Managing layers

Wallet and signer policy layers are in early access. Talk to us if you’d like to participate.

Rules are composed in layers. Environment-wide rules are set in the Dynamic Console or through the environment policy API. Account, wallet, and signer layers are set with the Dynamic SDK API or JavaScript SDK helpers. For JavaScript SDK helpers, see Manage Policies for wallet and signer layers on any embedded wallet, or the business accounts policies guide for the account layer.

A layer holds either legacy rules (the “Legacy rules” tabs on the layer pages) or declarative rules (the “Declarative rules” tabs), never both. A write that would mix them is refused with composition_layer_edit_mixed_rule_syntax. Declarative rules are in early access and must be enabled for your environment; until they are, a declarative write returns 403 with rule_syntax_disabled. For ready-made rules, see Rule examples.

Before you start

The layer pages use https://app.dynamicauth.com/api/v0 as the base URL and your environment ID. Account, wallet, and signer layer calls go to /sdk/<environment_id>/... and authenticate with the signed-in end user’s JWT (<user_jwt>), not an environment API token. Environment-wide rules use a developer API token instead; see Creating & Managing Rules.

For business-account layers, the caller must be a business-account owner or admin.
For wallet and signer layers, the caller must be the wallet owner. A business-account owner or admin can also manage layers for wallets and signers in their account.

Layers

Layer	Applies to	Page
Account	Every wallet in a business account	Account layer
Wallet	A single wallet	Wallet layer
Signer	A single signer share set on a wallet	Signer layer

Each page shows how to read the layer, add or update a rule, remove a rule, and replace the whole rule list.

Signer-modifiable rules

To let a signer edit or remove a wallet or signer-layer rule later, set modifiableBySigner: true when you create or update the rule. The signer can only modify the rule’s constraint fields, such as addresses and valueLimit. They cannot change the rule type or security settings. Declarative rules also accept modifiableBySigner; the examples below use legacy rules. modifiableBySigner cannot be used on environment-scope rules, and it cannot be combined with disableBlockaidSecurityChecks or operationRestrictions.

Wallet-layer example

curl -X PATCH \
"https://app.dynamicauth.com/api/v0/sdk/<environment_id>/waas/<wallet_id>/policy-layer" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer <user_jwt>" \
-d '{
  "op": "upsert",
  "rule": {
    "name": "Allow USDC with signer-editable limit",
    "ruleType": "allow",
    "chain": "EVM",
    "chainIds": [1],
    "addresses": ["0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48"],
    "valueLimit": { "maxPerCall": "100000000000" },
    "modifiableBySigner": true
  }
}'

Signer-layer example

curl -X PATCH \
"https://app.dynamicauth.com/api/v0/sdk/<environment_id>/waas/<wallet_id>/signers/self/policy-layer" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer <user_jwt>" \
-d '{
  "op": "upsert",
  "rule": {
    "name": "Signer-editable allowlist",
    "ruleType": "allow",
    "chain": "EVM",
    "chainIds": [1],
    "addresses": ["0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48"],
    "modifiableBySigner": true
  },
  "shareSetId": "<share_set_id>"
}'

Legacy rule fields

The legacy rule fields (ruleType, addresses, valueLimit, and so on) apply to legacy layers only. For the fields used in the legacy examples, see Rule fields on the Policies overview page.

Next steps

Account layer

Rules that apply to every wallet in a business account.

Wallet layer

Rules that apply to a single wallet.

Signer layer

Rules that apply to a single signer share set.

Rule examples

Ready-made declarative rules.

Learn

Implement

Managing layers

Before you start

Layers

Signer-modifiable rules

Wallet-layer example

Signer-layer example

Legacy rule fields

Next steps

Account layer

Wallet layer

Signer layer

Rule examples

​Before you start

​Layers

​Signer-modifiable rules

​Wallet-layer example

​Signer-layer example

​Legacy rule fields

​Next steps

Account layer

Wallet layer

Signer layer

Rule examples

Before you start

Layers

Signer-modifiable rules

Wallet-layer example

Signer-layer example

Legacy rule fields

Next steps