PCL Policy Admin
The single chain-wide address authorized to manage PCL templates and the global policy config, with a built-in recovery bypass so it cannot be locked out by its own rules.
The PCL policy admin is a single address stored in the x/pcl module parameters and exposed via IPcl.policyAdmin(). It is the only caller authorized to register or remove policy templates and to set or clear the GlobalPolicyConfig. To ensure the admin can always recover from a misconfigured global policy or denylist that would otherwise reject its own transactions, calls from the admin to a fixed set of PCL control-plane methods bypass PCL policy evaluation entirely at both the pre-execution operations extraction step and the post-execution transfer-scan hook.
Reading the current policy admin
The current admin address is a simple view read. Clients should call this at the start of any admin-tooling flow rather than caching the value across sessions — rotation is a consortium-governance action and can happen out-of-band.
// SPDX-License-Identifier: Apache-2.0
pragma solidity ^0.8.28;
import "@maroo-chain/contracts/precompiles/pcl/IPcl.sol";
contract AdminProbe {
IPcl constant pcl = IPcl(0x1000000000000000000000000000000000000005);
function currentAdmin() external view returns (address) {
return pcl.policyAdmin();
}
}What the admin can do
The admin is authorized on exactly four PCL entry points. Every other PCL call (contract-scoped policy management, view methods, proxy deployment) is open to the appropriate caller and is not gated on the admin.
Any other caller invoking these methods reverts with
| Method | Purpose |
|---|---|
registerPolicyTemplate(string) | Adds a built-in template to the active registry so it can be instantiated in a PolicySet. |
removePolicyTemplate(string) | Removes a template from the registry. The registry no longer tracks per-template consumers, so this call does not revert with PolicyTemplateInUse — an existing PolicySet referencing a since-removed template will instead fail at evaluation time with PolicyTemplateNotFound(templateId). |
setGlobalPolicies(GlobalPolicyConfig) | Replaces the chain-wide GlobalPolicyConfig. |
removeGlobalPolicies() | Clears the chain-wide GlobalPolicyConfig. |
Any other caller invoking these methods reverts with
Unauthorized().Recovery bypass — admin control-plane calls skip PCL
If the admin published a
GlobalPolicyConfig that (accidentally or otherwise) rejects its own address — for example a DENYLIST_POLICY containing the admin, or a PERIODIC_VOLUME_POLICY the admin has already exceeded — a naive PCL would refuse the very transaction the admin needs to fix the problem. To prevent this deadlock, transactions where msg.sender == policyAdmin AND the call targets the PCL precompile AND the 4-byte selector is one of the four control-plane methods above are treated as recovery calls: they skip PCL policy evaluation entirely in both the pre-execution operations extraction and the post-execution transfer-scan hook. All other admin transactions — ordinary transfers, non-PCL contract calls, even a PCL call whose selector is not in this set (for example a contractPolicies view or changeContractPolicies) — go through PCL enforcement normally.Practical consequence for callers
For a dApp author the takeaway is narrow: the admin has no ambient privilege over your contract. It cannot silently transfer OKRW past a
VOLUME_POLICY, cannot bypass an EAS_POLICY on a token you registered, and cannot escape a contract-scoped DENYLIST_POLICY. The bypass is limited to the four PCL control-plane selectors on the PCL precompile address itself. In practice this means the admin can always publish a new global config to undo a previous mistake, but each new config is then enforced against every subsequent transaction — including the admin's — unless the admin stays on the control-plane path.