# description
Ordered stateless per-call signing policy. The first matching rule decides each call: allow signs automatically, deny rejects without queuing, and reaching the end requires explicit owner approval. Omitted matchers mean anything and present matchers are ANDed. Native-value comparisons are per-call conditions, not cumulative spending budgets.