Policy Engine

aura-policy is a pure-Rust crate with no Anchor dependency. It is consumed by aura-core on-chain, by sdk-rs for off-chain pre-validation, and by the devnet smoke binaries. All rule logic, violation codes, and FHE graph specs live here — never duplicated in aura-core or the SDKs.

Entry Points

Evaluation Order (evaluate_transaction)

Rules short-circuit on the first failure. No subsequent rules are evaluated after a violation.

This is the full aura-policy in-crate order. aura-core instructions may also apply sidecar checks around it, such as queue capacity, operator/session authority, dWallet reservations, liveness, exposure groups, timelocks, and settlement state.

Public Precheck vs Full Evaluation

For confidential proposals, evaluate_public_precheck runs the public subset before the Encrypt CPI. Current source evaluates scoped pauses, budget envelopes, Bitcoin manual-review threshold, time window, protocol allowlist, slippage, quote freshness, counterparty risk, shared pool, velocity, and approval ladder. It skips the direct per-transaction, daily, weekly, monthly, and recipient cap checks. The trace explicitly records "encrypted per-transaction and daily-limit checks deferred to Encrypt" before the FHE branch handles the encrypted spend guardrails.

All 27 ViolationCodes

From programs/aura-policy/src/violations/mod.rs:

PolicyConfig Defaults

From programs/aura-policy/src/config/limits.rs — PolicyConfig::default():

Reputation Scaling

effective_daily_limit_usd is computed as:

effective = daily_limit_usd × multiplier_bps(reputation_score) / 10_000

Default ReputationPolicy:

If no reputation score is provided (None), the base daily_limit_usd is used unchanged.

Time Windows

active_hourly_limit returns daytime_hourly_limit_usd for hours 6–21 UTC and nighttime_hourly_limit_usd for hours 22–5 UTC. The hourly counter (hourly_spent_usd) resets when the current hour changes.

Transaction Types

From programs/aura-policy/src/types/transaction.rs:

Regulatory Flags

compute_regulatory_flags returns a u8 bitmask attached to every PolicyDecision:

Anomaly Detection

When anomaly_config.enabled = true and state.recent_amounts.len() >= min_sample_size, the engine computes a z-score over the recent amounts window:

z_score_bps = (amount - mean) / std_dev × 10_000

If z_score_bps > z_score_threshold_bps, the action is applied:

Policy Templates & Canary Testing

AURA now supports reusable policy templates and safe testing of policy changes through canary deployments.

Policy Templates

Pre-defined or custom policy configurations that can be applied to multiple treasuries:

import { instructions } from "@aura-protocol/sdk-ts";

// Create from scratch or fork a built-in preset
await instructions.policy.sendCreatePolicyTemplate(
  client,
  owner,
  createTemplateInput,
);

// Apply to treasury
await instructions.policy.sendApplyPolicyTemplate(client, owner, applyTemplateInput);

// Apply with parameterized scaling
await instructions.policy.sendApplyPolicyTemplateParameterized(
  client,
  owner,
  applyTemplateParameterizedInput,
);

Built-in presets:

• ConservativeDao
• AiAgentOps
• HighTrustExecutor
• StrictCompliance
• IntegrationTestFastPath
• TradingDesk
• PayrollSweep
• GrantDisbursement
• MevSearcher
• TreasuryColdStorage

Canary Deployments

Test a candidate policy against live proposals without enforcing it:

import { instructions } from "@aura-protocol/sdk-ts";

// 1. Start canary with candidate policy
await instructions.policy.sendStartCanary(client, owner, startCanaryInput);

// 2. Proposals evaluated against both enforced and candidate policies
// Canary tracks: pass/fail counts, deviation patterns, violation distribution

// 3. Promote if canary performs well
await instructions.policy.sendPromoteCanary(client, owner, promoteCanaryInput);

// Or discard if results are poor
await instructions.policy.sendDiscardCanary(client, owner, discardCanaryInput);

Canary scoring:

• Runs in parallel with enforced policy (never blocks proposals)
• Tracks samples, agreements, candidate allow/deny counts, and a per-rule divergence bitmap
• sample_cap bounds the shadow-evaluation cost and must be reached before promotion when non-zero
• Automatically records as new policy version on promotion

Policy Versioning & Rollback

All policy changes create immutable version records:

import { accounts, instructions } from "@aura-protocol/sdk-ts";

// Check version history
const history = await accounts.fetchPolicyHistoryAccount(client, policyHistoryPda);
console.log("Version count:", history.versionCount);
console.log("Snapshots:", history.snapshots);

// Roll back by supplying the full candidate config for the target snapshot.
await instructions.policy.sendRollbackPolicy(client, owner, rollbackPolicyInput);

Version lifecycle:

• Template applies, canary promotion, explicit snapshots, and rollbacks record policy versions in the history ring
• Versions are sequentially numbered and immutable
• Rollback is owner-gated; loosening rollbacks are staged through the config-change timelock
• Version metadata includes timestamp, author, and policy hash/provenance