Authorization is delegated, per operation, to a vault’s configured policy. The same validate interface is implemented by eight interchangeable policies, hot-swappable via update_vault_policy (only while transactions are disabled).
The shipped policies
| Policy | Use case | Program ID |
|---|
policy_owners | Gate by an owner set stored in the policy PDA | HyroXELvGkzBwgKz2Fsz2XEMDM6TYupZZ1A9qAtEM9Qs |
policy_manager_access | Manager-set gating for fund operations | Live on devnet |
policy_multisig | On-chain M-of-N signature gating | Live on devnet |
policy_limit_transfer | Min/max transfer bounds; drawdown / size cap | 7tSgfcgnfsPjogCSHP5BDe48vWFRMDddaC5KtEgsGvxb |
policy_withdrawal_window | Restrict ProcessWithdrawals to periodic windows | Live on devnet |
policy_challenges | The prop-firm challenge engine; authorizes oracle NAV reports | HyrowgoRRXfq1vwN5CTynd6keUAkm1kn2adRNqjTScwM |
policy_allow_any | Permit all (testing) | xrs3my6WB4KNyc9g7H2LCKCmUXUFJydyr5Un9AFTD1t |
policy_deny_all | Block all (emergency stop) | HmRxhUgc4rNR5dpzZvnBJYGUsL6a8w7keDr1hb8qAzCo |
What policies enforce on creation & execution
| Policy | On Creation | On Execution |
|---|
policy_owners | PDA check | require signer ∈ owners |
policy_manager_access | require signer == admin | require signer == admin |
policy_multisig | reject if a tx is pending; record pending + proposer’s bit | require set-bits ≥ threshold, then clear |
policy_limit_transfer | PDA check | decode proposed amount; require min ≤ amount ≤ max |
policy_allow_any | allow | allow |
policy_deny_all | allow | reject (freeze) |
TransactionAlreadyPending, NotEnoughSigners, AmountTooHigh / AmountTooLow, UnauthorizedSender.
The challenge policy and the oracle
policy_challenges is special: it authorizes the oracle’s NAV reports. Its validate(Report) reads the ChallengeTemplate and requires template.admin == signer — so only the designated oracle (the template admin) may push NAV for a challenge-bound vault. This is what makes the oracle trustworthy.
Each policy constrains only the operations it cares about; the rest pass through. To enforce several constraints at once, a combinator policy (planned) fans out to multiple checks. A vault binds exactly one policy at a time.
