# Understanding Administrative Policy

Administrative Policy answers one question: who is allowed to do what in the Crypto Vault? It controls every administrative action, from creating users to changing system settings.

## Deny by default

Every action starts denied. A rule explicitly grants one or more groups permission to perform the action. If no rule matches the caller, the action is blocked.

At bootstrap, **Modify Admin Policy** is granted to the initial Admins group so the first administrators can configure the remaining actions.

## Governed actions

| Action | What it permits |
|---|---|
| **Modify Admin Policy** | Change Administrative Policy rules |
| **Create Vaults** | Create and edit vaults |
| **Create & Manage Wallets/Keys** | Import, generate, update, and delete keys and wallets; manage their security group membership |
| **Manage Signing Policies & Security Groups** | Change Signing Policies and manage security groups |
| **Manage Users** | Create, update, and remove human users and Machine Users & Agents |
| **Manage User Groups** | Create groups and change membership |
| **View & Export Audit Log** | Review and export audit records |
| **View System Resources** | Read system resource data, including System Settings |
| **Freeze Assets** | Freeze keys, wallets, and vaults |
| **Unfreeze Assets** | Restore frozen keys, wallets, and vaults |
| **Configure Venues** | Create and update venue configuration |
| **Access Keys Backup** | Export the encrypted recovery kit |
| **Modify System Settings** | Enable or disable deployment-wide settings |

Freeze and unfreeze are separate actions. You can let an on-call operations group halt signing while limiting recovery to a smaller senior group.

## Vault-scoped rules

Two actions support a scope on each rule:

* **Create & Manage Wallets/Keys**
* **Manage Signing Policies & Security Groups**

The scope can be:

* **Any vault:** all current and future vaults.
* **Offchain:** exchange and API keys and their Offchain Signing Policy.
* **Selected vaults:** only the named vaults.

Use selected-vault scopes to separate teams or environments without creating broad administrative access. **Create Vaults** is not vault-scoped because the target vault does not exist yet.

## Mapping actions to groups

A human user or Machine User gains the union of the capabilities granted to all of its groups. For a vault-scoped action, the caller must also match the target scope.

For example, a user may be able to manage wallets in the Treasury vault, edit the Offchain policy, and have no access to wallets in the Settlement vault.

## How enforcement works

1. The Crypto Vault checks the caller's group memberships against the active Administrative Policy.
2. For a vault-scoped action, it also checks the target policy or vault.
3. If no rule matches, the request is denied.
4. If a rule matches, the action proceeds after the required request authentication.

Policy enforcement is consistent across all three Crypto Vault nodes. No single node can bypass the active policy.