a worked example with six rules, the resulting policy-svc log lines, and what a denial looks like end to end, see Policy Engine in the React Native boilerplate guide.