# Ward policies

**🟠 Advanced · Lesson 16**

WARD POLICIES - how permissive a conduit is about contracting with other conduits, and the three refusals that come with the door.

A policy is broader than a visibility flag. It governs THREE control surfaces at once: - may this conduit initiate OUTBOUND grants? - may it accept INBOUND borrowed lineages? - are per-spell permission and whitelist checks ENFORCED, or bypassed?

FIVE MODES default both directions allowed, but every spell still has to satisfy its own permission and whitelist rules whitelist_all expose local lineages without per-spell whitelist flags, AND let otherwise-blocked entries through block_all reject dynamic contracting from this ward entirely inbound_only accept borrowed inbound contracts; refuse to initiate outbound ones outbound_only grant outward; refuse inbound borrowing by peers

THREE REFUSALS, AND THE THIRD IS THE INTERESTING ONE

1. DYNAMIC MODE ONLY. On an automatic frame the door raises. This is not a policy engine that sits idle in automatic mode - wards only form and sever contracts at runtime in dynamic mode, so outside it the setting would be decoration.

2. NORMAL CONDUITS ONLY. A lesser conduit cannot hold a policy - "Convert to a normal Conduit first". Policy belongs to the thing that owns a lineage, not to a borrower of one.

3. NO RETROACTIVE LOCKDOWN. Setting block_all or whitelist_all WHILE CONTRACTS EXIST raises. Melder will not silently sever what you already granted, and it will not quietly leave the grants standing under a policy that says they should not exist. It refuses and makes you tear the contracts down yourself.

That is the never-substitute rule (lessons 06/13/14/17) applied to authority: a policy change that cannot be honestly applied is an error, never a partial application.

## Before you run

Use the [Advanced guide](../../advanced/index.md) for prerequisite concepts. Run from a checkout with Melder installed and Python 3.14 free-threading selected. The collection download includes the level's local helper modules.

## Run the saved script

```bash
python UX_and_AIX_experiences/03_advanced/16_ward_policies.py
```

```powershell
py -3.14t UX_and_AIX_experiences/03_advanced/16_ward_policies.py
```

{download}`Download this collection <../../downloads/advanced-examples.zip>` · [Source on GitHub](https://github.com/Synaptic724/melder/blob/4b364a338debcb1c010d0f6e9dcbbabb62945ba0/UX_and_AIX_experiences/03_advanced/16_ward_policies.py)

## Public surface

md.Policies, Conduit.set_new_policy, the dynamic-only
                   / normal-only / no-existing-contracts refusals

## Code

```{literalinclude} ../../downloads/03_advanced/16_ward_policies.py
:language: python
:linenos:
```

## Check the outcome

The script contains its own assertions or demonstrated refusal paths. Run it to evaluate those checks against your installed version. The code above is taken directly from the saved file; no run output is invented here.

[More advanced examples](index.md) · [Level guide](../../advanced/index.md)

## Related guides

- [Ward policies and refusals](../../advanced/policies.md)

## API contracts

- [Conduit](../../reference/api/resolution/conduit.md)
- [Policies](../../reference/api/connections/policies.md)