Vault Policy

Overview

Policies can define transaction limits, approval quorum, allowlisted destinations, supported assets, time windows, role permissions, withdrawal delays, recovery, and emergency actions. They may exist in organizational documents, custody platforms, hardware systems, or smart-contract code.

Written and technical policies may differ. A platform administrator might bypass configured rules, or an upgrade key may replace contract logic. Overly rigid policy can block urgent access, while broad exceptions can remove protection. Incorrect asset or network mappings can also cause unintended approvals.

Owners should establish a single authoritative policy model and map it to actual system permissions. Changes need independent approval, testing, versioning, effective dates, and alerts. Exceptions require scope, compensating controls, and expiry. Periodic testing should confirm that prohibited actions fail and permitted recovery works. Policy evidence should connect every executed action to the applicable rule version.

Vault Policy should be distinguished from investment ownership and from a software interface. For example, a provider may display an asset balance while holding pooled assets through another custodian; operations must verify contractual rights, segregation, withdrawal capability, and external evidence rather than rely on the screen alone.

Vault Policy works through controlled onboarding, asset receipt, internal attribution, storage-tier assignment, authorization, signing or provider instruction, monitoring, withdrawal, reconciliation, reporting, and return or migration. For Vault Policy, each handoff needs stable identifiers and an authoritative record of who approved and executed it.

The operating model for Vault Policy should map legal ownership, beneficial entitlement, technical control, account structure, asset segregation, supported networks, signing policy, provider roles, contractual duties, and insolvency treatment. For Vault Policy, these dimensions can belong to different parties and must not be inferred from a wallet label.