> ## Documentation Index
> Fetch the complete documentation index at: https://acachete.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Deploying a Policy

> Configure the allow-list and spend cap for your own wallet, or reset the demo environment to a pristine state.

<Note>
  Configuring your own wallet by hand, as this guide describes, is the manual version of what [`stellar agentgate init`](/guides/self-service-onboarding) automates end-to-end against the canonical `agent-policy` instance -- no policy deployment of your own required.
</Note>

## Configuring an allow-list

`agent-policy.configure` sets a wallet's allow-list and spend cap in one call, authenticated by the wallet itself (so only the wallet owner can change it):

```typescript theme={null}
await invokeAsWallet({
  server, networkPassphrase, feeSource: owner,
  operation: policyContract.call(
    "configure",
    nativeToScVal(walletId, { type: "address" }),
    xdr.ScVal.scvVec([
      allowedCallEntry(vaultId, "deposit", null),      // uncapped
      allowedCallEntry(vaultId, "withdraw", 1),        // capped, amount is arg index 1
    ]),
    nativeToScVal(1000n, { type: "i128" }),             // window_allowance
  ),
  walletContractId: walletId,
  walletSigner: owner,
});
```

<Warning>
  `configure` replaces the ENTIRE allow-list and cap in one call -- it is not additive. Re-configuring with a shorter list removes methods that were previously allowed.
</Warning>

## Restricting the agent's signer

A signer must be added with `SignerLimits` scoped to the target contract, requiring the policy as a co-signer -- see [Security Model](/concepts/security-model) for why an unlimited signer defeats the whole design:

```typescript theme={null}
const restrictedLimits = signerLimitsScopedTo(vaultId, [signerKeyPolicy(policyId)]);
await invokeAsWallet({
  server, networkPassphrase, feeSource: owner,
  operation: walletContract.call("update_signer", signerDescriptorEd25519(agentPubkey, restrictedLimits)),
  walletContractId: walletId,
  walletSigner: owner,
});
```

## Resetting to a pristine demo state

`scripts/reset-demo.ts` deploys an entirely fresh vault, policy, and wallet -- new keys, zero prior spend, zero prior balance -- and writes the result to `.env`:

```bash theme={null}
bun run reset-demo
```

Useful before recording a demo or re-running the scripted walkthrough, since the spend cap is cumulative across a 24-hour window and doesn't reset itself mid-demo.

<Card title="See the full setup scripts" icon="code" href="https://github.com/salazarsebas/teji/tree/main/scripts">
  `setup-wallet.ts`, `restrict-agent-signer.ts`, and `reconfigure-policy.ts` cover the individual steps this guide describes, for when you don't want a full fresh redeploy.
</Card>