Skip to main content

​
What is the Secure Policy Engine, and what does it do?

The Secure Policy Engine is the gatekeeper. It runs inside secure hardware and checks every request against your rules: roles and quorums, per-user and per-asset limits, rate limits and time windows, destination allow or deny lists, dApp or function controls, and contextual checks such as price or gas parameters. Only when a request passes these checks does the engine compile the exact raw blockchain transaction and allow it to be signed.

​
Will approvers actually see what they are approving?

Yes. Approvers see a clear summary of the action: destination, asset, amount, any fees or limits, and a decoded view for smart-contract calls. They approve the intent from their phone. The enclave then compiles the exact on-chain payload that matches that intent. If anything would differ at sign time (for example, a parameter or a simulation result), the system refuses to sign and logs the discrepancy.

​
What happens if there is no matching policy for a requested action or asset?

If there is no rule, it does not go through. PrimeVault’s policy engine is fully deterministic. When multiple rules match, the engine resolves them in order of specificity. There are no “ambiguous” policies in the engine. Conflicts are either resolved by specificity or blocked at equal specificity until admins adjust the rules. All such attempts are logged, and you can require explicit configuration before any new assets, destinations, or workflows become eligible.

​
Can we create templates for policies and apply them at scale?

Yes. You can define policy templates that include roles, limits, quorums, allow-lists, and dApp or trade permissions. Attach them when you create vaults in the UI or via API. This gives you consistent guardrails at scale and reduces configuration drift.