Controller Sessions & Policies

Session policies define which contracts and methods your app can call. They are required for session-based transaction execution — without policies, execute() will fail with error code 130 ("Array length mismatch") because the Controller's on-chain session validation requires a merkle proof for each call.

Without policies, Controller falls back to manual approval via the keychain modal. On local Katana, policies are required because new Controller accounts cannot be properly deployed without them.

How Sessions Work

1. Define policies (which contracts/methods your app needs)
2. User approves policies once during connection
3. Controller creates session with approved permissions
4. Transactions execute seamlessly via Paymaster

Defining Policies

import { SessionPolicies } from "@cartridge/controller";