# Vault policies

Spending policies cap how much can move through a vault, and through each role, in a weekly or monthly cycle. They are checked before a transaction is built, so a movement that breaks a policy never reaches signers.

> Part of the SQRL documentation, section "SQRL Enterprise".
> Rendered page: https://docs.sqrl.tech/enterprise/vaults/vault-policies

## Vault limits

Each vault has a limit per cycle. The vault page shows the **Limit**, how much is **Used** in the current cycle, what **Remains**, and when the cycle resets.

* The limit is cumulative over the cycle, not a cap on a single movement.
* It counts token units across every asset the vault moves.
* Mints, burns and transfers count against it. A vault with no limit refuses mints, burns and transfers rather than allowing them.

A vault's limit and cycle are changed by a holder of Manage vaults (`MANAGE_VAULTS`) through the [Update a vault's spending policy](/api/update-vault) API.

## Role limits

Each role also has a **Transaction limit (Tokens)** per cycle, set when the role is created or in **Edit permissions**. It caps how much a member holding that role can transfer within the cycle, whatever the vault's own limit. Role limits need Manage policies (`MANAGE_ROLES`).

## Cycles

* **Weekly**: counters reset each week on the configured day.
* **Monthly**: counters reset each month on the configured day.

  Policies are a pre-signing safety net. A movement over its limit is stopped before any transaction exists, and the denial is recorded in the audit log.