owner-arm — acts live only under the owner's EIP-712 arm over the policy hash of these limits (a tenant vault) or the owner's live MFA session (the layer's vault); disarm s
signer-allowlist — the vault key signs only the manifest's contracts and functions (checked at the signer, not the planner), and only the typed-data domains and message statements
message-pin — a signed message pins its recipient: a typed-data act's payee is the manifest's pay_to and its amount is within the signed limit; an EIP-191 act signs only the
chain-pin — the RPC answers for the chain signed for, and every signature is chain-bound
value-cap — each act moves at most its rule's value (one slice)
day-cap — the vault's rolling 24 h outflow (value + worst-case gas) stays within the signed cap
fee-cap — no transaction pays more per gas than the signed cap; gas and fee are explicit
exact-approvals — an approval is for the exact amount about to be spent; an unbounded one is refused at the signer
simulate-first — every buy is quoted by simulating it at the latest block, and its minOut bounds the fill
receipt-check — a send counts only once mined with status success; a revert stops the run
code-pin — every contract acted on has its reviewed bytecode (pinned, or pinned on first sight) and no proxy implementation slot
price-breaker — no buy when the dip is deeper than the signed maximum or the slice's own price impact exceeds the slippage
outflow-breaker — the vault may only lose what its own guard signed; anything else halts the lambda
halt-on-failure — a breaker, a refusal or a revert on a live run halts it; only a new owner arm (higher nonce) clears the halt
single-runner — one run at a time per vault (a lock): one nonce writer
idempotent-payouts — every payout is on a ledger before it is mined; a re-run pays only the rest
recipient-filter — payout lists are rebuilt from chain balances: deduplicated, no contracts (EIP-7702 accounts allowed), no vault/token/dead, a per-wallet share cap
fixed-addresses — every address it pays or calls is in its signed record or read from the factory that created it, never from history or a name service
vault-owns — what it owns on chain is held by the vault (fee recipient, owner role), checked every run; dry otherwise
kms-sign-only — the key is a non-exportable KMS key; the runner's IAM user may only Sign a DIGEST with ECDSA_SHA_256 on its own keys