# Setting Policies

A Policy is [defined](https://docs.sodot.dev/vertex-api-reference/#tag/admin/POST/admin/policies/create-policy) **as** a set of Rules that are evaluated against the message or transaction that is being signed.
**All** Rules of a Policy must be satisfied for the Policy to be satisfied.
A Policy may be an empty set of Rules, in which case all transactions will always pass validation.
Policies may be [attached as a default](https://docs.sodot.dev/vertex-api-reference/#tag/admin/POST/admin/policies/set-user-default-policy) Policy to a User, in which case all Key Shares generated by that User will be subject to the Policy.
Alternatively, a Policy may be [attached](https://docs.sodot.dev/vertex-api-reference/#tag/admin/POST/admin/policies/attach-policy-to-key) to a specific Key Share directly by a `SystemAdmin`.

## Prerequisites

Before setting up a Policy, we need to have a User and a Rule Server set up.
Please refer to the [Create User](/vertex/users_and_access_control) and [Rule Server](/vertex/policies/rule_server) guides.
We should now have the following information:

* A `SystemAdmin` API Key
* User Id
* Rule Server URL
* Rule Server public key
  * Public key JWT algorithm - `ES256` or `RS256`

## Creating a New Policy

### Create a Rule

Using [`add-external-rule`](https://docs.sodot.dev/vertex-api-reference/#tag/admin/POST/admin/policies/add-external-rule) endpoint, we can add a new Rule to the Vertex:

```bash
curl -L -X POST 'https://<YOUR_VERTEX>/admin/policies/add-external-rule' \
-H 'Content-Type: application/json' \
-H 'Accept: application/json' \
-H 'Authorization: <SYSTEMADMIN_API_KEY>' \
--data-raw '{
  "jwt_alg": "ES256-or-RS256",
  "name": "human-readable-name-for-rule",
  "pubkey": "PEM-encoded-public-key",
  "url": "URL-endpoint-for-rule-server"
}'
```

A `rule_id` will be returned in the response, which we will use to create a Policy.

#### List Rules

It's possible to list all Rules using the [`list-all-rules`](https://docs.sodot.dev/vertex-api-reference/#tag/admin/GET/admin/policies/list-all-rules) endpoint.

### Create Policy

Using the [`create-policy`](https://docs.sodot.dev/vertex-api-reference/#tag/admin/POST/admin/policies/create-policy) endpoint, we can create a new Policy:

```bash
curl -L -X POST 'https://<YOUR_VERTEX>/admin/policies/create-policy' \
-H 'Content-Type: application/json' \
-H 'Accept: application/json' \
-H 'Authorization: <SYSTEMADMIN_API_KEY>' \
--data-raw '{
  "name": "human-readable-name-for-policy",
  "rules": [
    "rule_id"
  ]
}'
```

A `policy_id` will be returned in the response, which we will use to attach the Policy to a Key Share.

#### List Policies

It's possible to list all Policies using the [`list-all-policies`](https://docs.sodot.dev/vertex-api-reference/#tag/admin/GET/admin/policies/list-all-policies) endpoint.

## Attaching a Policy to a Key Share

There are 2 ways to attach a Policy to a Key Share:

### Attach Policy as Default to User

Attaching a Policy as default to a User will make all Key Shares generated by that User subject to the Policy.
Using the [`set-user-default-policy`](https://docs.sodot.dev/vertex-api-reference/#tag/admin/POST/admin/policies/set-user-default-policy) endpoint, we can attach a Policy to a User:

```bash
curl -L -X POST 'https://<YOUR_VERTEX>/admin/policies/set-user-default-policy' \
-H 'Content-Type: application/json' \
-H 'Authorization: <SYSTEMADMIN_API_KEY>' \
--data-raw '{
  "policy_id": "string",
  "user_id": "string"
}'
```

### Attach Policy to Key Share

Attaching a Policy to a specific Key Share directly will make only that Key Share subject to the Policy.
A `key_id` is required to attach a Policy to a Key Share, see [Generating Keys](/vertex/keygen/generating_keys) for more information.

Using the [`attach-policy-to-key`](https://docs.sodot.dev/vertex-api-reference/#tag/admin/POST/admin/policies/attach-policy-to-key) endpoint, we can attach a Policy to a Key Share:

```bash
curl -L -X POST 'https://<YOUR_VERTEX>/admin/policies/attach-policy-to-key' \
-H 'Content-Type: application/json' \
-H 'Authorization: <SYSTEMADMIN_API_KEY>' \
--data-raw '{
  "key_id": "string",
  "policy_id": "string"
}'
```