# Policy Engine

Rules that sign — or refuse to. Amount tiers, named approvers, enforced at the MPC signature.

Spending limits enforced by a front end are advisory. Vaultody evaluates your rules before the
signing ceremony runs: a transaction request that does not clear its policy is never signed, so
there is no privileged screen, no override button and no support path that moves funds anyway.

## Anatomy of a rule

A rule scopes one or more vaults, an amount band, a rolling time window and a named approver list.
There are ten predefined tiers, from $0–10k up to $10M+, each with its own approver set and quorum.

- **Amount bands, not one limit** — reserves can run strict while float runs fast, per vault.
- **Every listed approver, or nothing** — above the threshold each named approver must confirm,
  and a single rejection ends the request.
- **Rolling windows** — catch salami-slicing, not just single large transfers.
- **No unguarded state** — with no rule configured, every transaction still requires one owner
  approval by default.

## Twenty-six actions beyond money

API key creation, webhook changes, team changes, backups and policy edits themselves are all
approval-gated through the same engine. Editing a policy is a governed action, so relaxing a
control leaves the same evidence trail as spending money — nobody quietly widens their own
mandate, automation included. Every evaluation lands in the append-only audit trail.

## FAQ

**Can we require two of four approvers instead of all of them?**
A rule requires all of its listed approvers — deliberate unanimity. Configure smaller approver
lists per tier for lighter flows; one rejection always stops the transfer.

**Who can approve?**
Humans on the mobile co-signer, holding a real key share behind biometrics, or your automated
signers for flows you have predefined — both inside the rule.

## Related

- [Roles & Permissions](/features/roles-and-permissions)
- [Mobile Co-signer](/features/mobile-co-signer)
- [Audit Trail](/features/audit-trail)
- [API Signer](/features/api-signer)