# Policy engine \[On-chain guardrails for Advanced Strategies — contract whitelists, function permissions, and calldata checks]

:::info
In Railnet smart contracts, an Advanced Strategy is implemented as a **Specialized Vehicle**. Its policy engine is a Zodiac Roles Modifier v2 contract enabled as a module on the Strategy Safe.
:::

An operator never calls the Strategy directly. Every transaction goes to the policy engine, which checks the role and every parameter before forwarding the call through the Strategy to the target protocol.

<PolicyEngineFlow />

From the protocol's side, `msg.sender == STRATEGY_ADDRESS`; the operator's signer is never visible. Allocation Strategies use role-based [guardrails](/strategies/allocation/guardrails) instead.

## Four layers of permission

**Contract whitelist.** Only explicitly listed target addresses are callable: the Aave V3 Pool, the USDC token for approvals, Morpho Blue. Anything else reverts.

**Function selectors.** Each allowed function is listed by 4-byte selector. Exits (`withdraw`, `repay`, `claimWithdrawals`) are enabled by default; entries (`supply`, `borrow`, `swap`) are enabled with spending limits; `liquidate`, `absorb` and admin functions are off until explicitly opted in.

**Calldata checks.** Condition trees constrain parameter values:

| Operator | Checks | Typical use |
|---|---|---|
| `EqualTo` | exact value | restrict to approved tokens or pool IDs |
| `EqualToAvatar` | equals the Strategy address | lock recipients so funds cannot leave |
| `GreaterThan` | above a threshold | require `amountOutMinimum > 0` |
| `LessThan` | below a threshold | cap individual transaction size |
| `WithinAllowance` | fits a spending budget | rate-limit with periodic refills |

Three checks nobody can remove, guardian included: recipient-like parameters (`to`, `recipient`, `receiver`, `onBehalfOf`, `owner`) are `EqualToAvatar`, `approve` spenders must be known protocol contracts, `delegatecall` is always false.

**Spending limits.** An allowance has a refill amount, a period (daily, weekly, monthly) and a maximum accrual that caps rollover. The amount parameter is deducted per transaction and the call reverts when the balance is short. Only inbound operations are limited; `withdraw`, `repay` and `claim` return funds to the Strategy. Keys can be per protocol (`aave_v3_daily`), per bridge route (`eth_arb_usdc_daily`) or shared as a global outbound cap.

## Cross-chain

The Strategy Safe has the same CREATE2 address on every chain, and each chain runs its own Roles Modifier controlling outbound operations only: bridge calls, transfers and cross-chain messages leaving that chain. Inbound funds are permissionless.

For bridging, the engine whitelists bridge contracts, restricts destination chain IDs, applies per-route allowances and locks `recipient` to `EqualToAvatar`. Since the address is identical everywhere, bridged funds land in your own Safe even if an operator key is compromised.

## Pre-built permission sets

Any EVM contract can be scoped manually, but these ship with ready-made permission sets. This is what an asset manager *executes on*, not the [yield sources](/yield-sources) Railnet wraps with an adapter.

| Category | Protocol | Chains |
|---|---|---|
| Lending | Aave V3 | ETH, ARB, OPT, BASE |
| Lending | Compound V3 | ETH, ARB, BASE |
| Lending | Morpho Blue | ETH, ARB, BASE |
| Lending | Spark | ETH |
| DEX | Uniswap V3 | ETH, ARB, OPT, BASE |
| DEX | CoW Swap | ETH, ARB, BASE |
| DEX | Balancer V2 | ETH, ARB, OPT, BASE |
| Staking | Lido | ETH |
| Yield | Pendle | ETH, ARB |
| Savings | Sky DSR | ETH |

Looping, leverage and bridging are not protocol features: whitelist the functions each pattern needs and bound the ratios with calldata checks.

## Next steps

<Cards>
  <Card title="Operate an Advanced Strategy" description="Route protocol calls through it." icon="terminal" to="/strategies/advanced/operate" />

  <Card title="Vault 7540 mechanics" description="Deposits, redemptions, settlement, fees." icon="vault" to="/strategies/advanced/vault" />

  <Card title="Risk management" description="Caps, emergency controls, audit trail." icon="shield-check" to="/strategies/risk-management" />
</Cards>