Portfolios

Every policy belongs to a program, and a program’s stream subscriptions are the scope its policies run inside. Nothing is evaluated outside a program: a stream no program with active policies subscribes to is watched by nothing, and check() answers it Deny with reasonCode: "NoActivePolicy".

Subscriptions

A program subscribes to streams on its Source tab (“Subscribe to a stream”) or in the wizard’s Streams step, and every event landing on those streams is judged by that program’s active policies. Two programs can subscribe to the same stream and reach different conclusions, because their policies differ. A treasury program and a payouts program can judge the same activity under different limits.

Wallet registration

The subject address of a recorded event, first seen, is registered to the account’s wallet register automatically, up to the account’s monitored-wallet limit; past the limit the event still lands. There is no separate provisioning step.

Go-forward only

A policy judges a stream from the moment its program subscribed to it, and a stream added later starts its own clock. Activity that predates the subscription is not judged, so switching on a control cannot flood the queue with months of past breaches.

const answer = await hira.check("transfer", { amount: "5000.00", fromAddress: "0x…", toAddress: "0x…" });
if (answer.reasonCode === "NoActivePolicy") {
  // no program with active policies subscribes to this stream: subscribe one,
  // then check again under a fresh idempotency key
}