Recipe: vault curator operations

Goal — A curator team runs day-to-day strategy operations from operator wallets or bots. Sensitive configuration changes stay behind higher-trust signers. Every action is restricted to known contracts, known functions, and bounded parameters.

Good for:

Curator teams that separate strategy execution from governance approvals.
Automated rebalancing with tight operational constraints.
Multi-vault operations that reuse one policy pattern.

Example: two policies, two trust levels

A curator manages a USDC strategy. An operator wallet rebalances across approved markets; a committee oversees material changes:

Policy	Members	Allowed
Rebalance & maintenance	Operator wallets, bots	Only the strategy and vault contracts and their underlying protocols. Rebalances, routine position adjustments, reward claims. Per-call amount limits; no arbitrary transfer recipients.
Governance changes	Committee signers	Only the admin and config functions of the strategy contracts: add or remove markets, change caps and queues, update fees.

The split matters: a leaked operator key cannot expand its own scope, because the config functions live in the other policy.

Steps

Import the controlling Safe — the vault or admin Safe that executes the strategy’s transactions.
Create the “Rebalance & maintenance” policy: open Policies, create a policy (for example “Curator Rebalancing”), select the Safe, and add the operator wallets or bot addresses as Members.
Add tightly scoped actions for the routine operations: DeFi actions for your protocols, Custom actions recorded with Pilot, and Swap actions for reward conversion. Restrict the targets to the exact contracts, name the functions, and cap the amounts.
Create the separate “Governance changes” policy with the committee signers. It contains only the admin and config calls.
Click Apply Changes for both policies and sign with the Safe.

Operators then execute the allowed workflows with Pilot: simulation first, onchain policy checks on execution.

Do it as code

The two-policy structure is two roles on one constellation node:


export const curatorRoles = eth.roles['Curator Roles']({
  nonce: 0n,
  owner: adminSafe,
  avatar: adminSafe,
  target: adminSafe,
  roles: { rebalance, governance },
})

Each role has its own members and permissions files. For bot operators, apply the AI agent pattern; to give the committee a veto window over high-impact calls, route a role through a Delay Modifier.