Skip to main content
You’re viewing Porto documentation — a distinct product from Anchorage Digital’s core custody platform. Go to Anchorage Digital docs →
Rules define the approval requirements for a specific operation type in your vault or admin policy. Porto rules are keyed to operation type — not dollar amount, address type, or time of day.

​
What is a rule

A rule pairs an operation type with an approval requirement:
  • Operation type: withdrawal, governance, staking, user management, trusted destination, vault, or API management
  • Approval requirement: the base quorum (and any subquorums) that must approve operations of that type
Example rule:
  • Operation type: Withdrawal
  • Approval requirement: 2 of 3 senior officers

​
Rule types you can create

Porto does not support amount-based, address-based, or time-based rule conditions — every rule applies uniformly to all operations of its type.

​
Adding a rule

1

Open policy

Go to Settings > Policies > Vault policy or Admin policy.
Vault policy screen showing list of existing rules

Policy overview with rules

2

Tap add rule

Select Add rule.
3

Select the operation type

Choose which operation type this rule applies to (withdrawal, governance, staking, user management, trusted destination, vault, or API management).
4

Define approval requirements

Specify who must approve:
  • Base quorum members: who can approve operations of this type
  • Number of approvers: how many of the base quorum must approve
  • Sub-quorums (optional): any additional mandatory groups — see Adding subquorums
5

Save the rule

Tap Save or Create rule.
6

Submit policy changes

Tap Submit policy or Apply changes. The new rule becomes active.
7

Approve if required

If your vault or admin policy requires approval for policy changes, the rule change must be approved.

​
Rule examples

​
Example 1: Withdrawal rule

Operation type: Withdrawal Approval requirement: 2 of 3 senior officers

​
Example 2: Trusted destination rule with a subquorum

Operation type: Trusted destination Approval requirement: Base quorum of 2 of 5, plus a subquorum requiring 1 of 2 Compliance officers

​
Example 3: User management rule

Operation type: User management Approval requirement: 2 of 3 admins

​
One rule per operation type

Each operation type has exactly one rule governing it per policy — there’s no rule-priority engine to reason about, because rules don’t overlap or compete for the same operation. If you haven’t customized a rule for a given operation type, that type follows the default policy.

​
Default policy

Every policy has a default configuration that governs any operation type you haven’t explicitly customized:
  • Purpose: Ensures every operation type always has a valid approval path, even before you’ve customized anything
  • Cannot be deleted: The default policy always applies to operation types without a customized rule

​
Testing rule changes

Before finalizing a new rule:
  1. Confirm the operation type — Make sure you’ve selected the correct operation type; rules don’t have overlapping conditions to double-check
  2. Confirm the approval count is achievable — Ensure enough base-quorum members and subquorum members exist to meet the requirement
  3. Communicate the change — Let affected users know a new rule is in effect for that operation type

​
Common mistakes to avoid

Mistake 1: Expecting amount- or time-based rules
  • Porto rules apply uniformly to an operation type; they cannot vary by dollar amount, destination type, or time of day.
Mistake 2: Too many mandatory subquorums
  • Adding many subquorums to one rule makes every operation of that type require sign-off from every group — this can create bottlenecks. Only add subquorums for groups whose participation is genuinely required.
Mistake 3: Forgetting the default policy still applies elsewhere
  • If you only customize a rule for withdrawals, all other operation types (governance, staking, etc.) still follow the default policy until you customize them too.

​
Rule documentation

When creating rules, document:
  • Why: Why is this rule necessary? What risk does it address?
  • Approval: Who must approve, and why?
  • Changes: When was it created/modified?
  • Owner: Who is responsible for this rule?

​
Managing rules over time

See Managing rules, Editing rules, and Deleting rules for ongoing rule maintenance.