Skip to main content
Controls apply in the workspace, on top of every API key’s scopes. They are set by admins in the console under Account Settings → Security & Approvals and on the Policies page, and every change is written to the audit trail.

​
Approval requirements

A withdrawal that matches no policy still falls under these settings when approval is required: the platform defaults to holding it, not to letting it through.

​
Policies

A policy routes matching withdrawals to an approval group. Create one on the Policies page with a name, a description, the approval group, and its rules: Policies can also be managed through the API by an admin key:

​
Approval groups

An approval group is a set of workspace members and a threshold: the number of approvals a request needs. Create groups on the Policies page (New group: name, required approvals) and add members to them. Groups are referenced by policies and by the workspace approval requirement.

​
Approving and rejecting

Held requests appear on the Approvals page, in three tabs: Pending Withdrawals, DApp Transactions (typed signing requests) and Approval Group Request. Each row shows the asset, wallet, amount, requester and recipient; a member of the group approves or rejects it. Once the threshold is met the withdrawal continues to signing; a rejection fails it with the reason recorded. The approver’s identity is taken from their console session, never from the request. Under dual control, the requester’s own approval is refused.

​
Destinations

The address book is managed in the console under Address Book.

​
Limits

Limits reject; policies hold for approval. Use both: a limit for the amount that should never move without a settings change, a policy for the amount that needs a second person.

​
Emergency: the kill switch

An admin can Freeze all withdrawals in the workspace from Security & Approvals → Emergency, with a reason (for example, suspected key compromise). While frozen:
  • every withdrawal request is rejected with HTTP 423;
  • the freeze and its reason are visible to all members;
  • the check fails closed: if the platform cannot read the freeze state, it blocks the withdrawal.
Unfreeze restores normal operation. Both actions are recorded in the audit trail with the acting admin. On balance drift sets what happens when reconciliation finds a wallet’s on-chain balance disagreeing with the platform’s record: Freeze withdrawals or Alert only.