---
title: "Policies"
description: "OpenPit exposes two policy stages:"
---
# Policies
OpenPit exposes two policy stages:
- `Start stage`: cheap checks that must see every request and do not need
rollback support.
- `Main stage`: deeper checks that may emit multiple rejects or register
reversible mutations.
Exact interface names differ by SDK and are listed in the language-specific
sections below.
## Configuration Model
Built-in policies use an axis-based configuration model. Each policy has one
or more axes - dimensions along which a limit or barrier is applied. An axis
becomes active only when a barrier is explicitly configured for it.
Common axes across built-in policies:
- **Broker axis**: applies to all orders regardless of account or asset.
- **Asset axis**: usually applies to all orders with a given settlement asset.
`OrderSizeLimitPolicy` is the exception: it resolves quantity by underlying
asset and notional by settlement asset; see
[OrderSizeLimitPolicy](#ordersizelimitpolicy).
- **Account axis**: applies to all orders from a given account.
- **Account+Asset axis**: usually applies to orders from a specific account and
settlement asset pair. `OrderSizeLimitPolicy` applies the same underlying /
settlement split within the account; see
[OrderSizeLimitPolicy](#ordersizelimitpolicy).
An axis without a matching barrier never rejects the order. At least one
axis must be configured; constructors return an error if all axes are empty.
## Synchronization
The sync policy is chosen on the engine builder. It controls how stateful
built-in policies synchronize their internal storage and defines the engine
handle's threading capability (see [Threading
Contract](Threading-Contract.md) for the per-mode contract).
| Mode | Behavior | Use case |
|--------------|--------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------|
| Full sync | Thread-safe handle; concurrent invocation on the same handle is safe. | Engine is shared across threads, or migration patterns make sequential pinning impractical. |
| No sync | Single-threaded handle; calls must stay on the OS thread that created the engine. | Single-threaded embedding; zero synchronization overhead. |
| Account sync | Sequential cross-thread access; caller pins each account to one processing chain. | Account-sharded workloads where one worker / queue owns each account. |
Storage owned by a built-in or custom policy is **always account-keyed**
when used through binding-facing storage contracts: the top-level key
carries an `account id`, and the per-account value can be any structure the
policy needs. The choice of sync mode does not change this rule.
Method names per language:
Go
- `openpit.NewEngineBuilder().FullSync()`
- `openpit.NewEngineBuilder().NoSync()`
- `openpit.NewEngineBuilder().AccountSync()`
If you are unsure, start with `FullSync()`: goroutines migrate between OS
threads at any await point, so even a single goroutine calling the engine
sequentially can wake up on a different OS thread than the one it suspended on.
`FullSync()` is the safe default.
`AccountSync()` only requires that calls for the same account are never
concurrent - it does not require a fixed OS thread. The standard Go pattern is
a sharded worker pool: hash the account ID to one of N channels; one goroutine
drains each channel, so the same account always lands on the same worker.
```go
const shards = 256
type task struct {
accountID string
order model.Order
}
// One channel per shard, one goroutine draining each channel: the same
// account always lands on the same worker, so AccountSync holds.
workers := make([]chan task, shards)
for i := range workers {
ch := make(chan task, 1024)
workers[i] = ch
go func(ch <-chan task) {
for t := range ch {
req, _, _ := engine.ExecutePreTrade(t.order)
if req != nil {
req.Close()
}
}
}(ch)
}
// fnv32 hashes the account ID; the modulo pins each account to one shard.
dispatch := func(t task) {
workers[fnv32(t.accountID)%shards] <- t
}
```
Different shards run in parallel; all orders for the same account always go to
the same shard and are processed sequentially.
Python
- `openpit.Engine.builder().full_sync()`
- `openpit.Engine.builder().no_sync()`
- `openpit.Engine.builder().account_sync()`
Prefer `no_sync()` when you do not explicitly work with multiple threads
yourself - it has zero synchronization overhead and is the right default for
embeddings that drive the engine from a single thread (synchronous code or one
asyncio loop). Use `full_sync()` only when you actually share the engine
across threads concurrently. Use `account_sync()` for sharded sequential
workloads where each account is pinned to one processing chain.
JavaScript
- `Engine.builder()`
The WebAssembly binding is single-threaded and exposes no user-selectable sync
mode. One engine instance runs synchronously on the calling thread; use one
engine per worker or isolate when you need parallelism.
C++
- `openpit::EngineBuilder(openpit::SyncPolicy::Full)`
- `openpit::EngineBuilder(openpit::SyncPolicy::None)`
- `openpit::EngineBuilder(openpit::SyncPolicy::Account)`
The sync policy is a constructor argument on `openpit::EngineBuilder`; the SDK
does not impose a default. Prefer `SyncPolicy::None` for a single-threaded
embedding with zero synchronization overhead. Use `SyncPolicy::Full` only when
the engine handle is actually shared across threads concurrently, and
`SyncPolicy::Account` for sharded sequential workloads where each account is
pinned to one processing chain.
Rust
- `Engine::builder::().full_sync()`
- `Engine::builder::().no_sync()`
- `Engine::builder::().account_sync()`
The choice depends on the embedding; the SDK does not impose a default.
Go
```go
engine, err := openpit.NewEngineBuilder().
NoSync().
Builtin(policies.BuildSpotFunds()).
Build()
```
Python
```python
import openpit
import openpit.pretrade.policies
# Limit-only spot funds, registered first in the policy list.
engine = (
openpit.Engine.builder()
.no_sync()
.builtin(openpit.pretrade.policies.build_spot_funds())
.build()
)
```
JavaScript
```ts
import { Engine } from "@openpit/engine";
import { buildSpotFunds } from "@openpit/engine/pretrade/policies";
// Limit-only spot funds, registered first in the policy list.
const engine = Engine.builder().builtin(buildSpotFunds()).build();
```
C++
```cpp
namespace policies = openpit::pretrade::policies;
openpit::EngineBuilder builder(openpit::SyncPolicy::None);
// Limit-only mode: no market-data service handle.
builder.Add(policies::SpotFundsPolicy{});
const openpit::Engine engine = builder.Build();
```
Rust
```rust
use openpit::pretrade::policies::{SpotFundsPolicy, SpotFundsSettings};
use openpit::{
Engine, FullSync, OrderOperation, SpotFundsMarketData, SpotFundsPricingSource,
WithAccountAdjustmentAmount, WithAccountAdjustmentBalanceOperation,
WithAccountAdjustmentBounds, WithExecutionReportFillDetails, WithExecutionReportOperation,
};
// Report and account-adjustment shapes composed from public SDK wrappers.
type SpotReport = WithExecutionReportOperation>;
type SpotAdjustment = WithAccountAdjustmentAmount<
WithAccountAdjustmentBounds<
WithAccountAdjustmentBalanceOperation,
>,
>;
let builder = Engine::builder::().full_sync();
// Limit-only mode: no market-data bundle.
let policy = SpotFundsPolicy::::new(
SpotFundsSettings::new(0, SpotFundsPricingSource::Mark, [])?,
None::>,
builder.storage_builder(),
);
let engine = builder.pre_trade(policy).build()?;
```
Go
```go
engine, err := openpit.NewEngineBuilder().
NoSync().
Builtin(
policies.BuildOrderValidation(),
).
Build()
```
Python
```python
import openpit
import openpit.pretrade.policies
engine = (
openpit.Engine.builder()
.no_sync()
.builtin(
openpit.pretrade.policies.build_order_validation(),
)
.build()
)
```
JavaScript
```ts
import { Engine } from "@openpit/engine";
import { buildOrderValidation } from "@openpit/engine/pretrade/policies";
const engine = Engine.builder()
.builtin(buildOrderValidation())
.build();
```
C++
```cpp
namespace policies = openpit::pretrade::policies;
openpit::EngineBuilder builder(openpit::SyncPolicy::None);
builder.Add(policies::OrderValidationPolicy{});
const openpit::Engine engine = builder.Build();
```
Rust
```rust
use openpit::pretrade::policies::OrderValidationPolicy;
use openpit::{Engine, OrderOperation};
let engine = Engine::builder::()
.no_sync()
.pre_trade(OrderValidationPolicy::new())
.build()?;
```
Go
```go
engine, err := openpit.NewEngineBuilder().
NoSync().
Builtin(
policies.BuildRateLimit().
BrokerBarrier(
policies.RateLimitBrokerBarrier{
Limit: policies.RateLimit{
MaxOrders: 100,
Window: time.Second,
},
},
),
).
Build()
```
Python
```python
import datetime
import openpit
import openpit.pretrade.policies
engine = (
openpit.Engine.builder()
.no_sync()
.builtin(
openpit.pretrade.policies.build_rate_limit()
.broker_barrier(
openpit.pretrade.policies.RateLimitBrokerBarrier(
limit=openpit.pretrade.policies.RateLimit(
max_orders=100,
window=datetime.timedelta(seconds=1),
),
),
)
)
.build()
)
```
JavaScript
```ts
import { Engine } from "@openpit/engine";
import {
buildRateLimit,
RateLimit,
RateLimitBrokerBarrier,
} from "@openpit/engine/pretrade/policies";
// windowMs is the rolling-window length in milliseconds (1 second here).
const engine = Engine.builder()
.builtin(
buildRateLimit().brokerBarrier(
new RateLimitBrokerBarrier(new RateLimit(100, 1000)),
),
)
.build();
```
C++
```cpp
namespace policies = openpit::pretrade::policies;
openpit::EngineBuilder builder(openpit::SyncPolicy::None);
builder.Add(policies::RateLimitPolicy{}.BrokerBarrier(
policies::RateLimitBrokerBarrier(policies::RateLimit(
/*maxOrders=*/100, /*windowNanoseconds=*/1'000'000'000))));
const openpit::Engine engine = builder.Build();
```
Rust
```rust
use std::time::Duration;
use openpit::pretrade::policies::{
RateLimit,
RateLimitBrokerBarrier,
RateLimitPolicy,
RateLimitSettings,
};
use openpit::{
Engine, OrderOperation, WithExecutionReportOperation, WithFinancialImpact,
};
type Report = WithExecutionReportOperation>;
let builder = Engine::builder::().no_sync();
let policy = RateLimitPolicy::new(
RateLimitSettings::new(
Some(RateLimitBrokerBarrier {
limit: RateLimit {
max_orders: 100,
window: Duration::from_secs(1),
},
}),
[], // asset barriers
[], // account barriers
[], // account+asset barriers
)?,
builder.storage_builder(),
);
let engine = builder.pre_trade(policy).build()?;
```
Go
```go
aapl, err := param.NewAsset("AAPL")
usd, err := param.NewAsset("USD")
assetMaxQty, err := param.NewQuantityFromString("100")
assetMaxNotional, err := param.NewVolumeFromString("50000")
brokerMaxQty, err := param.NewQuantityFromString("500")
brokerMaxNotional, err := param.NewVolumeFromString("100000")
// Quantity is keyed by the underlying asset, notional by the
// settlement asset; broker caps apply on top.
engine, err := openpit.NewEngineBuilder().
NoSync().
Builtin(
policies.BuildOrderSizeLimit().
AssetBarriers(
policies.OrderSizeAssetBarrier{
Asset: aapl,
Limit: policies.OrderSizeLimit{
MaxQuantity: optional.Some(assetMaxQty),
MaxNotional: optional.None[param.Volume](),
},
},
policies.OrderSizeAssetBarrier{
Asset: usd,
Limit: policies.OrderSizeLimit{
MaxQuantity: optional.None[param.Quantity](),
MaxNotional: optional.Some(assetMaxNotional),
},
},
).
BrokerBarrier(
policies.OrderSizeBrokerBarrier{
Limit: policies.OrderSizeLimit{
MaxQuantity: optional.Some(brokerMaxQty),
MaxNotional: optional.Some(brokerMaxNotional),
},
},
),
).
Build()
```
Python
```python
import openpit
import openpit.pretrade.policies
# Quantity is keyed by the underlying asset, notional by the
# settlement asset; broker caps apply on top.
engine = (
openpit.Engine.builder()
.no_sync()
.builtin(
openpit.pretrade.policies.build_order_size_limit()
.asset_barriers(
openpit.pretrade.policies.OrderSizeAssetBarrier(
limit=openpit.pretrade.policies.OrderSizeLimit(
max_quantity=openpit.param.Quantity(100),
max_notional=None,
),
asset="AAPL",
),
openpit.pretrade.policies.OrderSizeAssetBarrier(
limit=openpit.pretrade.policies.OrderSizeLimit(
max_quantity=None,
max_notional=openpit.param.Volume(50000),
),
asset="USD",
),
)
.broker_barrier(
openpit.pretrade.policies.OrderSizeBrokerBarrier(
limit=openpit.pretrade.policies.OrderSizeLimit(
max_quantity=openpit.param.Quantity(500),
max_notional=openpit.param.Volume(100000),
),
),
)
)
.build()
)
```
JavaScript
```ts
import { Engine } from "@openpit/engine";
import {
buildOrderSizeLimit,
OrderSizeAssetBarrier,
OrderSizeBrokerBarrier,
OrderSizeLimit,
} from "@openpit/engine/pretrade/policies";
// Quantities and notionals cross as decimal strings.
// Quantity is keyed by the underlying asset, notional by the
// settlement asset; broker caps apply on top.
const engine = Engine.builder()
.builtin(
buildOrderSizeLimit()
.assetBarriers([
new OrderSizeAssetBarrier(
new OrderSizeLimit("100", undefined),
"AAPL",
),
new OrderSizeAssetBarrier(
new OrderSizeLimit(undefined, "50000"),
"USD",
),
])
.brokerBarrier(
new OrderSizeBrokerBarrier(new OrderSizeLimit("500", "100000")),
),
)
.build();
```
C++
```cpp
namespace policies = openpit::pretrade::policies;
const openpit::param::Quantity assetMaxQty = openpit::param::Quantity::FromString("100");
const openpit::param::Volume assetMaxNotional = openpit::param::Volume::FromString("50000");
const openpit::param::Quantity brokerMaxQty = openpit::param::Quantity::FromString("500");
const openpit::param::Volume brokerMaxNotional = openpit::param::Volume::FromString("100000");
openpit::EngineBuilder builder(openpit::SyncPolicy::None);
// Quantity is keyed by the underlying asset, notional by the
// settlement asset; broker caps apply on top.
builder.Add(
policies::OrderSizeLimitPolicy{}
.AssetBarrier(policies::OrderSizeAssetBarrier(
policies::OrderSizeLimit::Quantity(assetMaxQty),
openpit::param::Asset("AAPL")))
.AssetBarrier(policies::OrderSizeAssetBarrier(
policies::OrderSizeLimit::Notional(assetMaxNotional),
openpit::param::Asset("USD")))
.BrokerBarrier(policies::OrderSizeBrokerBarrier(
policies::OrderSizeLimit::Both(brokerMaxQty, brokerMaxNotional))));
const openpit::Engine engine = builder.Build();
```
Rust
```rust
use openpit::param::{Asset, Quantity, Volume};
use openpit::pretrade::policies::{
OrderSizeAssetBarrier,
OrderSizeBrokerBarrier,
OrderSizeLimit,
OrderSizeLimitPolicy,
OrderSizeLimitSettings,
};
use openpit::storage::NoLocking;
use openpit::{
Engine, OrderOperation, WithExecutionReportOperation, WithFinancialImpact,
};
type Report = WithExecutionReportOperation>;
let engine = Engine::builder::()
.no_sync()
// Quantity is keyed by the underlying asset, notional by the
// settlement asset; broker caps apply on top.
.pre_trade(OrderSizeLimitPolicy::::new(
OrderSizeLimitSettings::new(
Some(OrderSizeBrokerBarrier {
limit: OrderSizeLimit {
max_quantity: Some(Quantity::from_str("500")?),
max_notional: Some(Volume::from_str("100000")?),
},
}),
[
OrderSizeAssetBarrier {
limit: OrderSizeLimit {
max_quantity: Some(Quantity::from_str("100")?),
max_notional: None,
},
asset: Asset::new("AAPL")?,
},
OrderSizeAssetBarrier {
limit: OrderSizeLimit {
max_quantity: None,
max_notional: Some(Volume::from_str("50000")?),
},
asset: Asset::new("USD")?,
},
],
[],
)?,
))
.build()?;
```
Go
```go
usd, err := param.NewAsset("USD")
lowerBound, err := param.NewPnlFromString("-1000")
upperBound, err := param.NewPnlFromString("500")
engine, err := openpit.NewEngineBuilder().
NoSync().
Builtin(
policies.BuildPnlBoundsKillSwitch().
BrokerBarriers(
policies.PnlBoundsBrokerBarrier{
SettlementAsset: usd,
LowerBound: optional.Some(lowerBound),
UpperBound: optional.Some(upperBound),
},
),
).
Build()
```
Python
```python
import openpit
import openpit.pretrade.policies
engine = (
openpit.Engine.builder()
.no_sync()
.builtin(
openpit.pretrade.policies.build_pnl_bounds_killswitch()
.broker_barriers(
openpit.pretrade.policies.PnlBoundsBrokerBarrier(
settlement_asset=openpit.param.Asset("USD"),
lower_bound=openpit.param.Pnl(-1000),
upper_bound=openpit.param.Pnl(500),
),
)
)
.build()
)
```
JavaScript
```ts
import { Engine } from "@openpit/engine";
import {
buildPnlBoundsKillswitch,
PnlBoundsBrokerBarrier,
} from "@openpit/engine/pretrade/policies";
// Bounds cross as signed decimal strings; at least one bound must be set.
const engine = Engine.builder()
.builtin(
buildPnlBoundsKillswitch().brokerBarriers([
new PnlBoundsBrokerBarrier("USD", "-1000", "500"),
]),
)
.build();
```
C++
```cpp
namespace policies = openpit::pretrade::policies;
policies::PnlBoundsBrokerBarrier barrier(openpit::param::Asset("USD"));
barrier.lowerBound = openpit::param::Pnl::FromString("-1000");
barrier.upperBound = openpit::param::Pnl::FromString("500");
openpit::EngineBuilder builder(openpit::SyncPolicy::None);
builder.Add(
policies::PnlBoundsKillSwitchPolicy{}.BrokerBarrier(std::move(barrier)));
const openpit::Engine engine = builder.Build();
```
Rust
```rust
use openpit::param::{Asset, Pnl};
use openpit::pretrade::policies::{
PnlBoundsBrokerBarrier,
PnlBoundsKillSwitchPolicy,
PnlBoundsKillSwitchSettings,
};
use openpit::{
Engine, OrderOperation, WithExecutionReportOperation, WithFinancialImpact,
};
type Report = WithExecutionReportOperation>;
let builder = Engine::builder::().no_sync();
let policy = PnlBoundsKillSwitchPolicy::new(
PnlBoundsKillSwitchSettings::new(
[PnlBoundsBrokerBarrier {
settlement_asset: Asset::new("USD")?,
lower_bound: Some(Pnl::from_str("-1000")?),
upper_bound: Some(Pnl::from_str("500")?),
}],
[],
)?,
builder.storage_builder(),
);
let engine = builder.pre_trade(policy).build()?;
```