Managing rules and policies

​

Understanding your current rules

1

Open vault policies

Go to Settings > Policies > Vault policy.

2

Review all rules

You’ll see a list of all active rules in priority order (most specific first).

3

Understand each rule

For each rule, note:

• What conditions trigger it (operation type, amount, address, time, role)
• Who must approve
• How many approvers are required
• Approval timeout

4

Map to operations

Mentally trace where recent operations would match in this rule list.

5

Identify gaps

Are there operations that don’t match any rule? (They shouldn’t be — default rule must exist)

​

Regular rule reviews

• Are any rules never matching? (Consider deleting)
• Are any rules too broad? (Consider making more specific)
• Are any rules conflicting? (Overlapping conditions with different requirements)
• Do team members still understand the rules?
• Have business conditions changed? (Volume, asset types, counterparties)
• Are approval times acceptable? (Fast enough but still safe)
• Do team members know the approval process?

​

Monitoring rule effectiveness

​

Track approval metrics

• Approval speed — How long do approvals typically take?
  • Target: Most approvals < 2 hours
  • Too slow: Consider reducing approver count or clarifying process
• Rejection rate — How often are operations rejected?
  • Target: < 5%
  • Too high: Consider rules too strict or rejections are due to user errors
• Escalation rate — How often do operations require higher-level approval?
  • Target: < 10-15%
  • Too high: Maybe your tiered thresholds are too conservative
• Rule hit rate — Which rules are matching operations?
  • All rules should match something eventually
  • Rarely-matching rules may be redundant

​

Generate reports

1. Rule usage report — Which rules matched how many operations last month?
2. Approval timeline report — How long did each operation take to approve?
3. Rejection report — What operations were rejected and why?
4. Audit trail — Who made changes to rules and when?

​

Identifying problem rules

​

Rule maintenance schedule

​

Updating rules

1. Identify the issue — What’s not working about the current rule?
2. Design the change — How will you modify the rule?
3. Announce the change — Notify stakeholders
4. Implement — Make the change and submit for approval
5. Monitor impact — Track the new rule’s effectiveness
6. Document — Record what changed and why

​

Policy simplification

• More than 7-8 rules per policy
• Rules with 3+ conditions
• 5+ subquorums with nested logic
• Users confused about how to get approvals

1. Merge similar rules — Combine rules with nearly identical requirements
2. Remove duplicates — If two rules do the same thing, delete one
3. Consolidate subquorums — Combine multiple specialized groups into broader categories
4. Use default rule — Remove overly specific rules; let broader rule apply
5. Eliminate time-based rules — These rarely add value and confuse users

• Before: 10 rules covering different asset types, amounts, and times
• After: 3 rules: small transactions (1 approver), medium ($X-Y, 2 approvers), large (>$Y, 3 approvers)

​

Approval process communication

1. Document the policy — Create a simple guide showing rules and approval requirements
2. Training — New users should understand their approval responsibilities
3. Visual flowchart — Create a diagram showing decision tree for approvals
4. FAQ — Answer common questions about why certain operations require certain approvals
5. Examples — Show concrete examples of different operation types

VAULT: Treasury

Simple operations (to trusted destinations): 1 approver needed
- Approver: Any of \{Treasurer, Assistant Treasurer\}
- Expected approval time: < 1 hour

Regular operations (to pre-approved addresses): 2 approvers needed
- Approvers: 2 of \{Treasurer, Assistant Treasurer, CFO\}
- Expected approval time: 2-4 hours

Large operations (> $500k or to new addresses): 3 approvers needed
- Approvers: All of \{Treasurer, CFO, CEO\}
- Expected approval time: 4-8 hours

​

Handling policy exceptions

1. Escalation procedure — How can someone request expedited approval?
2. Emergency override — What’s the process if normal approvers aren’t available?
3. Temporary exceptions — Can you temporarily change a rule for unusual situations?
4. Appeal process — What if someone disputes an approval decision?

​

Policy evolution tracking

​

Common policy scenarios

​

Growing organization

1. Stage 1 (startup): 1-2 approvers for everything
2. Stage 2 (20+ people): Different approval tiers (small/medium/large)
3. Stage 3 (100+ people): Role-based approvals, department-specific rules
4. Stage 4 (500+ people): Complex subquorum structures with specialized functions

​

High-compliance industry

• Annual compliance audit — Rules must be reviewed against compliance requirements
• Regulatory alignment — Ensure rules support compliance needs
• Documentation — Keep detailed records of policy changes and approvals
• Training — Users must understand policy and compliance implications

​

Multi-geography organization

• Regional policies — Different rules for different jurisdictions
• Central oversight — Corporate-level policies for cross-border operations
• Local expertise — Regional managers set policies for their area
• Compliance — Policies must meet all applicable regulations

​

Multiple currencies or asset types

• Asset-specific rules — Different approval requirements by asset type
• Amount rules — USD value thresholds vs. crypto amount thresholds
• Custody — Rules for custody assets vs. trading assets
• Bridges and derivatives — Special rules for higher-risk operations

​

Getting stakeholder buy-in

1. Document the rationale — Why is the change needed?
2. Show impact — How will approvals change? Speed? Security?
3. Get feedback — Ask stakeholders (users, approvers, compliance, legal)
4. Pilot if possible — Test the change with a subset first
5. Implement gradually — Phase in major changes rather than big bang
6. Monitor closely — Watch the impact; adjust if needed

​

Policy documentation template

POLICY NAME: [Name]
VAULT/ORGANIZATION: [Where it applies]
EFFECTIVE DATE: [When it starts]
LAST REVIEWED: [Date]
OWNER: [Person responsible]

PURPOSE:
[Why this policy exists; what risk it addresses]

RULES:
[List each rule with conditions and approval requirements]

SUBQUORUMS:
[If applicable, define each group and its quorum]

EXAMPLES:
[Show 2-3 example operations and their approval flows]

ESCALATION:
[How to handle exceptions or emergencies]

CHANGES FROM PREVIOUS VERSION:
[What was different; why it changed]

​

Tools and automation

• Policy management software — Visualize rules, test impact
• Approval workflow tools — Automate routing and notifications
• Audit logging — Automatically track all rule changes
• Analytics dashboards — Monitor approval metrics
• Template libraries — Pre-built policies for common scenarios

​

Best practices summary

• Regular reviews — Quarterly policy audits catch problems early
• Clear documentation — Users should understand why rules exist
• Simplify over time — Reduce complexity as you learn what works
• Monitor metrics — Track approval speed, rejection rates, escalations
• Communicate changes — Users should know about policy updates
• Keep history — Document why rules changed; helps with future decisions
• One change at a time — Don’t modify multiple rules simultaneously
• Involve stakeholders — Get buy-in from approvers, compliance, users
• Test before finalizing — Simulate how new rules will affect operations
• Maintain fallback — Always have a default rule; never leave operations without an approval path