# Overview

Config restrictions protect operations that change the system configuration of the vault, such as registering tokens, adding blockchain networks, or attaching cold-wallet master keys. They are one of three restriction categories alongside [Transaction Restrictions](https://vault.docs.blockdaemon.com/docs/transaction-restrictions) and [Policy Restrictions](https://vault.docs.blockdaemon.com/docs/policy-restrictions).

Unlike transaction restrictions, config restrictions carry **no filters**. They are all-or-nothing: if a config restriction exists, it applies to every config operation. The restriction specifies only which approver groups must sign off.

# Evaluation Semantics

Config restrictions follow the same additive model as transaction restrictions:

1. Every config restriction is checked.
2. Since there are no filters, every config restriction **always matches**.
3. All approval requirements from all matching restrictions accumulate.
4. The operation proceeds when every accumulated requirement is satisfied.
5. If **no** config restriction exists, config operations are allowed without approvals.

# Governed Operations

The following operations require config restriction approval when at least one config restriction is configured:

| Operation                     | Description                  |
| ----------------------------- | ---------------------------- |
| Register token                | Register a token             |
| Unregister token              | Remove a registered token     |
| Delete token                  | Delete a token entry        |
| Register custom chain         | Register a custom EVM chain   |
| Unregister chain              | Remove a registered chain     |
| Register blockchain network    | Register a known blockchain network |
| Unregister blockchain network  | Remove a registered blockchain network |
| Set ERS public key           | Set the Emergency Recovery Service public key |
| Attach master key             | Attach a cold-wallet master key |

> **Note:** Account creation is **not** governed by config restrictions. That is an uncategorized operation that always executes without policy approval.

# Example

A single config restriction protects all asset and chain management operations:

| Restriction ID                | Action                       |
| ------------------------------ | ---------------------------- |
| `config-default`              | 2 of owner                  |

Result:

- Registering a token requires 2 owner approvals.
- Registering a custom chain requires 2 owner approvals.
- Attaching a cold-wallet master key requires 2 owner approvals.
- Creating a new vault account requires no approval (uncategorized, not governed by config restrictions).

# 🗣️We Are Here to Help!

Please contact us via [email](mailto:support@blockdaemon.com) or support chat if you encounter an issue, bug, or need assistance. Don't forget to include any relevant details about the problem. To request a wallet form and Institutional Vault Approver form, please click [here](/content/support/index.html) or contact [our sales team](/content/get-in-touch/?contact-sales/index.html).

Updated 2 months ago