Skip to Content
DocumentationPlatformPolicy EngineApproval Flows

Approval Flows

An Allow policy can require one or more approvals before a transfer is signed. An approval is a user accepting the transfer on their paired mobile device — a governance decision that is separate from, and precedes, MPC signing. This page explains how approvals are configured and what the approver experiences.

Requiring Approvals

Approvals are set as a number on an Allow policy (the Approvals field in the policy builder). For example, a policy that allows transfers under $100,000 from the Treasury wallet can require 2 approvals — two different users must accept before the transfer proceeds to signing.

Because policies are evaluated in priority order, you build tiered approval by ordering policies: a lower-amount policy requiring 1 approval above a higher-amount policy requiring 2, with a final Reject (or default-deny) for anything that matches no allowing policy.

Approving does not require a key share. An approval is just a user accepting the transfer from their paired mobile device — the device does not need to be an MPC signer. Approval (governance) and MPC signing (which uses key shares) are distinct steps. Approvals are also not tied to a named “approver group” or a dashboard role; there is no separate approver-group entity.

Who Can Approve

Approvals come from users who have access to the wallet and a paired, active mobile device — the approval request is delivered to those devices as a push notification. The policy enforces the required number of distinct approvals; which of the eligible users respond is up to your operating procedure.

Once the required approvals are collected, the transfer moves to signing (PENDING_SIGNATURE), where the key-share-holding signers produce the partial signatures — the platform reserves at least one mobile signer in every signing session for a wallet that has mobile signers (see Threshold Signing).

Mobile Approval Experience

While a transfer is PENDING_APPROVAL:

  1. Eligible users receive a push notification on their paired device.
  2. The notification shows the wallet, destination (truncated), amount, asset, and network.
  3. The user opens the app and reviews the full transaction details.
  4. The user taps Approve or Reject (authenticating on the device).

Each acceptance is recorded as an approval. When the required number is reached, the transfer advances to PENDING_SIGNATURE and the MPC signing session begins — a separate step from the approval itself.

Rejection and Expiry

If an approver rejects the transfer, it moves to REJECTED (sub-status “rejected by approver”) and the initiator is notified.

If the approval window expires before enough approvals are collected, the transfer moves to EXPIRED. See the Transaction Lifecycle for the full status set.

Address WhitelistTransaction Limits