# Protecting Target Functions
Source: https://docs.chain.link/ace/guides/policy-manager/manage-protections
Last Updated: 2026-05-26

> For the complete documentation index, see [llms.txt](/llms.txt).

A **target protection** is the link between a [policy instance](/ace/guides/policy-manager/manage-policies) and a specific function on a [target contract](/ace/guides/policy-manager/manage-targets). When a user calls the protected function, the policy engine evaluates the bound policies in order and decides whether to allow or reject the transaction. Target protections are the final step in setting up on-chain compliance enforcement.

## Prerequisites

Before creating a target protection, you need:

1. A [policy engine](/ace/guides/policy-manager/manage-engines) deployed on your target chains.
2. A [target contract](/ace/guides/policy-manager/manage-targets) registered under that engine.
3. A [policy instance](/ace/guides/policy-manager/manage-policies) created from a policy implementation and associated with the same engine.
4. Extractors attached to the engine that support the function signatures you want to protect (see the [Policy Manager Quick Start](/ace/getting-started/policy-manager#extractor-ids-for-api-creation) for the full list).

## Create a target protection

A protection binds a policy instance to a specific function on your target contract. Once created, every call to that function is evaluated against the policy.

## Position and evaluation order

The `desired_position` determines the order in which policies are evaluated when a protected function is called:

- **Position 0** is evaluated first.
- Policies are evaluated sequentially. If a policy returns **Reject**, the transaction is reverted immediately and remaining policies are not evaluated.
- If all policies return **Allow**, or if no policy explicitly rejects, the `desired_default_allow` setting on the [target](/ace/guides/policy-manager/manage-targets#default-allow-behavior) determines the outcome.

For detailed information on composing effective rulesets, see [Policy Ordering & Composition](/ace/concepts/policy-ordering).

## View protections

## Manage an existing protection

From the **Functions** or **Policies** view on your target contract (see [View protections](#view-protections) above), click on a policy instance to open a detail drawer. From there you can:

- **Detach policy** — removes the protection so the policy no longer evaluates this function (see [Archive a protection](#archive-a-protection) below).
- **Edit instance** — opens the policy instance configuration (see [Update policy configuration](/ace/guides/policy-manager/manage-policies#update-policy-configuration)).

### Extend a protection to additional chains

If you created a protection on one chain and later want it to apply on additional chains, you can extend it via the API.

### Archive a protection

Archiving a protection unbinds the policy from the function. Once archived, the policy no longer evaluates transactions on that function.

> **NOTE**
>
> Protections must be archived before their parent [policy](/ace/guides/policy-manager/manage-policies#archive-a-policy)
> or [target](/ace/guides/policy-manager/manage-targets#archive-a-target) can be archived. Always archive protections
> first in the dependency chain.

## Archival dependency chain

ACE enforces an ordered archival flow. You must archive resources from the outside in:

1. **Target protections** — archive these first
2. **Policy instances** — archive after all protections referencing them are archived
3. **Targets** — archive after all protections on the target are archived
4. **Policy engines** — archive after all policies in the engine are archived

## Related pages

- [Policy Ordering & Composition](/ace/concepts/policy-ordering) — how evaluation order affects transaction outcomes
- [Managing Policy Engines](/ace/guides/policy-manager/manage-engines) — create the engine that manages policies
- [Managing Targets](/ace/guides/policy-manager/manage-targets) — register contracts to protect
- [Managing Policies](/ace/guides/policy-manager/manage-policies) — create and configure policy instances
- [Coordinator API Reference](/api/ace/coordinator/docs) — full API schema