---
name: cdp-policies
description: Creates transaction policies with accept/reject rules, attaches them to accounts, and tests enforcement. Supports value, address, and network criteria.
---

# cdp-policies

Policy CRUD and enforcement testing.

## Create policy

MUST include both accept AND reject rules (default when no rule matches is deny):

```
cdp policy-engine policies create scope=account \
  'rules:=[
    {"action":"accept","operation":"sendEvmTransaction","criteria":[{"type":"ethValue","ethValue":"50000000000000","operator":"<"}]},
    {"action":"reject","operation":"sendEvmTransaction","criteria":[{"type":"ethValue","ethValue":"50000000000000","operator":">="}]}
  ]'
```

## Project-scoped policy

Only one project-level policy can exist at a time. Applies to all accounts.

```
cdp policy-engine policies create scope=project \
  'rules:=[{"action":"accept","operation":"sendEvmTransaction","criteria":[{"type":"ethValue","ethValue":"100000000000000","operator":"<"}]}]'
```

## Attach to account

On create: `cdp evm accounts create name=<name> accountPolicy=<policyId>`
On existing: `cdp evm accounts update <address> accountPolicy=<policyId>`

Verify attachment: `cdp evm accounts get <address>` — check `accountPolicy` field.

## Test enforcement

1. Fund the account → `/cdp-accounts-create`
2. Under threshold (should PASS):
   Send `0.00001ether` via `/cdp-accounts-send` → assert `transactionHash` returned.
3. At/over threshold (should REJECT):
   Send `0.0001ether` via `/cdp-accounts-send` → assert `policy_violation` error.

## Update policy

```
cdp policy-engine policies update <policyId> 'rules:=[...]'
```
Re-test: previously rejected value should now succeed (re-encode tx for fresh nonce).

## CRUD

- List: `cdp policy-engine policies list scope==account` (note: `==` for query param)
- Get: `cdp policy-engine policies get <policyId>`
- Delete: detach first (`cdp evm accounts update <address> accountPolicy=""`), then:
  ```
  cdp policy-engine policies delete <policyId>
  ```

## Supported operations

`signEvmTransaction`, `sendEvmTransaction`, `signEvmMessage`, `signEvmTypedData`, `signEvmHash`,
`signSolTransaction`, `sendSolTransaction`, `signSolMessage`,
`prepareUserOperation`, `sendUserOperation`,
`signEndUserEvmTransaction`, `sendEndUserEvmTransaction` (and Solana equivalents)

## Criteria types

`ethValue` (operators: `<`, `<=`, `>`, `>=`, `==`), `evmAddress` (`in`, `notIn`),
`evmNetwork`, `evmData` (`startsWith`, `equals`), `netUSDChange`,
`solValue`, `solAddress`, `solNetwork`, `solData`, `programId`, `splAddress`, `splValue`,
`evmMessage`, `solMessage`

## Notes

- Rules are chain-specific: `ethValue` on `sendSolTransaction` will not match.
- Default threshold of 50000000000000 wei = 0.00005 ETH. Use `0.00001ether` for passing sends.