Universal Action Policy

The universal action policy allows for controlled access to specific contract functions with optional parameter-based rules. Below is an example that restricts a function call to a specific parameter value.

⚠️ Security Consideration: Always set appropriate time bounds and carefully consider which contract functions to expose.

import { usersNexusClient } from "./client.ts";
import { parseUnits, toFunctionSelector } from "viem";
 
const createSessionsResponse = await usersNexusClient.grantPermission({
  sessionRequestedInfo: [
    {
      sessionPublicKey,
      actionPoliciesInfo: [
        {
          functionSelector: toFunctionSelector("transfer(address,uint256)"),
          contractAddress: USDC_ADDRESS,
          rules: [
            {
              condition: ParamCondition.EQUAL,
              offsetIndex: 0, // recipient parameter
              isLimited: false,
              ref: WHITELISTED_ADDRESS
            },
            {
              condition: ParamCondition.LESS_THAN,
              offsetIndex: 1, // amount parameter
              isLimited: true,
              ref: parseUnits("1000", 6), // 1000 USDC per tx
              usage: {
                limit: parseUnits("5000", 6), // 5000 USDC total
                used: 0n
              }
            }
          ],
        }
      ]
    }
  ]
});

Common Use Cases

• Token Allowances: Set maximum spending limits for ERC20 tokens
• Whitelisted Transfers: Restrict transfers to approved addresses only
• Budget Management: Implement departmental spending controls
• DeFi Risk Management: Limit exposure in DeFi protocols
• Automated Payments: Control recurring token payments
• Treasury Operations: Manage organizational token distributions

Best Practices

1. Whitelist Recipients: Always specify allowed recipient addresses
2. Dual Limits: Implement both per-transaction and cumulative limits
3. Token Decimals: Carefully account for token decimal places when setting limits
4. Usage Tracking: Monitor cumulative usage against total limits
5. Multiple Tokens: Set appropriate limits for each token type
6. Regular Reviews: Periodically audit spending patterns and adjust limits
7. Combine Policies: Use with time-based restrictions for enhanced security