What is the correct Policy?

[n0price]

Dear Signatory Team,
I appreciate your help to share the correct policy to allow backer duties, voting, delegating, staking and unstaking and block transaction (ie: draining funds from consensus key). Thank you!

[michaelkernaghan]

The format in your signatory.yaml file would be

 block:
      preattestation:
      attestation:
      generic:
        - transaction
        - reveal
        - delegation

You can choose from the policy list for the rest:
[activate_account, attestation, attestation_with_dal, ballot, dal_publish_commitment, delegation, double_attestation_evidence, double_baking_evidence, double_preattestation_evidence, drain_delegate, failing_noop, finalize_unstake, increase_paid_storage, origination, preattestation, proposals, register_global_constant, reveal, seed_nonce_revelation, set_delegate_parameters, set_deposits_limit, signature_prefix, smart_rollup_add_messages, smart_rollup_cement, smart_rollup_execute_outbox_message,
smart_rollup_originate, smart_rollup_publish, smart_rollup_recover_bond, smart_rollup_refute, smart_rollup_timeout, stake,
transaction, transfer_ticket, unstake, update_consensus_key, vdf_revelation, zk_rollup_origination, zk_rollup_publish,
zk_rollup_update]

So you might choose:

 block:
      preattestation:
      attestation:
      unstake:
      finalize_unstake:    
      generic:
        - transaction
        - reveal
        - delegation
        - drain_delegate

[n0price]

Thanks, so something like this should work to allow baker duties, delegation and staking transactions only.

tezos:
  tz1ExamplePublicKeyHash:
    log_payloads: true
    allow:
      endorsement:
        - endorsement
        - preendorsement
      generic:
        - delegation
        - stake
        - unstake
        - ballot
        - reveal 
      block:
        - block
    deny:
      generic:
        - transaction   # Deny general transactions (e.g., Alice sending to Bob)
        - drain_delegate  # Specifically block draining of consensus key

[michaelkernaghan]

signatory is "closed by default" so there is no 'deny' block.

also, if you have 'unstake' you might want 'finalize_unstake' as well.

Finally, note as well that endorsement is now attestation and preendorsement is now preattestation

[n0price]

Thanks, the following example now is it correct?

tezos:
  tz1ExamplePublicKeyHash:
    log_payloads: true
    allow:
      block:
      preattestation:
      attestation:
      unstake:
      finalize_unstake:    
      generic:
        - transaction
        - reveal
        - delegation
        - drain_delegate

[michaelkernaghan]

That should work.