Policy model
How spend limits, destination rules, and timelocks are intended to compose.
Specification, not description
Nothing below is implemented. This page states what the module is meant to do so that the tests, when they are written, have something to be measured against. Where this page and the code eventually disagree, the code is authoritative and this page is the bug.
Shape
The account delegates execution to a module. Every call the agent wants to make is presented to the module first, and the module either passes it through or reverts.
agent -> account -> policy module -> target
|
+-- reverts if any constraint rejects the callConstraints are intended to be conjunctive: a call has to satisfy every active constraint. There is no precedence order to reason about and no constraint that overrides another, because a rule that can be overridden is not a rule.
Constraints
Spend limits
A cap on value moved within a period. The open question is what "within a period" means precisely — see window boundary permits double-spend.
Destination rules
An allowlist of addresses the agent may reach. The open question is that reaching an address is not the same as constraining what happens there — see allowlisted routers reach arbitrary destinations.
Timelocks
A delay between requesting an operation and being able to perform it, so that a human has an opportunity to intervene. The open question is what happens when there are more queued operations than a human can read — see timelock queue can be flooded.
Revocation
An operator can withdraw the grant. This is intended to take effect immediately rather than after a delay, on the grounds that the situation in which you most want to revoke is the one in which you least want to wait.
What the model does not cover
Token approvals are not value movement, and a module that meters transfers does not see them. This is the sharpest gap in the model as currently conceived — see approvals move no value.
Testing intent
A test is the specification. Where an intended behaviour is described here and not yet implemented, the test that describes it is more valuable than the implementation and should land first, even skipped.