Policy Authoring Workflow

Requirements Gathering

Before writing code, define the strict security bounds of the policy.

• Who is the actor? (e.g., an automated bot, a junior admin)
• Where can they interact? (e.g., Uniswap Router, specific ERC20 tokens)
• What functions can they call? (e.g., exactInputSingle, transfer)
• How much can they spend? (e.g., max 1 ETH per day)

Environment Setup

Ensure you have the Matador CLI installed and your project directory structured. It is recommended to keep your ABIs in a dedicated folder.

# Install the CLI
npm install -D matador-policy-cli

# Create structure
mkdir policies abis

Writing the Policy

Create a new .matador file. Start by importing necessary ABIs and defining the parameters.

import "abis/UniswapRouter.json" as Uniswap;

permission SwapGuard -> 1.0.0 {
    parameters: {
        router: address
    }
    when: {
        all {
            context.target == parameters.router,
            context.selector == Uniswap.exactInputSingle.selector
        }
    }
}

Compilation & Validation

Use the CLI to compile your policy. The compiler performs static analysis to catch type mismatches and syntax errors before deployment.

npx matador-policy-cli compile policies/swap-guard.matador -d ./out

Testing (Foundry)

Before deploying to a live account, test your policy bytecode using Foundry. Create mock execution contexts to simulate both valid and invalid transactions.

function testPolicy() public {
    // Load compiled bytecode
    bytes memory bytecode = vm.readFile("./out/swap-guard.json");
    
    // 1. Test Valid Transaction (Should Pass)
    interpreter.enforce(bytecode, subject, validExec);
    
    // 2. Test Invalid Transaction (Should Revert)
    vm.expectRevert();
    interpreter.enforce(bytecode, subject, invalidExec);
}

Provisioning

Once tested, provision the policy to your smart account on-chain. This usually involves calling a grantPermission function on your account contract.

// On-chain transaction
smartAccount.grantPermission(permissionId, compiledBytecode);