Author policies with JSON

Learn how to publish a policy outside the Developer Portal forms. Use the CLI for supported wallet types, nested conditions, personal limits, or approval requirements that you want to author directly as JSON. Contact Para for help checking an advanced policy before relying on it.

Authenticate and select the beta key

Install the CLI, then authenticate with your developer account. These commands require access to the selected organization and project, not just possession of its public API key.

para login
para orgs switch
para projects switch
para keys list --environment beta
para keys permissions state KEY_ID --environment beta --json
para keys permissions catalog KEY_ID --environment beta --json

Use the key’s ID for KEY_ID. The catalog describes the available authoring language; state returns the current policy records. Use para keys permissions state to manage these policies; the parent command returns a legacy status view.

Start with a Solana transfer Request

Save this document as solana-transfers.json. It asks a user for standing access to native SOL transfers up to 0.01 SOL. 10000000 is an integer amount in lamports, not a dollar amount. The asset condition prevents another asset from being mistaken for native SOL.

solana-transfers.json

{
  "id": "solana-small-transfers",
  "schemaVersion": "permissions.policy.v1",
  "version": "1",
  "selector": {
    "walletType": "SOLANA",
    "requestRoute": "solana.sign_transaction",
    "requestType": "solana_transaction"
  },
  "rules": [
    {
      "id": "small-native-transfer",
      "effect": "allow",
      "when": {
        "kind": "all",
        "of": [
          { "kind": "compare", "fact": "request.classification", "op": "eq", "value": "native_transfer" },
          { "kind": "compare", "fact": "request.value.asset", "op": "eq", "value": "solana:native" },
          { "kind": "compare", "fact": "request.value.baseUnits", "op": "lte", "value": "10000000" }
        ]
      }
    }
  ],
  "metadata": {
    "productMode": "delegation",
    "description": "Send up to 0.01 SOL per native transfer"
  }
}

This selector applies to matching Solana signing requests under the selected API key. Add walletId to limit it to one wallet. For an app-owned wallet, design a Guardrail with the appropriate deny/approval rules instead of assuming this user-consent Request has the same meaning.

Validate, save, and activate

para keys permissions validate KEY_ID --file solana-transfers.json --environment beta --json
para keys permissions create KEY_ID --file solana-transfers.json --environment beta --json

Inspect the validation result and returned draft. Copy the new policy.recordId from the create response, then activate that record:

para keys permissions activate RECORD_ID KEY_ID --environment beta --yes --json
para keys permissions state KEY_ID --environment beta --json

Validation checks the policy against the trusted project/key context. Creating a draft does not enable its behavior. Activation enables policy enforcement and supersedes an active version with the same logical policy ID.

The CLI accepts advanced JSON, but does not bypass policy validation, organization permissions, or the beta-only mutation boundary. A successful validation is not proof that the policy expresses your intent; test both matching and non-matching requests.

Exercise the user flow

Use the normal Solana signer integration with a user-owned wallet. Grant the Request through Portal, then test an amount below the limit and one above it. The first can use standing access; the second does not receive permission from this rule and follows the remaining policies and review flow.

Integrate consent and adjustable limits

Request consent before a transaction, inspect the result, and expose personal settings.

Update or retire the policy

To replace a policy, keep its logical id, use its next version, and provide the new JSON. Replacing an active record takes effect immediately; replacing a draft keeps the replacement in draft.

para keys permissions replace RECORD_ID KEY_ID --file solana-transfers-updated.json --environment beta --yes --json
para keys permissions deactivate ACTIVE_RECORD_ID KEY_ID --environment beta --yes --json
para keys permissions archive INACTIVE_RECORD_ID KEY_ID --environment beta --yes --json

Read the state again after each change. If a command cannot confirm whether a mutation completed, inspect the current records before retrying. Do not blindly create another version.

Build more complex policies

Add nested logic, other wallet types, spending windows, adjustable values, and approval requirements.

Manage versions and production review

Understand activation windows and the separate, Para-reviewed production publication process.

Overview

CLI

AI Tooling

Author policies with JSON

Authenticate and select the beta key

Start with a Solana transfer Request

Validate, save, and activate

Exercise the user flow

Integrate consent and adjustable limits

Update or retire the policy

Build more complex policies

Manage versions and production review

Authenticate and select the beta key

Start with a Solana transfer Request

Validate, save, and activate

Exercise the user flow

Integrate consent and adjustable limits

​Update or retire the policy

Build more complex policies

Manage versions and production review

Update or retire the policy