# Configure a signing policy

Signing Policy changes are drafted and submitted as one atomic update. You need **Manage Signing Policies & Security Groups** permission for the selected policy's scope.

## Open a policy

1. In the sidebar, select **Signing Policies**.
2. Select **Offchain** or a vault.
3. Select **Edit Rules**.

You can also open a vault, select its **Signing Policy** tab, and edit the same policy there.

## Add a rule

1. Select **Add Rule**.
2. For a vault policy, choose **On-chain transfer** or **Raw signing**.
3. Select the required **Initiator group**.
4. Select the required **Key group** for Offchain or **Source** security group for a vault.
5. Configure the conditions for the selected rule type.
6. Under **Then**, choose **Approve** or **Deny**.
7. Add the rule to the draft.

### Configure an on-chain transfer rule

For each condition, either allow any value or make an explicit selection:

* **Network:** select one or more networks.
* **Asset amount:** select assets and optionally add an operator and amount cap for each one.
* **Destination:** enter the permitted EVM or Solana addresses.
* **USD value:** optionally add an operator and dollar cap when price-based policies are enabled.

Asset choices are limited to assets supported by the selected networks. The editor warns when an asset or destination does not match the rule's network scope.

### Configure a raw-signing rule

Confirm the endpoint displayed by the editor, then scope the rule with the smallest practical initiator and security groups. Raw signing does not use network, asset, destination, or USD value conditions.

## Order the rules

Drag rules to set their priority. The first matching rule wins. The permanent default-deny rule stays pinned at the bottom.

A useful pattern is to place narrow deny rules first, followed by narrow approve rules. Review the full order, not only the rule you added.

## Review and submit

1. Select **Submit**.
2. Review the summary of added, removed, and changed rules.
3. Confirm the update.
4. Complete the passkey prompt.

The new policy becomes active after the operation completes. Select **Discard** to abandon the whole draft without changing the active policy.

## Example: approve bounded treasury transfers

Assume the **Treasury operators** group may use wallets in the **Treasury wallets** security group to send ETH on Ethereum, up to 2 ETH, only to two approved destinations.

1. Open the vault policy and select **Edit Rules**, then **Add Rule**.
2. Choose **On-chain transfer**.
3. Set **Initiator group** to **Treasury operators**.
4. Set **Source** to **Treasury wallets**.
5. Select Ethereum under **Network**.
6. Select ETH under **Asset amount**, turn off **any amount**, and set the cap to less than or equal to 2.
7. Under **Destination**, add the two approved Ethereum addresses.
8. Choose **Approve**, add the rule, and place it above broader rules.
9. Submit, review the summary, and confirm with your passkey.

Any request outside those conditions falls through to the next rule and ultimately to the default deny.