> ## Documentation Index
> Fetch the complete documentation index at: https://docs.0xkey.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Policy templates

> Ready-to-adapt CEL policies for treasury, automation allowlists, and agent deny-by-default.

Copy these into Dashboard **Security → Policies** or `createPolicy`. Adjust addresses, tags, and thresholds. 0xkey is **deny-by-default** — missing allows mean reject.

## Treasury 2-of-N (high-value ETH transfer)

Require two approvers from the `ops-team` tag for native transfers above a wei threshold:

```json theme={"theme":{"light":"github-light","dark":"github-dark"}}
{
  "policyName": "treasury-eth-2ofn",
  "effect": "EFFECT_ALLOW",
  "condition": "activity.type == 'ACTIVITY_TYPE_ETH_SEND_TRANSACTION' && eth.tx.value >= decimal('1000000000000000000')",
  "consensus": "approvers.filter(user, user.tags.contains('ops-team')).count() >= 2"
}
```

## Automation allowlist (single recipient)

Backend sweeper may only send to a fixed address:

```json theme={"theme":{"light":"github-light","dark":"github-dark"}}
{
  "policyName": "sweeper-allowlist",
  "effect": "EFFECT_ALLOW",
  "condition": "activity.type == 'ACTIVITY_TYPE_SIGN_TRANSACTION_V2' && eth.tx.to == '0xYourHotWallet'",
  "consensus": ""
}
```

## Agent deny-by-default (explicit deny on broad sign)

Block an agent-tagged user from arbitrary `signRawPayload` while allowing a narrow contract call elsewhere:

```json theme={"theme":{"light":"github-light","dark":"github-dark"}}
{
  "policyName": "agent-deny-raw",
  "effect": "EFFECT_DENY",
  "condition": "activity.type == 'ACTIVITY_TYPE_SIGN_RAW_PAYLOAD_V2' && credentials.any(c, c.user.tags.contains('agent'))",
  "consensus": ""
}
```

<Note>
  Exact `credentials` / tag field names depend on enclave CEL context availability. Validate with Policy Simulate before production. If a field is unavailable, fall back to `activity.actor` / user-id equality conditions documented in [Policy language](/concepts/policies/language).
</Note>

## Deployer allowlist (contract creation / specific selector)

```json theme={"theme":{"light":"github-light","dark":"github-dark"}}
{
  "policyName": "deployer-selector",
  "effect": "EFFECT_ALLOW",
  "condition": "activity.type == 'ACTIVITY_TYPE_SIGN_TRANSACTION_V2' && eth.tx.data[0:4] == '0x6057361d'",
  "consensus": "approvers.count() >= 1"
}
```

## Gas Station intent (Enterprise)

When using `sponsor: true`, add policies for EIP-712 intent signing and paymaster execution as described in the Gas Station package (`@0xkey-io/gas-station` `policyUtils`). Keep paymaster execution policies separate from user intent policies.

## Solana / Tron

Mirror the same patterns with `solana.tx.*` and `tron.tx.*` contexts — see [Policy language](/concepts/policies/language) and network pages.