CertifiedActionDONValidatorPolicy
The CertifiedActionDONValidatorPolicy (CADV) is the onchain contract that validates permits generated by offchain policy execution. When a Chainlink DON workflow approves an action, it delivers a permit through the Keystone Forwarder. The CADV stores the permit and verifies it when the protected function is called.
For a full explanation of how offchain policies work, what you can connect to, and how the permit flow operates, see Off-Chain Policy Execution.
Permit lifecycle
Managed offchain permits are pre-presented: the DON writes the permit to the CADV before the user submits the protected transaction. The user does not include permit bytes in the transaction.
The CADV indexes a permit by its transaction intent, which includes:
- Caller address
- Protected target address
- Function selector
- Ordered parameters produced by the target function's extractor
At execution time, the policy engine passes the actual caller, target, selector, and extracted parameters to the CADV. The call is allowed only when they match a stored, valid permit. After the protected call succeeds, the policy engine invokes postRun, which increments the permit's usage count and emits PermitUsed.
The managed wallet_risk_scoring policy currently creates permits with:
maxUses = 1— the permit can authorize one successful transaction.expiry = 0— the permit does not expire.
These values are fixed in the current Beta release.
The CADV also emits PermitStored when the workflow publishes a permit. ACE waits for this event before changing the corresponding evaluation status to ready.
Combining with other policies
The CADV is attached to a target function like any other policy. It can run before or after onchain policies such as identity, allowlist, or volume checks. All policies in the function's policy chain must allow the call.
See Policy Ordering & Composition for guidance on evaluation order.
Related pages
- Off-Chain Policy Execution — conceptual overview of managed and custom offchain policies
- Evaluation API — the runtime API for requesting managed offchain permits
- Policy Ordering & Composition — guidance on evaluation order