# Configure your admin policy

This page walks you through editing the Administrative Policy: opening a draft, assigning actions to groups, reviewing the change summary, and activating the new policy with a passkey signature.

:::note
You need the **Modify Admin Policy** capability to make changes. At bootstrap, this capability is granted to the Admins group. If you cannot see the **Edit Policy** button, ask an administrator who has this capability.
:::

## Open a draft

1. Navigate to **Admin Policy** in the sidebar.
2. The page shows a two-pane layout. The left pane lists the administrative actions. The right pane shows the current rules for the selected action.
3. Click **Edit Policy** in the top-right corner. The entire page enters edit mode, and all actions become editable in a single draft.

:::tip
Only one pending draft can exist at a time. If you open a draft and leave without submitting or discarding, the draft remains open and the **Edit Policy** button takes you back into it rather than creating a new one.
:::

## Assign actions to groups

In edit mode, select each action in the left pane to configure its rules.

For each action:

1. Select the action in the left pane.
2. The action stays **denied by default**: no one can perform it until you add a rule granting it to a group.
3. Add one or more rules, choosing which groups are allowed to perform this action.
4. For **Create & Manage Wallets/Keys** and **Manage Signing Policies & Security Groups**, choose **Any vault**, **Offchain**, or one or more specific vaults for each rule.
5. Repeat for each action you want to configure.

**Any vault** includes current and future vaults. A selection of named vaults stays limited to those vaults. **Offchain** covers exchange and API keys rather than an on-chain vault.

**Tracking changes:** actions with unsaved changes show a blue dot in the left pane. Actions with configuration errors (for example, a rule referencing a group that has been deleted) show a red dot. Fix all red-dot errors before submitting.

## A common starter policy

If you are setting up the vault for the first time, a workable starting point assigns actions like this:

| Action | Group |
|---|---|
| Manage Users | Operations group |
| Manage User Groups | Operations group |
| Modify Admin Policy | Senior admins |
| Create Vaults | Trading operations |
| Create & Manage Wallets/Keys | Trading operations, scoped to the required vaults |
| Manage Signing Policies & Security Groups | Security administrators, scoped to the required vaults |
| Freeze Assets | Operations group |
| Unfreeze Assets | Senior admins |
| View System Resources | All staff group |
| View & Export Audit Log | Compliance group |
| Access Keys Backup | Senior admins |
| Configure Venues | Trading operations |
| Modify System Settings | Senior admins |

Adjust group names to match your organization's structure and risk tolerance.

## Review the change summary

When you are satisfied with all your changes:

1. Click **Submit** in the top-right corner.
2. A summary modal opens showing a diff of every changed action: rules added and rules removed.
3. Review the diff carefully. If anything looks wrong, click **Cancel** to go back and adjust the draft.

## Submit and sign with your passkey

1. Click **Confirm** in the summary modal.
2. Your browser shows the WebAuthn prompt (Face ID, Touch ID, Windows Hello, or PIN depending on your device).
3. Approve the gesture. The passkey signature is attached to the policy submission.
4. The vault applies all changed rules atomically. The page exits edit mode and shows the newly active policy.

## Discard a draft

If you want to abandon all changes:

1. Click **Discard** while in edit mode.
2. A confirmation dialog asks you to confirm. Discarding removes all unsaved rule changes across every action.

You can also click **Discard** at any point during editing if you want to start over. The policy in effect remains unchanged until you submit.