Policy schema

The sign-rules format a warrant binds.

A policy is JSON. The web3 gate reads sign_rules:

{
  "sign_rules": {
    "window": "24h",
    "deny": [
      { "name": "no withdrawals", "match": { "tx.function": "withdraw" } },
      { "name": "daily cap", "match": { "window.spent_after_usd": { "gt": 100000 } } }
    ],
    "approve": [
      { "name": "mid", "match": { "notional_usd": { "gt": 5000, "lte": 50000 } } }
    ],
    "allow": [
      { "name": "small", "match": { "tx.chain": "sui:testnet", "notional_usd": { "lte": 5000 } } }
    ]
  }
}

Precedence

deny → approve → allow, then default-deny. A matching deny always refuses; a matching approve holds for owner sign-off; a matching allow proceeds; no match fails closed.

Facts a rule can match

Fact	Source
`tx.chain`	the `--chain`
`tx.package` / `tx.to` / `tx.function`	decoded from the tx bytes (Sui), else declared
`notional_usd`	priced from outflows (Sui) or the declared `--value`, in USD cents
`window.spent_usd` / `window.spent_after_usd`	rolling spend from the audit log
`asset.<SYM>.amount`	raw decoded outflow amounts (the oracle-free floor)
`unpriceable`	set when value can't be priced — guard on it for non-Sui or undeclared value

Match operators

String equality, { "lte": n }, { "gt": n }, { "in": [ … ] }. Catch the OR-of-allows footguns (unbounded allow, USD-only with no raw floor) with warden policy lint.