Protecting Target Functions

A target protection is the link between a policy instance and a specific function on a target contract. When a user calls the protected function, the policy engine evaluates the bound policies in order and decides whether to allow or reject the transaction. Target protections are the final step in setting up on-chain compliance enforcement.

Prerequisites

Before creating a target protection, you need:

  1. A policy engine deployed on your target chains.
  2. A target contract registered under that engine.
  3. A policy instance created from a policy implementation and associated with the same engine.
  4. Extractors attached to the engine that support the function signatures you want to protect (see the Policy Manager Quick Start for the full list).

Create a target protection

A protection binds a policy instance to a specific function on your target contract. Once created, every call to that function is evaluated against the policy.

  1. In the Chainlink Platform, go to Compliance > Policy Manager in the left sidebar.

  2. Click on the policy engine that manages your target contract.

  3. In the Contracts tab, click on the target contract you want to protect.

  4. Click the Attach Policy button.

  5. Step 1 — Select policy: Choose the policy type and the specific policy instance you want to use.

  6. Step 2 — Define protected functions: Use the Contract functions dropdown to select a function to protect. For each function, choose the Execution order:

    • Last (default) — the policy is added at the end of the evaluation chain.
    • First — the policy is evaluated before all other policies on this function.

    To protect multiple functions with the same policy, click Add more and repeat for each function.

  7. Step 3 — Review and deploy: Confirm your selections and deploy the protection.

Create a target protection with a POST request:

curl -X POST https://ace.api.chain.link/v1/targets/<TARGET_ID>/protections \
  -H "Content-Type: application/json" \
  -H "Authorization: Apikey <API_KEY>" \
  -d '{
    "function_signature": "transfer(address,uint256)",
    "policy_instance_id": "<POLICY_ID>",
    "desired_position": 0,
    "extractor_output_ids": [
      "<EXTRACTOR_OUTPUT_ID_FOR_ACCOUNT>",
      "<EXTRACTOR_OUTPUT_ID_FOR_AMOUNT>"
    ],
    "onchain_target_protections": [
      { "chain_selector": "16015286601757825753" }
    ]
  }'
FieldRequiredDescription
function_signatureYesThe function to protect (e.g., transfer(address,uint256))
policy_instance_idYesUUID of the policy instance to bind
desired_positionNoEvaluation order (0 is first). Determines where in the policy chain this policy runs
extractor_output_idsNoArray of extractor output UUIDs mapping extracted calldata to the policy's parameters
onchain_target_protectionsNoArray of objects with chain_selector to specify deployment chains

Each on-chain protection starts in creation_pending status until the AddPolicy call completes. The combination of policy instance, target, and function selector must be unique.

Position and evaluation order

The desired_position determines the order in which policies are evaluated when a protected function is called:

  • Position 0 is evaluated first.
  • Policies are evaluated sequentially. If a policy returns Reject, the transaction is reverted immediately and remaining policies are not evaluated.
  • If all policies return Allow, or if no policy explicitly rejects, the desired_default_allow setting on the target determines the outcome.

For detailed information on composing effective rulesets, see Policy Ordering & Composition.

View protections

  1. In the Chainlink Platform, go to Compliance > Policy Manager in the left sidebar.

  2. Click on the policy engine, then click on the target contract.

  3. Choose one of two views:

    • Functions — groups protections by function. You see two sections: Unprotected functions (no policies attached) and Protected functions (with the policies protecting each function and their deployment status).
    • Policies — groups protections by policy instance. Each policy card shows which functions it protects.

    You can also filter by Policy or Status using the dropdowns at the top.

List all protections for a target:

curl https://ace.api.chain.link/v1/targets/<TARGET_ID>/protections \
  -H "Authorization: Apikey <API_KEY>"
ParameterDescription
pagePage number (default: 1)
page_sizeResults per page (max: 100)
include_onchainsInclude per-chain deployment details (default: true)
function_signatureFilter by function signature
policy_instance_idFilter by policy instance
statusFilter by on-chain status (creation_pending, created, removal_pending, etc.)

To retrieve a specific protection:

curl https://ace.api.chain.link/v1/targets/<TARGET_ID>/protections/<PROTECTION_ID> \
  -H "Authorization: Apikey <API_KEY>"

Manage an existing protection

From the Functions or Policies view on your target contract (see View protections above), click on a policy instance to open a detail drawer. From there you can:

Extend a protection to additional chains

If you created a protection on one chain and later want it to apply on additional chains, you can extend it via the API.

Extend a protection to additional chains with a PUT request:

curl -X PUT https://ace.api.chain.link/v1/targets/<TARGET_ID>/protections/<PROTECTION_ID> \
  -H "Content-Type: application/json" \
  -H "Authorization: Apikey <API_KEY>" \
  -d '{
    "onchain_target_protections": [
      { "chain_selector": "16015286601757825753" },
      { "chain_selector": "3478487238524512106" }
    ]
  }'

Archive a protection

Archiving a protection unbinds the policy from the function. Once archived, the policy no longer evaluates transactions on that function.

  1. From the Functions or Policies view on your target contract, click on the policy instance you want to detach.
  2. In the detail drawer, click Detach policy.

Archive a protection with a PATCH request:

curl -X PATCH https://ace.api.chain.link/v1/targets/<TARGET_ID>/protections/<PROTECTION_ID> \
  -H "Content-Type: application/json" \
  -H "Authorization: Apikey <API_KEY>" \
  -d '{
    "status": "archived"
  }'

Archival dependency chain

ACE enforces an ordered archival flow. You must archive resources from the outside in:

  1. Target protections — archive these first
  2. Policy instances — archive after all protections referencing them are archived
  3. Targets — archive after all protections on the target are archived
  4. Policy engines — archive after all policies in the engine are archived

Get the latest Chainlink content straight to your inbox.