diff --git a/lib/Command/Developer/Reset.php b/lib/Command/Developer/Reset.php
index 18b58dc58b..c9c4e1793a 100644
--- a/lib/Command/Developer/Reset.php
+++ b/lib/Command/Developer/Reset.php
@@ -96,6 +96,12 @@ protected function configure(): void {
 				mode: InputOption::VALUE_NONE,
 				description: 'Reset config'
 			)
+			->addOption(
+				name: 'policy',
+				shortcut: null,
+				mode: InputOption::VALUE_NONE,
+				description: 'Reset policy data'
+			)
 		;
 	}
 
@@ -140,6 +146,10 @@ protected function execute(InputInterface $input, OutputInterface $output): int
 				$this->resetConfig();
 				$ok = true;
 			}
+			if ($input->getOption('policy') || $all) {
+				$this->resetPolicy();
+				$ok = true;
+			}
 		} catch (\Exception $e) {
 			$this->logger->error($e->getMessage());
 			throw $e;
@@ -254,4 +264,17 @@ private function resetConfig(): void {
 		} catch (\Throwable) {
 		}
 	}
+
+	private function resetPolicy(): void {
+		try {
+			$delete = $this->db->getQueryBuilder();
+			$delete->delete('libresign_permission_set_binding')
+				->executeStatement();
+
+			$delete = $this->db->getQueryBuilder();
+			$delete->delete('libresign_permission_set')
+				->executeStatement();
+		} catch (\Throwable) {
+		}
+	}
 }
diff --git a/lib/Controller/AdminController.php b/lib/Controller/AdminController.php
index 34c2458980..b8ebe168f6 100644
--- a/lib/Controller/AdminController.php
+++ b/lib/Controller/AdminController.php
@@ -24,6 +24,7 @@
 use OCA\Libresign\Service\IdentifyMethodService;
 use OCA\Libresign\Service\Install\ConfigureCheckService;
 use OCA\Libresign\Service\Install\InstallService;
+use OCA\Libresign\Service\Policy\PolicyService;
 use OCA\Libresign\Service\ReminderService;
 use OCA\Libresign\Service\SignatureBackgroundService;
 use OCA\Libresign\Service\SignatureTextService;
@@ -83,6 +84,7 @@ public function __construct(
 		private ReminderService $reminderService,
 		private FooterService $footerService,
 		private DocMdpConfigService $docMdpConfigService,
+		private PolicyService $policyService,
 		private IdentifyMethodService $identifyMethodService,
 		private FileMapper $fileMapper,
 	) {
@@ -960,57 +962,6 @@ private function saveOrDeleteConfig(string $key, ?string $value, string $default
 		}
 	}
 
-	/**
-	 * Set signature flow configuration
-	 *
-	 * @param bool $enabled Whether to force a signature flow for all documents
-	 * @param string|null $mode Signature flow mode: 'parallel' or 'ordered_numeric' (only used when enabled is true)
-	 * @return DataResponse<Http::STATUS_OK, LibresignMessageResponse, array{}>|DataResponse<Http::STATUS_BAD_REQUEST, LibresignErrorResponse, array{}>|DataResponse<Http::STATUS_INTERNAL_SERVER_ERROR, LibresignErrorResponse, array{}>
-	 *
-	 * 200: Configuration saved successfully
-	 * 400: Invalid signature flow mode provided
-	 * 500: Internal server error
-	 */
-	#[ApiRoute(verb: 'POST', url: '/api/{apiVersion}/admin/signature-flow/config', requirements: ['apiVersion' => '(v1)'])]
-	public function setSignatureFlowConfig(bool $enabled, ?string $mode = null): DataResponse {
-		try {
-			if (!$enabled) {
-				$this->appConfig->deleteKey(Application::APP_ID, 'signature_flow');
-				return new DataResponse([
-					'message' => $this->l10n->t('Settings saved'),
-				]);
-			}
-
-			if ($mode === null) {
-				return new DataResponse([
-					'error' => $this->l10n->t('Mode is required when signature flow is enabled.'),
-				], Http::STATUS_BAD_REQUEST);
-			}
-
-			try {
-				$signatureFlow = \OCA\Libresign\Enum\SignatureFlow::from($mode);
-			} catch (\ValueError) {
-				return new DataResponse([
-					'error' => $this->l10n->t('Invalid signature flow mode. Use "parallel" or "ordered_numeric".'),
-				], Http::STATUS_BAD_REQUEST);
-			}
-
-			$this->appConfig->setValueString(
-				Application::APP_ID,
-				'signature_flow',
-				$signatureFlow->value
-			);
-
-			return new DataResponse([
-				'message' => $this->l10n->t('Settings saved'),
-			]);
-		} catch (\Exception $e) {
-			return new DataResponse([
-				'error' => $e->getMessage(),
-			], Http::STATUS_INTERNAL_SERVER_ERROR);
-		}
-	}
-
 	/**
 	 * Configure DocMDP signature restrictions
 	 *
diff --git a/lib/Controller/PageController.php b/lib/Controller/PageController.php
index 51d7305461..95fed81b0f 100644
--- a/lib/Controller/PageController.php
+++ b/lib/Controller/PageController.php
@@ -23,6 +23,7 @@
 use OCA\Libresign\Service\FileService;
 use OCA\Libresign\Service\IdentifyMethod\SignatureMethod\TokenService;
 use OCA\Libresign\Service\IdentifyMethodService;
+use OCA\Libresign\Service\Policy\PolicyService;
 use OCA\Libresign\Service\RequestSignatureService;
 use OCA\Libresign\Service\SessionService;
 use OCA\Libresign\Service\SignerElementsService;
@@ -58,6 +59,7 @@ public function __construct(
 		private AccountService $accountService,
 		protected SignFileService $signFileService,
 		protected RequestSignatureService $requestSignatureService,
+		private PolicyService $policyService,
 		private SignerElementsService $signerElementsService,
 		protected IL10N $l10n,
 		private IdentifyMethodService $identifyMethodService,
@@ -106,7 +108,13 @@ public function index(): TemplateResponse {
 
 		$this->provideSignerSignatues();
 		$this->initialState->provideInitialState('identify_methods', $this->identifyMethodService->getIdentifyMethodsSettings());
-		$this->initialState->provideInitialState('signature_flow', $this->appConfig->getValueString(Application::APP_ID, 'signature_flow', \OCA\Libresign\Enum\SignatureFlow::NONE->value));
+		$resolvedPolicies = [];
+		foreach ($this->policyService->resolveKnownPolicies() as $policyKey => $resolvedPolicy) {
+			$resolvedPolicies[$policyKey] = $resolvedPolicy->toArray();
+		}
+		$this->initialState->provideInitialState('effective_policies', [
+			'policies' => $resolvedPolicies,
+		]);
 		$this->initialState->provideInitialState('docmdp_config', $this->docMdpConfigService->getConfig());
 		$this->initialState->provideInitialState('legal_information', $this->appConfig->getValueString(Application::APP_ID, 'legal_information'));
 
diff --git a/lib/Controller/PolicyController.php b/lib/Controller/PolicyController.php
new file mode 100644
index 0000000000..af5ee37297
--- /dev/null
+++ b/lib/Controller/PolicyController.php
@@ -0,0 +1,430 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Libresign\Controller;
+
+use OCA\Libresign\AppInfo\Application;
+use OCA\Libresign\Service\Policy\Model\PolicyLayer;
+use OCA\Libresign\Service\Policy\PolicyService;
+use OCP\AppFramework\Http;
+use OCP\AppFramework\Http\Attribute\ApiRoute;
+use OCP\AppFramework\Http\Attribute\NoAdminRequired;
+use OCP\AppFramework\Http\Attribute\NoCSRFRequired;
+use OCP\AppFramework\Http\DataResponse;
+use OCP\Group\ISubAdmin;
+use OCP\IGroupManager;
+use OCP\IL10N;
+use OCP\IRequest;
+use OCP\IUserSession;
+
+/**
+ * @psalm-import-type LibresignErrorResponse from \OCA\Libresign\ResponseDefinitions
+ * @psalm-import-type LibresignEffectivePolicyState from \OCA\Libresign\ResponseDefinitions
+ * @psalm-import-type LibresignEffectivePoliciesResponse from \OCA\Libresign\ResponseDefinitions
+ * @psalm-import-type LibresignGroupPolicyResponse from \OCA\Libresign\ResponseDefinitions
+ * @psalm-import-type LibresignGroupPolicyState from \OCA\Libresign\ResponseDefinitions
+ * @psalm-import-type LibresignGroupPolicyWriteResponse from \OCA\Libresign\ResponseDefinitions
+ * @psalm-import-type LibresignSystemPolicyResponse from \OCA\Libresign\ResponseDefinitions
+ * @psalm-import-type LibresignSystemPolicyWriteResponse from \OCA\Libresign\ResponseDefinitions
+ * @psalm-import-type LibresignUserPolicyResponse from \OCA\Libresign\ResponseDefinitions
+ * @psalm-import-type LibresignUserPolicyState from \OCA\Libresign\ResponseDefinitions
+ * @psalm-import-type LibresignUserPolicyWriteResponse from \OCA\Libresign\ResponseDefinitions
+ */
+final class PolicyController extends AEnvironmentAwareController {
+	public function __construct(
+		IRequest $request,
+		private IL10N $l10n,
+		private PolicyService $policyService,
+		private IUserSession $userSession,
+		private IGroupManager $groupManager,
+		private ISubAdmin $subAdmin,
+	) {
+		parent::__construct(Application::APP_ID, $request);
+	}
+
+	/**
+	 * Effective policies bootstrap
+	 *
+	 * @return DataResponse<Http::STATUS_OK, LibresignEffectivePoliciesResponse, array{}>
+	 *
+	 * 200: OK
+	 */
+	#[NoAdminRequired]
+	#[NoCSRFRequired]
+	#[ApiRoute(verb: 'GET', url: '/api/{apiVersion}/policies/effective', requirements: ['apiVersion' => '(v1)'])]
+	public function effective(): DataResponse {
+		/** @var array<string, LibresignEffectivePolicyState> $policies */
+		$policies = [];
+		foreach ($this->policyService->resolveKnownPolicies() as $policyKey => $resolvedPolicy) {
+			/** @var LibresignEffectivePolicyState $policyState */
+			$policyState = $resolvedPolicy->toArray();
+			$policies[$policyKey] = $policyState;
+		}
+
+		/** @var LibresignEffectivePoliciesResponse $data */
+		$data = [
+			'policies' => $policies,
+		];
+
+		return new DataResponse($data);
+	}
+
+	/**
+	 * Read explicit system policy configuration
+	 *
+	 * @param string $policyKey Policy identifier to read from the system layer.
+	 * @return DataResponse<Http::STATUS_OK, LibresignSystemPolicyResponse, array{}>
+	 *
+	 * 200: OK
+	 */
+	#[ApiRoute(verb: 'GET', url: '/api/{apiVersion}/policies/system/{policyKey}', requirements: ['apiVersion' => '(v1)', 'policyKey' => '[a-z0-9_]+'])]
+	public function getSystem(string $policyKey): DataResponse {
+		$policy = $this->policyService->getSystemPolicy($policyKey);
+
+		/** @var LibresignSystemPolicyResponse $data */
+		$data = [
+			'policy' => [
+				'policyKey' => $policyKey,
+				'scope' => ($policy?->getScope() === 'global' ? 'global' : 'system'),
+				'value' => $policy?->getValue(),
+				'allowChildOverride' => $policy?->isAllowChildOverride() ?? true,
+				'visibleToChild' => $policy?->isVisibleToChild() ?? true,
+				'allowedValues' => $policy?->getAllowedValues() ?? [],
+			],
+		];
+
+		return new DataResponse($data);
+	}
+
+	/**
+	 * Read a group-level policy value
+	 *
+	 * @param string $groupId Group identifier that receives the policy binding.
+	 * @param string $policyKey Policy identifier to read for the selected group.
+	 * @return DataResponse<Http::STATUS_OK, LibresignGroupPolicyResponse, array{}>|DataResponse<Http::STATUS_FORBIDDEN, LibresignErrorResponse, array{}>
+	 *
+	 * 200: OK
+	 * 403: Forbidden
+	 */
+	#[NoAdminRequired]
+	#[ApiRoute(verb: 'GET', url: '/api/{apiVersion}/policies/group/{groupId}/{policyKey}', requirements: ['apiVersion' => '(v1)', 'groupId' => '[^/]+', 'policyKey' => '[a-z0-9_]+'])]
+	public function getGroup(string $groupId, string $policyKey): DataResponse {
+		if (!$this->canManageGroupPolicy($groupId)) {
+			return $this->forbiddenGroupPolicyResponse();
+		}
+
+		$policy = $this->policyService->getGroupPolicy($policyKey, $groupId);
+
+		/** @var LibresignGroupPolicyResponse $data */
+		$data = [
+			'policy' => $this->serializeGroupPolicy($groupId, $policyKey, $policy),
+		];
+
+		return new DataResponse($data);
+	}
+
+	/**
+	 * Read a user-level policy preference for a target user (admin scope)
+	 *
+	 * @param string $userId Target user identifier that receives the policy preference.
+	 * @param string $policyKey Policy identifier to read for the selected user.
+	 * @return DataResponse<Http::STATUS_OK, LibresignUserPolicyResponse, array{}>
+	 *
+	 * 200: OK
+	 */
+	#[ApiRoute(verb: 'GET', url: '/api/{apiVersion}/policies/user/{userId}/{policyKey}', requirements: ['apiVersion' => '(v1)', 'userId' => '[^/]+', 'policyKey' => '[a-z0-9_]+'])]
+	public function getUserPolicyForUser(string $userId, string $policyKey): DataResponse {
+		$policy = $this->policyService->getUserPreferenceForUserId($policyKey, $userId);
+
+		/** @var LibresignUserPolicyResponse $data */
+		$data = [
+			'policy' => $this->serializeUserPolicy($userId, $policyKey, $policy),
+		];
+
+		return new DataResponse($data);
+	}
+
+	/**
+	 * Save a system-level policy value
+	 *
+	 * @param string $policyKey Policy identifier to persist at the system layer.
+	 * @param null|bool|int|float|string $value Policy value to persist. Null resets the policy to its default system value.
+	 * @param bool $allowChildOverride Whether lower layers may override this system default.
+	 * @return DataResponse<Http::STATUS_OK, LibresignSystemPolicyWriteResponse, array{}>|DataResponse<Http::STATUS_BAD_REQUEST, LibresignErrorResponse, array{}>
+	 *
+	 * 200: OK
+	 * 400: Invalid policy value
+	 */
+	#[ApiRoute(verb: 'POST', url: '/api/{apiVersion}/policies/system/{policyKey}', requirements: ['apiVersion' => '(v1)', 'policyKey' => '[a-z0-9_]+'])]
+	public function setSystem(string $policyKey, null|bool|int|float|string $value = null, bool $allowChildOverride = false): DataResponse {
+		$value = $this->readScalarParam('value', $value);
+		$allowChildOverride = $this->readBoolParam('allowChildOverride', $allowChildOverride);
+
+		try {
+			$policy = $this->policyService->saveSystem($policyKey, $value, $allowChildOverride);
+			/** @var LibresignSystemPolicyWriteResponse $data */
+			$data = [
+				'message' => $this->l10n->t('Settings saved'),
+				'policy' => $policy->toArray(),
+			];
+
+			return new DataResponse($data);
+		} catch (\InvalidArgumentException $exception) {
+			/** @var LibresignErrorResponse $data */
+			$data = [
+				'error' => $this->l10n->t($exception->getMessage()),
+			];
+
+			return new DataResponse($data, Http::STATUS_BAD_REQUEST);
+		}
+	}
+
+	/**
+	 * Save a group-level policy value
+	 *
+	 * @param string $groupId Group identifier that receives the policy binding.
+	 * @param string $policyKey Policy identifier to persist at the group layer.
+	 * @param null|bool|int|float|string $value Policy value to persist for the group.
+	 * @param bool $allowChildOverride Whether users and requests below this group may override the group default.
+	 * @return DataResponse<Http::STATUS_OK, LibresignGroupPolicyWriteResponse, array{}>|DataResponse<Http::STATUS_BAD_REQUEST, LibresignErrorResponse, array{}>|DataResponse<Http::STATUS_FORBIDDEN, LibresignErrorResponse, array{}>
+	 *
+	 * 200: OK
+	 * 400: Invalid policy value
+	 * 403: Forbidden
+	 */
+	#[NoAdminRequired]
+	#[ApiRoute(verb: 'PUT', url: '/api/{apiVersion}/policies/group/{groupId}/{policyKey}', requirements: ['apiVersion' => '(v1)', 'groupId' => '[^/]+', 'policyKey' => '[a-z0-9_]+'])]
+	public function setGroup(string $groupId, string $policyKey, null|bool|int|float|string $value = null, bool $allowChildOverride = false): DataResponse {
+		if (!$this->canManageGroupPolicy($groupId)) {
+			return $this->forbiddenGroupPolicyResponse();
+		}
+
+		$value = $this->readScalarParam('value', $value);
+		$allowChildOverride = $this->readBoolParam('allowChildOverride', $allowChildOverride);
+
+		try {
+			$policy = $this->policyService->saveGroupPolicy($policyKey, $groupId, $value, $allowChildOverride);
+			/** @var LibresignGroupPolicyWriteResponse $data */
+			$data = [
+				'message' => $this->l10n->t('Settings saved'),
+				'policy' => $this->serializeGroupPolicy($groupId, $policyKey, $policy),
+			];
+
+			return new DataResponse($data);
+		} catch (\InvalidArgumentException $exception) {
+			/** @var LibresignErrorResponse $data */
+			$data = [
+				'error' => $this->l10n->t($exception->getMessage()),
+			];
+
+			return new DataResponse($data, Http::STATUS_BAD_REQUEST);
+		}
+	}
+
+	/**
+	 * Clear a group-level policy value
+	 *
+	 * @param string $groupId Group identifier that receives the policy binding.
+	 * @param string $policyKey Policy identifier to clear for the selected group.
+	 * @return DataResponse<Http::STATUS_OK, LibresignGroupPolicyWriteResponse, array{}>|DataResponse<Http::STATUS_FORBIDDEN, LibresignErrorResponse, array{}>
+	 *
+	 * 200: OK
+	 * 403: Forbidden
+	 */
+	#[NoAdminRequired]
+	#[ApiRoute(verb: 'DELETE', url: '/api/{apiVersion}/policies/group/{groupId}/{policyKey}', requirements: ['apiVersion' => '(v1)', 'groupId' => '[^/]+', 'policyKey' => '[a-z0-9_]+'])]
+	public function clearGroup(string $groupId, string $policyKey): DataResponse {
+		if (!$this->canManageGroupPolicy($groupId)) {
+			return $this->forbiddenGroupPolicyResponse();
+		}
+
+		$policy = $this->policyService->clearGroupPolicy($policyKey, $groupId);
+		/** @var LibresignGroupPolicyWriteResponse $data */
+		$data = [
+			'message' => $this->l10n->t('Settings saved'),
+			'policy' => $this->serializeGroupPolicy($groupId, $policyKey, $policy),
+		];
+
+		return new DataResponse($data);
+	}
+
+	/**
+	 * Save a user policy preference
+	 *
+	 * @param string $policyKey Policy identifier to persist for the current user.
+	 * @param null|bool|int|float|string $value Policy value to persist as the current user's default.
+	 * @return DataResponse<Http::STATUS_OK, LibresignSystemPolicyWriteResponse, array{}>|DataResponse<Http::STATUS_BAD_REQUEST, LibresignErrorResponse, array{}>
+	 *
+	 * 200: OK
+	 * 400: Invalid policy value
+	 */
+	#[NoAdminRequired]
+	#[ApiRoute(verb: 'PUT', url: '/api/{apiVersion}/policies/user/{policyKey}', requirements: ['apiVersion' => '(v1)', 'policyKey' => '[a-z0-9_]+'])]
+	public function setUserPreference(string $policyKey, null|bool|int|float|string $value = null): DataResponse {
+		$value = $this->readScalarParam('value', $value);
+
+		try {
+			$policy = $this->policyService->saveUserPreference($policyKey, $value);
+			/** @var LibresignSystemPolicyWriteResponse $data */
+			$data = [
+				'message' => $this->l10n->t('Settings saved'),
+				'policy' => $policy->toArray(),
+			];
+
+			return new DataResponse($data);
+		} catch (\InvalidArgumentException $exception) {
+			/** @var LibresignErrorResponse $data */
+			$data = [
+				'error' => $this->l10n->t($exception->getMessage()),
+			];
+
+			return new DataResponse($data, Http::STATUS_BAD_REQUEST);
+		}
+	}
+
+	/**
+	 * Save a user policy preference for a target user (admin scope)
+	 *
+	 * @param string $userId Target user identifier that receives the policy preference.
+	 * @param string $policyKey Policy identifier to persist for the target user.
+	 * @param null|bool|int|float|string $value Policy value to persist as target user preference.
+	 * @return DataResponse<Http::STATUS_OK, LibresignUserPolicyWriteResponse, array{}>|DataResponse<Http::STATUS_BAD_REQUEST, LibresignErrorResponse, array{}>
+	 *
+	 * 200: OK
+	 * 400: Invalid policy value
+	 */
+	#[ApiRoute(verb: 'PUT', url: '/api/{apiVersion}/policies/user/{userId}/{policyKey}', requirements: ['apiVersion' => '(v1)', 'userId' => '[^/]+', 'policyKey' => '[a-z0-9_]+'])]
+	public function setUserPolicyForUser(string $userId, string $policyKey, null|bool|int|float|string $value = null): DataResponse {
+		$value = $this->readScalarParam('value', $value);
+
+		try {
+			$policy = $this->policyService->saveUserPreferenceForUserId($policyKey, $userId, $value);
+			/** @var LibresignUserPolicyWriteResponse $data */
+			$data = [
+				'message' => $this->l10n->t('Settings saved'),
+				'policy' => $this->serializeUserPolicy($userId, $policyKey, $policy),
+			];
+
+			return new DataResponse($data);
+		} catch (\InvalidArgumentException $exception) {
+			/** @var LibresignErrorResponse $data */
+			$data = [
+				'error' => $this->l10n->t($exception->getMessage()),
+			];
+
+			return new DataResponse($data, Http::STATUS_BAD_REQUEST);
+		}
+	}
+
+	/**
+	 * Clear a user policy preference
+	 *
+	 * @param string $policyKey Policy identifier to clear for the current user.
+	 * @return DataResponse<Http::STATUS_OK, LibresignSystemPolicyWriteResponse, array{}>
+	 *
+	 * 200: OK
+	 */
+	#[NoAdminRequired]
+	#[ApiRoute(verb: 'DELETE', url: '/api/{apiVersion}/policies/user/{policyKey}', requirements: ['apiVersion' => '(v1)', 'policyKey' => '[a-z0-9_]+'])]
+	public function clearUserPreference(string $policyKey): DataResponse {
+		$policy = $this->policyService->clearUserPreference($policyKey);
+		/** @var LibresignSystemPolicyWriteResponse $data */
+		$data = [
+			'message' => $this->l10n->t('Settings saved'),
+			'policy' => $policy->toArray(),
+		];
+
+		return new DataResponse($data);
+	}
+
+	/**
+	 * Clear a user policy preference for a target user (admin scope)
+	 *
+	 * @param string $userId Target user identifier that receives the policy preference removal.
+	 * @param string $policyKey Policy identifier to clear for the target user.
+	 * @return DataResponse<Http::STATUS_OK, LibresignUserPolicyWriteResponse, array{}>
+	 *
+	 * 200: OK
+	 */
+	#[ApiRoute(verb: 'DELETE', url: '/api/{apiVersion}/policies/user/{userId}/{policyKey}', requirements: ['apiVersion' => '(v1)', 'userId' => '[^/]+', 'policyKey' => '[a-z0-9_]+'])]
+	public function clearUserPolicyForUser(string $userId, string $policyKey): DataResponse {
+		$policy = $this->policyService->clearUserPreferenceForUserId($policyKey, $userId);
+		/** @var LibresignUserPolicyWriteResponse $data */
+		$data = [
+			'message' => $this->l10n->t('Settings saved'),
+			'policy' => $this->serializeUserPolicy($userId, $policyKey, $policy),
+		];
+
+		return new DataResponse($data);
+	}
+
+	/** @return LibresignGroupPolicyState */
+	private function serializeGroupPolicy(string $groupId, string $policyKey, ?PolicyLayer $policy): array {
+		return [
+			'policyKey' => $policyKey,
+			'scope' => 'group',
+			'targetId' => $groupId,
+			'value' => $policy?->getValue(),
+			'allowChildOverride' => $policy?->isAllowChildOverride() ?? true,
+			'visibleToChild' => $policy?->isVisibleToChild() ?? true,
+			'allowedValues' => $policy?->getAllowedValues() ?? [],
+		];
+	}
+
+	/** @return LibresignUserPolicyState */
+	private function serializeUserPolicy(string $userId, string $policyKey, ?PolicyLayer $policy): array {
+		return [
+			'policyKey' => $policyKey,
+			'scope' => 'user',
+			'targetId' => $userId,
+			'value' => $policy?->getValue(),
+		];
+	}
+
+	private function canManageGroupPolicy(string $groupId): bool {
+		$user = $this->userSession->getUser();
+		if ($user === null) {
+			return false;
+		}
+
+		if ($this->groupManager->isAdmin($user->getUID())) {
+			return true;
+		}
+
+		$group = $this->groupManager->get($groupId);
+		if ($group === null) {
+			return false;
+		}
+
+		return $this->subAdmin->isSubAdminOfGroup($user, $group);
+	}
+
+	private function readScalarParam(string $key, null|bool|int|float|string $default): null|bool|int|float|string {
+		$value = $this->request->getParams()[$key] ?? $default;
+		if (!is_scalar($value) && $value !== null) {
+			return $default;
+		}
+
+		return $value;
+	}
+
+	private function readBoolParam(string $key, bool $default): bool {
+		$value = $this->request->getParams()[$key] ?? $default;
+		return is_bool($value) ? $value : $default;
+	}
+
+	/** @return DataResponse<Http::STATUS_FORBIDDEN, LibresignErrorResponse, array{}> */
+	private function forbiddenGroupPolicyResponse(): DataResponse {
+		/** @var LibresignErrorResponse $data */
+		$data = [
+			'error' => $this->l10n->t('Not allowed to manage this group policy'),
+		];
+
+		return new DataResponse($data, Http::STATUS_FORBIDDEN);
+	}
+}
diff --git a/lib/Controller/RequestSignatureController.php b/lib/Controller/RequestSignatureController.php
index 0fcc5a6de9..f52612bc5b 100644
--- a/lib/Controller/RequestSignatureController.php
+++ b/lib/Controller/RequestSignatureController.php
@@ -67,7 +67,7 @@ public function __construct(
 	 * @param list<LibresignNewFile> $files Multiple files to create an envelope (optional, use either file or files). Each file supports nodeId, url, base64 or path.
 	 * @param string|null $callback URL that will receive a POST after the document is signed
 	 * @param integer|null $status Numeric code of status * 0 - no signers * 1 - signed * 2 - pending
-	 * @param string|null $signatureFlow Signature flow mode: 'parallel' or 'ordered_numeric'. If not provided, uses global configuration
+	 * @param string|null $signatureFlow Signature flow mode: 'parallel' or 'ordered_numeric'. If not provided, uses the effective policy resolution.
 	 * @return DataResponse<Http::STATUS_OK, LibresignDetailedFileResponse, array{}>|DataResponse<Http::STATUS_UNPROCESSABLE_ENTITY, LibresignMessageResponse|LibresignActionErrorResponse, array{}>
 	 *
 	 * 200: OK
@@ -133,7 +133,7 @@ public function request(
 	 * @param LibresignVisibleElement[]|null $visibleElements Visible elements on document
 	 * @param LibresignNewFile|array<empty>|null $file File object. Supports nodeId, url, base64 or path when creating a new request.
 	 * @param integer|null $status Numeric code of status * 0 - no signers * 1 - signed * 2 - pending
-	 * @param string|null $signatureFlow Signature flow mode: 'parallel' or 'ordered_numeric'. If not provided, uses global configuration
+	 * @param string|null $signatureFlow Signature flow mode: 'parallel' or 'ordered_numeric'. If not provided, uses the effective policy resolution.
 	 * @param string|null $name The name of file to sign
 	 * @param LibresignFolderSettings $settings Settings to define how and where the file should be stored
 	 * @param list<LibresignNewFile> $files Multiple files to create an envelope (optional, use either file or files). Each file supports nodeId, url, base64 or path.
diff --git a/lib/Db/PermissionSet.php b/lib/Db/PermissionSet.php
new file mode 100644
index 0000000000..7b1c7b1cfc
--- /dev/null
+++ b/lib/Db/PermissionSet.php
@@ -0,0 +1,108 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Libresign\Db;
+
+use OCP\AppFramework\Db\Entity;
+use OCP\DB\Types;
+
+use function json_decode;
+use function json_encode;
+
+/**
+ * @method void setId(int $id)
+ * @method int getId()
+ * @method void setName(string $name)
+ * @method string getName()
+ * @method void setDescription(?string $description)
+ * @method ?string getDescription()
+ * @method void setScopeType(string $scopeType)
+ * @method string getScopeType()
+ * @method void setEnabled(int $enabled)
+ * @method void setPriority(int $priority)
+ * @method int getPriority()
+ * @method void setCreatedAt(\DateTime|string $createdAt)
+ * @method ?\DateTime getCreatedAt()
+ * @method void setUpdatedAt(\DateTime|string $updatedAt)
+ * @method ?\DateTime getUpdatedAt()
+ */
+class PermissionSet extends Entity {
+	protected string $name = '';
+	protected ?string $description = null;
+	protected string $scopeType = 'organization';
+	protected int $enabled = 1;
+	protected int $priority = 0;
+	protected string $policyJson = '{}';
+	protected ?\DateTime $createdAt = null;
+	protected ?\DateTime $updatedAt = null;
+
+	public function __construct() {
+		$this->addType('id', Types::INTEGER);
+		$this->addType('name', Types::STRING);
+		$this->addType('description', Types::TEXT);
+		$this->addType('scopeType', Types::STRING);
+		$this->addType('enabled', Types::SMALLINT);
+		$this->addType('priority', Types::SMALLINT);
+		$this->addType('policyJson', Types::TEXT);
+		$this->addType('createdAt', Types::DATETIME);
+		$this->addType('updatedAt', Types::DATETIME);
+	}
+
+	public function isEnabled(): bool {
+		return $this->enabled === 1;
+	}
+
+	public function setEnabled(bool $enabled): void {
+		$this->setter('enabled', [$enabled ? 1 : 0]);
+	}
+
+	/**
+	 * @param array<string, mixed> $policyJson
+	 */
+	public function setPolicyJson(array $policyJson): void {
+		$this->setter('policyJson', [json_encode($policyJson, JSON_THROW_ON_ERROR)]);
+	}
+
+	/**
+	 * @return array<string, mixed>
+	 */
+	public function getDecodedPolicyJson(): array {
+		$decoded = json_decode($this->policyJson, true);
+		return is_array($decoded) ? $decoded : [];
+	}
+
+	/**
+	 * @param \DateTime|string $createdAt
+	 */
+	public function setCreatedAt($createdAt): void {
+		if (!$createdAt instanceof \DateTime) {
+			$createdAt = new \DateTime($createdAt, new \DateTimeZone('UTC'));
+		}
+		$this->createdAt = $createdAt;
+		$this->markFieldUpdated('createdAt');
+	}
+
+	public function getCreatedAt(): ?\DateTime {
+		return $this->createdAt;
+	}
+
+	/**
+	 * @param \DateTime|string $updatedAt
+	 */
+	public function setUpdatedAt($updatedAt): void {
+		if (!$updatedAt instanceof \DateTime) {
+			$updatedAt = new \DateTime($updatedAt, new \DateTimeZone('UTC'));
+		}
+		$this->updatedAt = $updatedAt;
+		$this->markFieldUpdated('updatedAt');
+	}
+
+	public function getUpdatedAt(): ?\DateTime {
+		return $this->updatedAt;
+	}
+}
diff --git a/lib/Db/PermissionSetBinding.php b/lib/Db/PermissionSetBinding.php
new file mode 100644
index 0000000000..f760af1b46
--- /dev/null
+++ b/lib/Db/PermissionSetBinding.php
@@ -0,0 +1,52 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Libresign\Db;
+
+use OCP\AppFramework\Db\Entity;
+use OCP\DB\Types;
+
+/**
+ * @method void setId(int $id)
+ * @method int getId()
+ * @method void setPermissionSetId(int $permissionSetId)
+ * @method int getPermissionSetId()
+ * @method void setTargetType(string $targetType)
+ * @method string getTargetType()
+ * @method void setTargetId(string $targetId)
+ * @method string getTargetId()
+ */
+class PermissionSetBinding extends Entity {
+	protected int $permissionSetId = 0;
+	protected string $targetType = '';
+	protected string $targetId = '';
+	protected ?\DateTime $createdAt = null;
+
+	public function __construct() {
+		$this->addType('id', Types::INTEGER);
+		$this->addType('permissionSetId', Types::INTEGER);
+		$this->addType('targetType', Types::STRING);
+		$this->addType('targetId', Types::STRING);
+		$this->addType('createdAt', Types::DATETIME);
+	}
+
+	/**
+	 * @param \DateTime|string $createdAt
+	 */
+	public function setCreatedAt($createdAt): void {
+		if (!$createdAt instanceof \DateTime) {
+			$createdAt = new \DateTime($createdAt, new \DateTimeZone('UTC'));
+		}
+		$this->createdAt = $createdAt;
+		$this->markFieldUpdated('createdAt');
+	}
+
+	public function getCreatedAt(): ?\DateTime {
+		return $this->createdAt;
+	}
+}
diff --git a/lib/Db/PermissionSetBindingMapper.php b/lib/Db/PermissionSetBindingMapper.php
new file mode 100644
index 0000000000..e2363b9bb6
--- /dev/null
+++ b/lib/Db/PermissionSetBindingMapper.php
@@ -0,0 +1,83 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Libresign\Db;
+
+use OCP\AppFramework\Db\DoesNotExistException;
+use OCP\DB\QueryBuilder\IQueryBuilder;
+use OCP\ICacheFactory;
+use OCP\IDBConnection;
+
+/**
+ * @template-extends CachedQBMapper<PermissionSetBinding>
+ */
+class PermissionSetBindingMapper extends CachedQBMapper {
+	public function __construct(IDBConnection $db, ICacheFactory $cacheFactory) {
+		parent::__construct($db, $cacheFactory, 'libresign_permission_set_binding');
+	}
+
+	/**
+	 * @throws DoesNotExistException
+	 */
+	public function getById(int $id): PermissionSetBinding {
+		$cached = $this->cacheGet('id:' . $id);
+		if ($cached instanceof PermissionSetBinding) {
+			return $cached;
+		}
+
+		$qb = $this->db->getQueryBuilder();
+		$qb->select('*')
+			->from($this->getTableName())
+			->where($qb->expr()->eq('id', $qb->createNamedParameter($id, IQueryBuilder::PARAM_INT)));
+
+		/** @var PermissionSetBinding */
+		$entity = $this->findEntity($qb);
+		$this->cacheEntity($entity);
+		return $entity;
+	}
+
+	/**
+	 * @throws DoesNotExistException
+	 */
+	public function getByTarget(string $targetType, string $targetId): PermissionSetBinding {
+		$qb = $this->db->getQueryBuilder();
+		$qb->select('*')
+			->from($this->getTableName())
+			->where($qb->expr()->eq('target_type', $qb->createNamedParameter($targetType)))
+			->andWhere($qb->expr()->eq('target_id', $qb->createNamedParameter($targetId)));
+
+		/** @var PermissionSetBinding */
+		$entity = $this->findEntity($qb);
+		$this->cacheEntity($entity);
+		return $entity;
+	}
+
+	/**
+	 * @param list<string> $targetIds
+	 * @return list<PermissionSetBinding>
+	 */
+	public function findByTargets(string $targetType, array $targetIds): array {
+		if ($targetIds === []) {
+			return [];
+		}
+
+		$qb = $this->db->getQueryBuilder();
+		$qb->select('*')
+			->from($this->getTableName())
+			->where($qb->expr()->eq('target_type', $qb->createNamedParameter($targetType)))
+			->andWhere($qb->expr()->in('target_id', $qb->createNamedParameter($targetIds, IQueryBuilder::PARAM_STR_ARRAY)));
+
+		/** @var list<PermissionSetBinding> */
+		$entities = $this->findEntities($qb);
+		foreach ($entities as $entity) {
+			$this->cacheEntity($entity);
+		}
+
+		return $entities;
+	}
+}
diff --git a/lib/Db/PermissionSetMapper.php b/lib/Db/PermissionSetMapper.php
new file mode 100644
index 0000000000..bafa288eb2
--- /dev/null
+++ b/lib/Db/PermissionSetMapper.php
@@ -0,0 +1,66 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Libresign\Db;
+
+use OCP\AppFramework\Db\DoesNotExistException;
+use OCP\DB\QueryBuilder\IQueryBuilder;
+use OCP\ICacheFactory;
+use OCP\IDBConnection;
+
+/**
+ * @template-extends CachedQBMapper<PermissionSet>
+ */
+class PermissionSetMapper extends CachedQBMapper {
+	public function __construct(IDBConnection $db, ICacheFactory $cacheFactory) {
+		parent::__construct($db, $cacheFactory, 'libresign_permission_set');
+	}
+
+	/**
+	 * @throws DoesNotExistException
+	 */
+	public function getById(int $id): PermissionSet {
+		$cached = $this->cacheGet('id:' . $id);
+		if ($cached instanceof PermissionSet) {
+			return $cached;
+		}
+
+		$qb = $this->db->getQueryBuilder();
+		$qb->select('*')
+			->from($this->getTableName())
+			->where($qb->expr()->eq('id', $qb->createNamedParameter($id, IQueryBuilder::PARAM_INT)));
+
+		/** @var PermissionSet */
+		$entity = $this->findEntity($qb);
+		$this->cacheEntity($entity);
+		return $entity;
+	}
+
+	/**
+	 * @param list<int> $ids
+	 * @return list<PermissionSet>
+	 */
+	public function findByIds(array $ids): array {
+		if ($ids === []) {
+			return [];
+		}
+
+		$qb = $this->db->getQueryBuilder();
+		$qb->select('*')
+			->from($this->getTableName())
+			->where($qb->expr()->in('id', $qb->createNamedParameter($ids, IQueryBuilder::PARAM_INT_ARRAY)));
+
+		/** @var list<PermissionSet> */
+		$entities = $this->findEntities($qb);
+		foreach ($entities as $entity) {
+			$this->cacheEntity($entity);
+		}
+
+		return $entities;
+	}
+}
diff --git a/lib/Files/TemplateLoader.php b/lib/Files/TemplateLoader.php
index 7d3c8e3d1f..425ce46316 100644
--- a/lib/Files/TemplateLoader.php
+++ b/lib/Files/TemplateLoader.php
@@ -16,11 +16,11 @@
 use OCA\Libresign\Service\AccountService;
 use OCA\Libresign\Service\DocMdp\ConfigService;
 use OCA\Libresign\Service\IdentifyMethodService;
+use OCA\Libresign\Service\Policy\PolicyService;
 use OCP\App\IAppManager;
 use OCP\AppFramework\Services\IInitialState;
 use OCP\EventDispatcher\Event;
 use OCP\EventDispatcher\IEventListener;
-use OCP\IAppConfig;
 use OCP\IRequest;
 use OCP\IUserSession;
 use OCP\Util;
@@ -37,7 +37,7 @@ public function __construct(
 		private ValidateHelper $validateHelper,
 		private IdentifyMethodService $identifyMethodService,
 		private CertificateEngineFactory $certificateEngineFactory,
-		private IAppConfig $appConfig,
+		private PolicyService $policyService,
 		private IAppManager $appManager,
 		private ConfigService $docMdpConfigService,
 	) {
@@ -63,23 +63,22 @@ public function handle(Event $event): void {
 	}
 
 	protected function getInitialStatePayload(): array {
+		$resolvedPolicies = [];
+		foreach ($this->policyService->resolveKnownPolicies() as $policyKey => $resolvedPolicy) {
+			$resolvedPolicies[$policyKey] = $resolvedPolicy->toArray();
+		}
+
 		return [
 			'certificate_ok' => $this->certificateEngineFactory->getEngine()->isSetupOk(),
 			'identify_methods' => $this->identifyMethodService->getIdentifyMethodsSettings(),
-			'signature_flow' => $this->getSignatureFlow(),
+			'effective_policies' => [
+				'policies' => $resolvedPolicies,
+			],
 			'docmdp_config' => $this->docMdpConfigService->getConfig(),
 			'can_request_sign' => $this->canRequestSign(),
 		];
 	}
 
-	private function getSignatureFlow(): string {
-		return $this->appConfig->getValueString(
-			Application::APP_ID,
-			'signature_flow',
-			\OCA\Libresign\Enum\SignatureFlow::NONE->value
-		);
-	}
-
 	private function canRequestSign(): bool {
 		try {
 			$this->validateHelper->canRequestSign($this->userSession->getUser());
diff --git a/lib/Handler/FooterHandler.php b/lib/Handler/FooterHandler.php
index fd5ea2c882..7019454a84 100644
--- a/lib/Handler/FooterHandler.php
+++ b/lib/Handler/FooterHandler.php
@@ -12,6 +12,9 @@
 use OCA\Libresign\Db\File as FileEntity;
 use OCA\Libresign\Exception\LibresignException;
 use OCA\Libresign\Service\File\Pdf\PdfMetadataExtractor;
+use OCA\Libresign\Service\Policy\PolicyService;
+use OCA\Libresign\Service\Policy\Provider\Footer\AddFooterPolicy;
+use OCA\Libresign\Service\Policy\Provider\Footer\SignatureFooterPolicyValue;
 use OCA\Libresign\Vendor\Endroid\QrCode\Color\Color;
 use OCA\Libresign\Vendor\Endroid\QrCode\Encoding\Encoding;
 use OCA\Libresign\Vendor\Endroid\QrCode\ErrorCorrectionLevel;
@@ -41,17 +44,17 @@ public function __construct(
 		private IL10N $l10n,
 		private IFactory $l10nFactory,
 		private ITempManager $tempManager,
+		private PolicyService $policyService,
 		private TemplateVariables $templateVars,
 	) {
 	}
 
-	public function getFooter(array $dimensions): string {
-		$add_footer = (bool)$this->appConfig->getValueBool(Application::APP_ID, 'add_footer', true);
-		if (!$add_footer) {
+	public function getFooter(array $dimensions, bool $forceEnabled = false): string {
+		if (!$forceEnabled && !$this->isFooterEnabled()) {
 			return '';
 		}
 
-		$htmlFooter = $this->getRenderedHtmlFooter();
+		$htmlFooter = $this->getRenderedHtmlFooter($forceEnabled);
 		foreach ($dimensions as $dimension) {
 			if (!isset($pdf)) {
 				$pdf = new Mpdf([
@@ -94,14 +97,14 @@ public function getMetadata(File $file, FileEntity $fileEntity): array {
 		return $metadata;
 	}
 
-	private function getRenderedHtmlFooter(): string {
+	private function getRenderedHtmlFooter(bool $forceEnabled = false): string {
 		try {
 			$twigEnvironment = new Environment(
 				new FilesystemLoader(),
 			);
 			return $twigEnvironment
 				->createTemplate($this->getTemplate())
-				->render($this->prepareTemplateVars());
+				->render($this->prepareTemplateVars($forceEnabled));
 		} catch (SyntaxError $e) {
 			throw new LibresignException($e->getMessage());
 		}
@@ -112,7 +115,11 @@ public function setTemplateVar(string $name, mixed $value): self {
 		return $this;
 	}
 
-	private function prepareTemplateVars(): array {
+	private function prepareTemplateVars(bool $forceEnabled = false): array {
+		$footerPolicy = SignatureFooterPolicyValue::normalize(
+			$this->policyService->resolve(AddFooterPolicy::KEY)->getEffectiveValue()
+		);
+
 		if (!$this->templateVars->getSignedBy()) {
 			$this->templateVars->setSignedBy(
 				$this->appConfig->getValueString(Application::APP_ID, 'footer_signed_by', $this->l10n->t('Digitally signed by LibreSign.'))
@@ -132,7 +139,9 @@ private function prepareTemplateVars(): array {
 		}
 
 		if (!$this->templateVars->getValidationSite() && $this->templateVars->getUuid()) {
-			$validationSite = $this->appConfig->getValueString(Application::APP_ID, 'validation_site');
+			$validationSite = $footerPolicy['validationSite'] !== ''
+				? $footerPolicy['validationSite']
+				: $this->appConfig->getValueString(Application::APP_ID, 'validation_site');
 			if ($validationSite) {
 				$this->templateVars->setValidationSite(
 					rtrim($validationSite, '/') . '/' . $this->templateVars->getUuid()
@@ -155,7 +164,7 @@ private function prepareTemplateVars(): array {
 			}
 		}
 
-		if ($this->appConfig->getValueBool(Application::APP_ID, 'write_qrcode_on_footer', true) && $this->templateVars->getValidationSite()) {
+		if ($footerPolicy['writeQrcodeOnFooter'] && $this->templateVars->getValidationSite()) {
 			$this->templateVars->setQrcode($this->getQrCodeImageBase64($this->templateVars->getValidationSite()));
 		}
 
@@ -204,4 +213,10 @@ private function getQrCodeImageBase64(string $text): string {
 	public function getTemplateVariablesMetadata(): array {
 		return $this->templateVars->getVariablesMetadata();
 	}
+
+	private function isFooterEnabled(): bool {
+		return SignatureFooterPolicyValue::isEnabled(
+			$this->policyService->resolve(AddFooterPolicy::KEY)->getEffectiveValue()
+		);
+	}
 }
diff --git a/lib/Migration/Version18000Date20260317000000.php b/lib/Migration/Version18000Date20260317000000.php
new file mode 100644
index 0000000000..a06a974ee0
--- /dev/null
+++ b/lib/Migration/Version18000Date20260317000000.php
@@ -0,0 +1,100 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Libresign\Migration;
+
+use Closure;
+use OCP\DB\ISchemaWrapper;
+use OCP\DB\Types;
+use OCP\Migration\IOutput;
+use OCP\Migration\SimpleMigrationStep;
+
+class Version18000Date20260317000000 extends SimpleMigrationStep {
+	/**
+	 * @param Closure(): ISchemaWrapper $schemaClosure
+	 */
+	#[\Override]
+	public function changeSchema(IOutput $output, Closure $schemaClosure, array $options): ?ISchemaWrapper {
+		/** @var ISchemaWrapper $schema */
+		$schema = $schemaClosure();
+
+		if ($schema->hasTable('libresign_permission_set')) {
+			$permissionSetTable = $schema->getTable('libresign_permission_set');
+		} else {
+			$permissionSetTable = $schema->createTable('libresign_permission_set');
+			$permissionSetTable->addColumn('id', Types::INTEGER, [
+				'autoincrement' => true,
+				'notnull' => true,
+				'unsigned' => true,
+			]);
+			$permissionSetTable->addColumn('name', Types::STRING, [
+				'notnull' => true,
+				'length' => 255,
+			]);
+			$permissionSetTable->addColumn('description', Types::TEXT, [
+				'notnull' => false,
+			]);
+			$permissionSetTable->addColumn('scope_type', Types::STRING, [
+				'notnull' => true,
+				'length' => 64,
+			]);
+			$permissionSetTable->addColumn('enabled', Types::SMALLINT, [
+				'notnull' => true,
+				'default' => 1,
+			]);
+			$permissionSetTable->addColumn('priority', Types::SMALLINT, [
+				'notnull' => true,
+				'default' => 0,
+			]);
+			$permissionSetTable->addColumn('policy_json', Types::TEXT, [
+				'notnull' => true,
+				'default' => '{}',
+			]);
+			$permissionSetTable->addColumn('created_at', Types::DATETIME, [
+				'notnull' => true,
+			]);
+			$permissionSetTable->addColumn('updated_at', Types::DATETIME, [
+				'notnull' => true,
+			]);
+			$permissionSetTable->setPrimaryKey(['id']);
+			$permissionSetTable->addIndex(['scope_type'], 'ls_perm_set_scope_idx');
+		}
+
+		if (!$schema->hasTable('libresign_permission_set_binding')) {
+			$table = $schema->createTable('libresign_permission_set_binding');
+			$table->addColumn('id', Types::INTEGER, [
+				'autoincrement' => true,
+				'notnull' => true,
+				'unsigned' => true,
+			]);
+			$table->addColumn('permission_set_id', Types::INTEGER, [
+				'notnull' => true,
+				'unsigned' => true,
+			]);
+			$table->addColumn('target_type', Types::STRING, [
+				'notnull' => true,
+				'length' => 64,
+			]);
+			$table->addColumn('target_id', Types::STRING, [
+				'notnull' => true,
+				'length' => 255,
+			]);
+			$table->addColumn('created_at', Types::DATETIME, [
+				'notnull' => true,
+			]);
+			$table->setPrimaryKey(['id']);
+			$table->addIndex(['permission_set_id'], 'ls_perm_bind_set_idx');
+			$table->addUniqueIndex(['target_type', 'target_id'], 'ls_perm_bind_target_uidx');
+			$table->addForeignKeyConstraint($permissionSetTable, ['permission_set_id'], ['id'], [
+				'onDelete' => 'CASCADE',
+			]);
+		}
+
+		return $schema;
+	}
+}
diff --git a/lib/Migration/Version18001Date20260320000000.php b/lib/Migration/Version18001Date20260320000000.php
new file mode 100644
index 0000000000..1c646acf67
--- /dev/null
+++ b/lib/Migration/Version18001Date20260320000000.php
@@ -0,0 +1,95 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Libresign\Migration;
+
+use Closure;
+use OCA\Libresign\AppInfo\Application;
+use OCA\Libresign\Service\Policy\Provider\DocMdp\DocMdpPolicy;
+use OCA\Libresign\Service\Policy\Provider\Signature\SignatureFlowPolicy;
+use OCP\DB\ISchemaWrapper;
+use OCP\Exceptions\AppConfigTypeConflictException;
+use OCP\IAppConfig;
+use OCP\Migration\IOutput;
+use OCP\Migration\SimpleMigrationStep;
+
+class Version18001Date20260320000000 extends SimpleMigrationStep {
+	private const APP_ID = Application::APP_ID;
+	private const EMPTY_STRING = '';
+	private const IDENTIFY_METHODS_KEY = 'identify_methods';
+	private const LEGACY_SYSTEM_KEY = SignatureFlowPolicy::KEY;
+
+	public function __construct(
+		private IAppConfig $appConfig,
+	) {
+	}
+
+	#[\Override]
+	public function preSchemaChange(IOutput $output, Closure $schemaClosure, array $options): void {
+		$this->migrateSignatureFlowKeys();
+		$this->migrateDocMdpLevelType();
+		$this->migrateIdentifyMethodsType();
+	}
+
+	private function migrateSignatureFlowKeys(): void {
+		$newSystemKey = SignatureFlowPolicy::SYSTEM_APP_CONFIG_KEY;
+
+		$this->copyStringValueWhenDestinationEmpty(self::LEGACY_SYSTEM_KEY, $newSystemKey);
+
+		$this->appConfig->deleteKey(self::APP_ID, self::LEGACY_SYSTEM_KEY);
+	}
+
+	private function migrateDocMdpLevelType(): void {
+		$legacyValue = $this->readLegacyString(DocMdpPolicy::SYSTEM_APP_CONFIG_KEY);
+		if ($legacyValue === null || $legacyValue === self::EMPTY_STRING || !is_numeric($legacyValue)) {
+			return;
+		}
+
+		$this->appConfig->deleteKey(self::APP_ID, DocMdpPolicy::SYSTEM_APP_CONFIG_KEY);
+		$this->appConfig->setValueInt(self::APP_ID, DocMdpPolicy::SYSTEM_APP_CONFIG_KEY, (int)$legacyValue);
+	}
+
+	private function migrateIdentifyMethodsType(): void {
+		$legacyValue = $this->readLegacyString(self::IDENTIFY_METHODS_KEY);
+		if ($legacyValue === null || $legacyValue === self::EMPTY_STRING) {
+			return;
+		}
+
+		$this->appConfig->deleteKey(self::APP_ID, self::IDENTIFY_METHODS_KEY);
+		$decoded = json_decode($legacyValue, true);
+		if (!is_array($decoded)) {
+			return;
+		}
+
+		$this->appConfig->setValueArray(self::APP_ID, self::IDENTIFY_METHODS_KEY, $decoded);
+	}
+
+	private function copyStringValueWhenDestinationEmpty(string $sourceKey, string $destinationKey): void {
+		$sourceValue = $this->appConfig->getValueString(self::APP_ID, $sourceKey, self::EMPTY_STRING);
+		$destinationValue = $this->appConfig->getValueString(self::APP_ID, $destinationKey, self::EMPTY_STRING);
+		if ($sourceValue === self::EMPTY_STRING || $destinationValue !== self::EMPTY_STRING) {
+			return;
+		}
+
+		$this->appConfig->setValueString(self::APP_ID, $destinationKey, $sourceValue);
+	}
+
+	private function readLegacyString(string $key): ?string {
+		try {
+			return $this->appConfig->getValueString(self::APP_ID, $key, self::EMPTY_STRING);
+		} catch (AppConfigTypeConflictException) {
+			// The key is already stored in the target typed format
+			return null;
+		}
+	}
+
+	#[\Override]
+	public function changeSchema(IOutput $output, Closure $schemaClosure, array $options): ?ISchemaWrapper {
+		return null;
+	}
+}
diff --git a/lib/Migration/Version18002Date20260410000000.php b/lib/Migration/Version18002Date20260410000000.php
new file mode 100644
index 0000000000..3824adcaab
--- /dev/null
+++ b/lib/Migration/Version18002Date20260410000000.php
@@ -0,0 +1,127 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Libresign\Migration;
+
+use Closure;
+use OCA\Libresign\AppInfo\Application;
+use OCA\Libresign\Service\Policy\Provider\Footer\SignatureFooterPolicyValue;
+use OCP\DB\ISchemaWrapper;
+use OCP\Exceptions\AppConfigTypeConflictException;
+use OCP\IAppConfig;
+use OCP\Migration\IOutput;
+use OCP\Migration\SimpleMigrationStep;
+
+class Version18002Date20260410000000 extends SimpleMigrationStep {
+	private const APP_ID = Application::APP_ID;
+
+	public function __construct(
+		private IAppConfig $appConfig,
+	) {
+	}
+
+	#[\Override]
+	public function preSchemaChange(IOutput $output, Closure $schemaClosure, array $options): void {
+		$this->migrateLegacyFooterSettings();
+	}
+
+	private function migrateLegacyFooterSettings(): void {
+		$legacyAddFooter = $this->readLegacyValue('add_footer');
+		$legacyWriteQrCodeOnFooter = $this->readLegacyBool('write_qrcode_on_footer', true);
+		$legacyValidationSite = $this->readLegacyString('validation_site', '');
+		$legacyFooterTemplateIsDefault = $this->readLegacyBool('footer_template_is_default', true);
+
+		$rawFooterPolicyValue = $legacyAddFooter;
+		if (!$this->isStructuredFooterPayload($legacyAddFooter)) {
+			$rawFooterPolicyValue = [
+				'enabled' => $this->toBool($legacyAddFooter, true),
+				'writeQrcodeOnFooter' => $legacyWriteQrCodeOnFooter,
+				'validationSite' => $legacyValidationSite,
+				'customizeFooterTemplate' => !$legacyFooterTemplateIsDefault,
+			];
+		}
+
+		$encodedFooterPolicyValue = SignatureFooterPolicyValue::encode(
+			SignatureFooterPolicyValue::normalize($rawFooterPolicyValue),
+		);
+
+		$this->appConfig->deleteKey(self::APP_ID, 'add_footer');
+		$this->appConfig->setValueString(self::APP_ID, 'add_footer', $encodedFooterPolicyValue);
+	}
+
+	private function isStructuredFooterPayload(mixed $value): bool {
+		if (!is_string($value)) {
+			return false;
+		}
+
+		$decoded = json_decode($value, true);
+		if (!is_array($decoded)) {
+			return false;
+		}
+
+		return array_key_exists('enabled', $decoded)
+			|| array_key_exists('writeQrcodeOnFooter', $decoded)
+			|| array_key_exists('validationSite', $decoded)
+			|| array_key_exists('customizeFooterTemplate', $decoded);
+	}
+
+	private function readLegacyValue(string $key): mixed {
+		try {
+			return $this->appConfig->getValueString(self::APP_ID, $key, '');
+		} catch (AppConfigTypeConflictException) {
+			return $this->appConfig->getValueBool(self::APP_ID, $key, true);
+		}
+	}
+
+	private function readLegacyBool(string $key, bool $default): bool {
+		try {
+			$rawValue = $this->appConfig->getValueString(self::APP_ID, $key, '');
+			if ($rawValue === '') {
+				return $default;
+			}
+
+			return in_array(strtolower(trim($rawValue)), ['1', 'true', 'yes', 'on'], true);
+		} catch (AppConfigTypeConflictException) {
+			return $this->appConfig->getValueBool(self::APP_ID, $key, $default);
+		}
+	}
+
+	private function readLegacyString(string $key, string $default): string {
+		try {
+			return trim($this->appConfig->getValueString(self::APP_ID, $key, $default));
+		} catch (AppConfigTypeConflictException) {
+			return $default;
+		}
+	}
+
+	private function toBool(mixed $value, bool $default): bool {
+		if (is_bool($value)) {
+			return $value;
+		}
+
+		if (is_int($value)) {
+			return $value === 1;
+		}
+
+		if (is_string($value)) {
+			$trimmed = trim($value);
+			if ($trimmed === '') {
+				return $default;
+			}
+
+			return in_array(strtolower($trimmed), ['1', 'true', 'yes', 'on'], true);
+		}
+
+		return $default;
+	}
+
+	#[\Override]
+	public function changeSchema(IOutput $output, Closure $schemaClosure, array $options): ?ISchemaWrapper {
+		return null;
+	}
+}
diff --git a/lib/ResponseDefinitions.php b/lib/ResponseDefinitions.php
index cb386d9f76..b037ffe763 100644
--- a/lib/ResponseDefinitions.php
+++ b/lib/ResponseDefinitions.php
@@ -354,11 +354,85 @@
  *
  * Validation and progress contracts
  *
+ * @psalm-type LibresignEffectivePolicyValue = null|bool|int|float|string
+ * @psalm-type LibresignEffectivePolicyState = array{
+ *     policyKey: string,
+ *     effectiveValue: LibresignEffectivePolicyValue,
+ *     sourceScope: string,
+ *     visible: bool,
+ *     editableByCurrentActor: bool,
+ *     allowedValues: list<LibresignEffectivePolicyValue>,
+ *     canSaveAsUserDefault: bool,
+ *     canUseAsRequestOverride: bool,
+ *     preferenceWasCleared: bool,
+ *     blockedBy: ?string,
+ * }
+ * @psalm-type LibresignEffectivePolicyResponse = array{
+ *     policy: LibresignEffectivePolicyState,
+ * }
+ * @psalm-type LibresignEffectivePoliciesResponse = array{
+ *     policies: array<string, LibresignEffectivePolicyState>,
+ * }
+ * @psalm-type LibresignSystemPolicyWriteRequest = array{
+ *     value: LibresignEffectivePolicyValue,
+ * }
+ * @psalm-type LibresignGroupPolicyState = array{
+ *     policyKey: string,
+ *     scope: 'group',
+ *     targetId: string,
+ *     value: null|LibresignEffectivePolicyValue,
+ *     allowChildOverride: bool,
+ *     visibleToChild: bool,
+ *     allowedValues: list<LibresignEffectivePolicyValue>,
+ * }
+ * @psalm-type LibresignGroupPolicyResponse = array{
+ *     policy: LibresignGroupPolicyState,
+ * }
+ * @psalm-type LibresignGroupPolicyWriteRequest = array{
+ *     value: LibresignEffectivePolicyValue,
+ *     allowChildOverride: bool,
+ * }
+ * @psalm-type LibresignSystemPolicyState = array{
+ *     policyKey: string,
+ *     scope: 'system'|'global',
+ *     value: null|LibresignEffectivePolicyValue,
+ *     allowChildOverride: bool,
+ *     visibleToChild: bool,
+ *     allowedValues: list<LibresignEffectivePolicyValue>,
+ * }
+ * @psalm-type LibresignSystemPolicyResponse = array{
+ *     policy: LibresignSystemPolicyState,
+ * }
+ * @psalm-type LibresignUserPolicyState = array{
+ *     policyKey: string,
+ *     scope: 'user',
+ *     targetId: string,
+ *     value: null|LibresignEffectivePolicyValue,
+ * }
+ * @psalm-type LibresignUserPolicyResponse = array{
+ *     policy: LibresignUserPolicyState,
+ * }
+ * @psalm-type LibresignGroupPolicyWriteResponse = LibresignMessageResponse&LibresignGroupPolicyResponse
+ * @psalm-type LibresignSystemPolicyWriteResponse = LibresignMessageResponse&LibresignEffectivePolicyResponse
+ * @psalm-type LibresignUserPolicyWriteResponse = LibresignMessageResponse&LibresignUserPolicyResponse
+ * @psalm-type LibresignPolicySnapshotEntry = array{
+ *     effectiveValue: string,
+ *     sourceScope: string,
+ * }
+ * @psalm-type LibresignPolicySnapshotNumericEntry = array{
+ *     effectiveValue: int,
+ *     sourceScope: string,
+ * }
+ * @psalm-type LibresignValidatePolicySnapshot = array{
+ *     docmdp?: LibresignPolicySnapshotNumericEntry,
+ *     signature_flow?: LibresignPolicySnapshotEntry,
+ * }
  * @psalm-type LibresignValidateMetadata = array{
  *     extension: string,
  *     p: int,
  *     d?: list<array{w: float, h: float}>,
  *     original_file_deleted?: bool,
+ *     policy_snapshot?: LibresignValidatePolicySnapshot,
  *     pdfVersion?: string,
  *     status_changed_at?: string,
  * }
diff --git a/lib/Service/AccountService.php b/lib/Service/AccountService.php
index f721938150..30eed63ec9 100644
--- a/lib/Service/AccountService.php
+++ b/lib/Service/AccountService.php
@@ -36,6 +36,7 @@
 use OCP\Files\IMimeTypeDetector;
 use OCP\Files\IRootFolder;
 use OCP\Files\NotFoundException;
+use OCP\Group\ISubAdmin;
 use OCP\Http\Client\IClientService;
 use OCP\IAppConfig;
 use OCP\IGroupManager;
@@ -73,6 +74,7 @@ public function __construct(
 		private IURLGenerator $urlGenerator,
 		private Pkcs12Handler $pkcs12Handler,
 		private IGroupManager $groupManager,
+		private ISubAdmin $subAdmin,
 		private IdDocsService $idDocsService,
 		private SignerElementsService $signerElementsService,
 		private UserElementMapper $userElementMapper,
@@ -207,8 +209,11 @@ public function getConfig(?IUser $user = null): array {
 		$info['files_list_signer_identify_tab'] = $this->getUserConfigByKey('files_list_signer_identify_tab', $user);
 		$info['files_list_sorting_mode'] = $this->getUserConfigByKey('files_list_sorting_mode', $user) ?: 'name';
 		$info['files_list_sorting_direction'] = $this->getUserConfigByKey('files_list_sorting_direction', $user) ?: 'asc';
+		$info['policy_workbench_catalog_compact_view'] = $this->getUserConfigByKey('policy_workbench_catalog_compact_view', $user) === '1';
+		$info['can_manage_group_policies'] = $user !== null
+			&& ($this->groupManager->isAdmin($user->getUID()) || $this->subAdmin->isSubAdmin($user));
 
-		return array_filter($info);
+		return array_filter($info, static fn (mixed $value): bool => $value !== null && $value !== '');
 	}
 
 	public function getConfigFilters(?IUser $user = null): array {
diff --git a/lib/Service/DocMdp/ConfigService.php b/lib/Service/DocMdp/ConfigService.php
index 39e0689d99..d25c8b7e72 100644
--- a/lib/Service/DocMdp/ConfigService.php
+++ b/lib/Service/DocMdp/ConfigService.php
@@ -20,6 +20,7 @@
  */
 class ConfigService {
 	private const CONFIG_KEY_LEVEL = 'docmdp_level';
+	private const DEFAULT_LEVEL = DocMdpLevel::CERTIFIED_FORM_FILLING;
 
 	public function __construct(
 		private IAppConfig $appConfig,
@@ -43,8 +44,8 @@ public function setEnabled(bool $enabled): void {
 	}
 
 	public function getLevel(): DocMdpLevel {
-		$level = $this->appConfig->getValueInt(Application::APP_ID, self::CONFIG_KEY_LEVEL, DocMdpLevel::CERTIFIED_FORM_FILLING->value);
-		return DocMdpLevel::tryFrom($level) ?? DocMdpLevel::CERTIFIED_FORM_FILLING;
+		$level = $this->appConfig->getValueInt(Application::APP_ID, self::CONFIG_KEY_LEVEL, self::DEFAULT_LEVEL->value);
+		return DocMdpLevel::tryFrom($level) ?? self::DEFAULT_LEVEL;
 	}
 
 	public function setLevel(DocMdpLevel $level): void {
@@ -71,4 +72,5 @@ private function getAvailableLevels(): array {
 			DocMdpLevel::cases()
 		);
 	}
+
 }
diff --git a/lib/Service/FolderService.php b/lib/Service/FolderService.php
index 626193bdaf..b78b69ea8d 100644
--- a/lib/Service/FolderService.php
+++ b/lib/Service/FolderService.php
@@ -69,14 +69,8 @@ public function getUserRootFolder(): Folder {
 	public function getFolder(): Folder {
 		$path = $this->getLibreSignDefaultPath();
 		$containerFolder = $this->getContainerFolder();
-		try {
-			/** @var Folder $folder */
-			$folder = $containerFolder->get($path);
-		} catch (NotFoundException) {
-			/** @var Folder $folder */
-			$folder = $containerFolder->newFolder($path);
-		}
-		return $folder;
+
+		return $this->ensureFolderPathExists($containerFolder, $path);
 	}
 
 	/**
@@ -119,6 +113,23 @@ protected function getContainerFolder(): Folder {
 		return $reflectionProperty->getValue($containerFolder);
 	}
 
+	private function ensureFolderPathExists(Folder $folder, string $path): Folder {
+		$cleanPath = trim($path, '/');
+
+		if ($cleanPath === '') {
+			return $folder;
+		}
+
+		$segments = array_filter(explode('/', $cleanPath), static fn (string $segment): bool => $segment !== '');
+		$currentFolder = $folder;
+
+		foreach ($segments as $segment) {
+			$currentFolder = $currentFolder->getOrCreateFolder($segment);
+		}
+
+		return $currentFolder;
+	}
+
 	private function getLibreSignDefaultPath(): string {
 		if (!$this->userId) {
 			return 'unauthenticated';
diff --git a/lib/Service/IdentifyMethod/Account.php b/lib/Service/IdentifyMethod/Account.php
index 20cbb84514..cd28a7081e 100644
--- a/lib/Service/IdentifyMethod/Account.php
+++ b/lib/Service/IdentifyMethod/Account.php
@@ -8,7 +8,6 @@
 
 namespace OCA\Libresign\Service\IdentifyMethod;
 
-use OCA\Libresign\AppInfo\Application;
 use OCA\Libresign\Db\IdentifyMethodMapper;
 use OCA\Libresign\Exception\LibresignException;
 use OCA\Libresign\Helper\JSActions;
@@ -161,10 +160,7 @@ public function getSettings(): array {
 	}
 
 	private function isEnabledByDefault(): bool {
-		$config = $this->identifyService->getAppConfig()->getValueArray(Application::APP_ID, 'identify_methods', []);
-		if (json_last_error() !== JSON_ERROR_NONE || !is_array($config)) {
-			return true;
-		}
+		$config = $this->identifyService->getSavedSettings();
 
 		// Remove not enabled
 		$config = array_filter($config, fn ($i) => isset($i['enabled']) && $i['enabled'] ? true : false);
diff --git a/lib/Service/IdentifyMethod/IdentifyService.php b/lib/Service/IdentifyMethod/IdentifyService.php
index 2329a59227..2693acb489 100644
--- a/lib/Service/IdentifyMethod/IdentifyService.php
+++ b/lib/Service/IdentifyMethod/IdentifyService.php
@@ -17,6 +17,7 @@
 use OCA\Libresign\Service\SessionService;
 use OCP\AppFramework\Utility\ITimeFactory;
 use OCP\EventDispatcher\IEventDispatcher;
+use OCP\Exceptions\AppConfigTypeConflictException;
 use OCP\Files\IRootFolder;
 use OCP\IAppConfig;
 use OCP\IL10N;
@@ -26,7 +27,7 @@
 use Psr\Log\LoggerInterface;
 
 class IdentifyService {
-	private array $savedSettings = [];
+	private ?array $savedSettings = null;
 	public function __construct(
 		private IdentifyMethodMapper $identifyMethodMapper,
 		private SessionService $sessionService,
@@ -126,10 +127,32 @@ private function refreshIdFromDatabaseIfNecessary(IdentifyMethod $identifyMethod
 	}
 
 	public function getSavedSettings(): array {
-		if (!empty($this->savedSettings)) {
+		if ($this->savedSettings !== null) {
 			return $this->savedSettings;
 		}
-		return $this->getAppConfig()->getValueArray(Application::APP_ID, 'identify_methods', []);
+
+		$this->getAppConfig()->clearCache(true);
+		try {
+			$this->savedSettings = $this->getAppConfig()->getValueArray(Application::APP_ID, 'identify_methods', []);
+		} catch (AppConfigTypeConflictException) {
+			// Key was stored with wrong type (e.g., string written by the provisioning API).
+			// Normalize it: read the raw string, delete the key, and re-store as array type.
+			try {
+				$raw = $this->getAppConfig()->getValueString(Application::APP_ID, 'identify_methods', '');
+			} catch (AppConfigTypeConflictException) {
+				$raw = '';
+			}
+			$this->getAppConfig()->deleteKey(Application::APP_ID, 'identify_methods');
+			$decoded = json_decode($raw, true);
+			if (is_array($decoded)) {
+				$this->getAppConfig()->setValueArray(Application::APP_ID, 'identify_methods', $decoded);
+				$this->savedSettings = $decoded;
+			} else {
+				$this->savedSettings = [];
+			}
+		}
+
+		return $this->savedSettings;
 	}
 
 	public function getEventDispatcher(): IEventDispatcher {
diff --git a/lib/Service/Policy/Contract/IPolicyDefinition.php b/lib/Service/Policy/Contract/IPolicyDefinition.php
new file mode 100644
index 0000000000..b16fd9c7c1
--- /dev/null
+++ b/lib/Service/Policy/Contract/IPolicyDefinition.php
@@ -0,0 +1,30 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Libresign\Service\Policy\Contract;
+
+use OCA\Libresign\Service\Policy\Model\PolicyContext;
+
+interface IPolicyDefinition {
+	public function key(): string;
+
+	public function resolutionMode(): string;
+
+	public function getAppConfigKey(): string;
+
+	public function getUserPreferenceKey(): string;
+
+	public function normalizeValue(mixed $rawValue): mixed;
+
+	public function validateValue(mixed $value, PolicyContext $context): void;
+
+	/** @return list<mixed> */
+	public function allowedValues(PolicyContext $context): array;
+
+	public function defaultSystemValue(): mixed;
+}
diff --git a/lib/Service/Policy/Contract/IPolicyDefinitionProvider.php b/lib/Service/Policy/Contract/IPolicyDefinitionProvider.php
new file mode 100644
index 0000000000..0a23c76c6e
--- /dev/null
+++ b/lib/Service/Policy/Contract/IPolicyDefinitionProvider.php
@@ -0,0 +1,16 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Libresign\Service\Policy\Contract;
+
+interface IPolicyDefinitionProvider {
+	/** @return list<string> */
+	public function keys(): array;
+
+	public function get(string|\BackedEnum $policyKey): IPolicyDefinition;
+}
diff --git a/lib/Service/Policy/Contract/IPolicyResolver.php b/lib/Service/Policy/Contract/IPolicyResolver.php
new file mode 100644
index 0000000000..5f9fd8d914
--- /dev/null
+++ b/lib/Service/Policy/Contract/IPolicyResolver.php
@@ -0,0 +1,21 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Libresign\Service\Policy\Contract;
+
+use OCA\Libresign\Service\Policy\Model\PolicyContext;
+use OCA\Libresign\Service\Policy\Model\ResolvedPolicy;
+
+interface IPolicyResolver {
+	public function resolve(IPolicyDefinition $definition, PolicyContext $context): ResolvedPolicy;
+
+	/** @param list<IPolicyDefinition> $definitions
+	 * @return array<string, ResolvedPolicy>
+	 */
+	public function resolveMany(array $definitions, PolicyContext $context): array;
+}
diff --git a/lib/Service/Policy/Contract/IPolicySource.php b/lib/Service/Policy/Contract/IPolicySource.php
new file mode 100644
index 0000000000..4d51761585
--- /dev/null
+++ b/lib/Service/Policy/Contract/IPolicySource.php
@@ -0,0 +1,38 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Libresign\Service\Policy\Contract;
+
+use OCA\Libresign\Service\Policy\Model\PolicyContext;
+use OCA\Libresign\Service\Policy\Model\PolicyLayer;
+
+interface IPolicySource {
+	public function loadSystemPolicy(string $policyKey): ?PolicyLayer;
+
+	/** @return list<PolicyLayer> */
+	public function loadGroupPolicies(string $policyKey, PolicyContext $context): array;
+
+	/** @return list<PolicyLayer> */
+	public function loadCirclePolicies(string $policyKey, PolicyContext $context): array;
+
+	public function loadUserPreference(string $policyKey, PolicyContext $context): ?PolicyLayer;
+
+	public function loadRequestOverride(string $policyKey, PolicyContext $context): ?PolicyLayer;
+
+	public function loadGroupPolicyConfig(string $policyKey, string $groupId): ?PolicyLayer;
+
+	public function saveSystemPolicy(string $policyKey, mixed $value, bool $allowChildOverride = false): void;
+
+	public function saveGroupPolicy(string $policyKey, string $groupId, mixed $value, bool $allowChildOverride): void;
+
+	public function clearGroupPolicy(string $policyKey, string $groupId): void;
+
+	public function saveUserPreference(string $policyKey, PolicyContext $context, mixed $value): void;
+
+	public function clearUserPreference(string $policyKey, PolicyContext $context): void;
+}
diff --git a/lib/Service/Policy/Model/PolicyContext.php b/lib/Service/Policy/Model/PolicyContext.php
new file mode 100644
index 0000000000..0e7d56f818
--- /dev/null
+++ b/lib/Service/Policy/Model/PolicyContext.php
@@ -0,0 +1,93 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Libresign\Service\Policy\Model;
+
+final class PolicyContext {
+	private ?string $userId = null;
+	/** @var list<string> */
+	private array $groups = [];
+	/** @var list<string> */
+	private array $circles = [];
+	/** @var array<string, mixed>|null */
+	private ?array $activeContext = null;
+	/** @var array<string, mixed> */
+	private array $requestOverrides = [];
+	/** @var array<string, mixed> */
+	private array $actorCapabilities = [];
+
+	public static function fromUserId(string $userId): self {
+		$context = new self();
+		$context->setUserId($userId);
+		return $context;
+	}
+
+	public function setUserId(?string $userId): self {
+		$this->userId = $userId;
+		return $this;
+	}
+
+	public function getUserId(): ?string {
+		return $this->userId;
+	}
+
+	/** @param list<string> $groups */
+	public function setGroups(array $groups): self {
+		$this->groups = $groups;
+		return $this;
+	}
+
+	/** @return list<string> */
+	public function getGroups(): array {
+		return $this->groups;
+	}
+
+	/** @param list<string> $circles */
+	public function setCircles(array $circles): self {
+		$this->circles = $circles;
+		return $this;
+	}
+
+	/** @return list<string> */
+	public function getCircles(): array {
+		return $this->circles;
+	}
+
+	/** @param array<string, mixed>|null $activeContext */
+	public function setActiveContext(?array $activeContext): self {
+		$this->activeContext = $activeContext;
+		return $this;
+	}
+
+	/** @return array<string, mixed>|null */
+	public function getActiveContext(): ?array {
+		return $this->activeContext;
+	}
+
+	/** @param array<string, mixed> $requestOverrides */
+	public function setRequestOverrides(array $requestOverrides): self {
+		$this->requestOverrides = $requestOverrides;
+		return $this;
+	}
+
+	/** @return array<string, mixed> */
+	public function getRequestOverrides(): array {
+		return $this->requestOverrides;
+	}
+
+	/** @param array<string, mixed> $actorCapabilities */
+	public function setActorCapabilities(array $actorCapabilities): self {
+		$this->actorCapabilities = $actorCapabilities;
+		return $this;
+	}
+
+	/** @return array<string, mixed> */
+	public function getActorCapabilities(): array {
+		return $this->actorCapabilities;
+	}
+}
diff --git a/lib/Service/Policy/Model/PolicyLayer.php b/lib/Service/Policy/Model/PolicyLayer.php
new file mode 100644
index 0000000000..16e8cdc17b
--- /dev/null
+++ b/lib/Service/Policy/Model/PolicyLayer.php
@@ -0,0 +1,78 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Libresign\Service\Policy\Model;
+
+final class PolicyLayer {
+	private string $scope = '';
+	private mixed $value = null;
+	private bool $allowChildOverride = false;
+	private bool $visibleToChild = true;
+	/** @var list<mixed> */
+	private array $allowedValues = [];
+	/** @var array<string, mixed> */
+	private array $notes = [];
+
+	public function setScope(string $scope): self {
+		$this->scope = $scope;
+		return $this;
+	}
+
+	public function getScope(): string {
+		return $this->scope;
+	}
+
+	public function setValue(mixed $value): self {
+		$this->value = $value;
+		return $this;
+	}
+
+	public function getValue(): mixed {
+		return $this->value;
+	}
+
+	public function setAllowChildOverride(bool $allowChildOverride): self {
+		$this->allowChildOverride = $allowChildOverride;
+		return $this;
+	}
+
+	public function isAllowChildOverride(): bool {
+		return $this->allowChildOverride;
+	}
+
+	public function setVisibleToChild(bool $visibleToChild): self {
+		$this->visibleToChild = $visibleToChild;
+		return $this;
+	}
+
+	public function isVisibleToChild(): bool {
+		return $this->visibleToChild;
+	}
+
+	/** @param list<mixed> $allowedValues */
+	public function setAllowedValues(array $allowedValues): self {
+		$this->allowedValues = $allowedValues;
+		return $this;
+	}
+
+	/** @return list<mixed> */
+	public function getAllowedValues(): array {
+		return $this->allowedValues;
+	}
+
+	/** @param array<string, mixed> $notes */
+	public function setNotes(array $notes): self {
+		$this->notes = $notes;
+		return $this;
+	}
+
+	/** @return array<string, mixed> */
+	public function getNotes(): array {
+		return $this->notes;
+	}
+}
diff --git a/lib/Service/Policy/Model/PolicySpec.php b/lib/Service/Policy/Model/PolicySpec.php
new file mode 100644
index 0000000000..79b80e44cb
--- /dev/null
+++ b/lib/Service/Policy/Model/PolicySpec.php
@@ -0,0 +1,102 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Libresign\Service\Policy\Model;
+
+use Closure;
+use OCA\Libresign\Service\Policy\Contract\IPolicyDefinition;
+
+use function in_array;
+use function sprintf;
+
+final class PolicySpec implements IPolicyDefinition {
+	public const RESOLUTION_MODE_RESOLVED = 'resolved';
+	public const RESOLUTION_MODE_VALUE_CHOICE = 'value_choice';
+
+	/** @var list<mixed>|Closure(PolicyContext): list<mixed> */
+	private array|Closure $allowedValuesResolver;
+	/** @var Closure(mixed): mixed|null */
+	private ?Closure $normalizer;
+	/** @var Closure(mixed, PolicyContext): void|null */
+	private ?Closure $validator;
+
+	/**
+	 * @param list<mixed>|Closure(PolicyContext): list<mixed> $allowedValues
+	 * @param Closure(mixed): mixed|null $normalizer
+	 * @param Closure(mixed, PolicyContext): void|null $validator
+	 */
+	public function __construct(
+		private string $key,
+		private mixed $defaultSystemValue,
+		array|Closure $allowedValues,
+		?Closure $normalizer = null,
+		?Closure $validator = null,
+		private ?string $appConfigKey = null,
+		private ?string $userPreferenceKey = null,
+		private string $resolutionMode = self::RESOLUTION_MODE_RESOLVED,
+	) {
+		$this->allowedValuesResolver = $allowedValues;
+		$this->normalizer = $normalizer;
+		$this->validator = $validator;
+	}
+
+	#[\Override]
+	public function key(): string {
+		return $this->key;
+	}
+
+	#[\Override]
+	public function resolutionMode(): string {
+		return $this->resolutionMode;
+	}
+
+	#[\Override]
+	public function getAppConfigKey(): string {
+		return $this->appConfigKey ?? $this->key;
+	}
+
+	#[\Override]
+	public function getUserPreferenceKey(): string {
+		return $this->userPreferenceKey ?? 'policy.' . $this->key;
+	}
+
+	#[\Override]
+	public function normalizeValue(mixed $rawValue): mixed {
+		if ($this->normalizer !== null) {
+			return ($this->normalizer)($rawValue);
+		}
+
+		return $rawValue;
+	}
+
+	#[\Override]
+	public function validateValue(mixed $value, PolicyContext $context): void {
+		if ($this->validator !== null) {
+			($this->validator)($value, $context);
+			return;
+		}
+
+		if (!in_array($value, $this->allowedValues($context), true)) {
+			throw new \InvalidArgumentException(sprintf('Invalid value for %s', $this->key()));
+		}
+	}
+
+	#[\Override]
+	public function allowedValues(PolicyContext $context): array {
+		if ($this->allowedValuesResolver instanceof Closure) {
+			return ($this->allowedValuesResolver)($context);
+		}
+
+		return $this->allowedValuesResolver;
+	}
+
+	#[\Override]
+	public function defaultSystemValue(): mixed {
+		return $this->defaultSystemValue;
+	}
+}
diff --git a/lib/Service/Policy/Model/ResolvedPolicy.php b/lib/Service/Policy/Model/ResolvedPolicy.php
new file mode 100644
index 0000000000..e934c20870
--- /dev/null
+++ b/lib/Service/Policy/Model/ResolvedPolicy.php
@@ -0,0 +1,131 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Libresign\Service\Policy\Model;
+
+final class ResolvedPolicy {
+	private string $policyKey = '';
+	private mixed $effectiveValue = null;
+	private string $sourceScope = '';
+	private bool $visible = false;
+	private bool $editableByCurrentActor = false;
+	/** @var list<mixed> */
+	private array $allowedValues = [];
+	private bool $canSaveAsUserDefault = false;
+	private bool $canUseAsRequestOverride = false;
+	private bool $preferenceWasCleared = false;
+	private ?string $blockedBy = null;
+
+	public function setPolicyKey(string $policyKey): self {
+		$this->policyKey = $policyKey;
+		return $this;
+	}
+
+	public function getPolicyKey(): string {
+		return $this->policyKey;
+	}
+
+	public function setEffectiveValue(mixed $effectiveValue): self {
+		$this->effectiveValue = $effectiveValue;
+		return $this;
+	}
+
+	public function getEffectiveValue(): mixed {
+		return $this->effectiveValue;
+	}
+
+	public function setSourceScope(string $sourceScope): self {
+		$this->sourceScope = $sourceScope;
+		return $this;
+	}
+
+	public function getSourceScope(): string {
+		return $this->sourceScope;
+	}
+
+	public function setVisible(bool $visible): self {
+		$this->visible = $visible;
+		return $this;
+	}
+
+	public function isVisible(): bool {
+		return $this->visible;
+	}
+
+	public function setEditableByCurrentActor(bool $editableByCurrentActor): self {
+		$this->editableByCurrentActor = $editableByCurrentActor;
+		return $this;
+	}
+
+	public function isEditableByCurrentActor(): bool {
+		return $this->editableByCurrentActor;
+	}
+
+	/** @param list<mixed> $allowedValues */
+	public function setAllowedValues(array $allowedValues): self {
+		$this->allowedValues = $allowedValues;
+		return $this;
+	}
+
+	/** @return list<mixed> */
+	public function getAllowedValues(): array {
+		return $this->allowedValues;
+	}
+
+	public function setCanSaveAsUserDefault(bool $canSaveAsUserDefault): self {
+		$this->canSaveAsUserDefault = $canSaveAsUserDefault;
+		return $this;
+	}
+
+	public function canSaveAsUserDefault(): bool {
+		return $this->canSaveAsUserDefault;
+	}
+
+	public function setCanUseAsRequestOverride(bool $canUseAsRequestOverride): self {
+		$this->canUseAsRequestOverride = $canUseAsRequestOverride;
+		return $this;
+	}
+
+	public function canUseAsRequestOverride(): bool {
+		return $this->canUseAsRequestOverride;
+	}
+
+	public function setPreferenceWasCleared(bool $preferenceWasCleared): self {
+		$this->preferenceWasCleared = $preferenceWasCleared;
+		return $this;
+	}
+
+	public function wasPreferenceCleared(): bool {
+		return $this->preferenceWasCleared;
+	}
+
+	public function setBlockedBy(?string $blockedBy): self {
+		$this->blockedBy = $blockedBy;
+		return $this;
+	}
+
+	public function getBlockedBy(): ?string {
+		return $this->blockedBy;
+	}
+
+	/** @return array<string, mixed> */
+	public function toArray(): array {
+		return [
+			'policyKey' => $this->getPolicyKey(),
+			'effectiveValue' => $this->getEffectiveValue(),
+			'sourceScope' => $this->getSourceScope(),
+			'visible' => $this->isVisible(),
+			'editableByCurrentActor' => $this->isEditableByCurrentActor(),
+			'allowedValues' => $this->getAllowedValues(),
+			'canSaveAsUserDefault' => $this->canSaveAsUserDefault(),
+			'canUseAsRequestOverride' => $this->canUseAsRequestOverride(),
+			'preferenceWasCleared' => $this->wasPreferenceCleared(),
+			'blockedBy' => $this->getBlockedBy(),
+		];
+	}
+}
diff --git a/lib/Service/Policy/PolicyService.php b/lib/Service/Policy/PolicyService.php
new file mode 100644
index 0000000000..873af0950e
--- /dev/null
+++ b/lib/Service/Policy/PolicyService.php
@@ -0,0 +1,165 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Libresign\Service\Policy;
+
+use OCA\Libresign\Service\Policy\Model\PolicyLayer;
+use OCA\Libresign\Service\Policy\Model\ResolvedPolicy;
+use OCA\Libresign\Service\Policy\Provider\PolicyProviders;
+use OCA\Libresign\Service\Policy\Runtime\DefaultPolicyResolver;
+use OCA\Libresign\Service\Policy\Runtime\PolicyContextFactory;
+use OCA\Libresign\Service\Policy\Runtime\PolicyRegistry;
+use OCA\Libresign\Service\Policy\Runtime\PolicySource;
+use OCP\IUser;
+
+class PolicyService {
+	private DefaultPolicyResolver $resolver;
+
+	public function __construct(
+		private PolicyContextFactory $contextFactory,
+		private PolicySource $source,
+		private PolicyRegistry $registry,
+	) {
+		$this->resolver = new DefaultPolicyResolver($this->source);
+	}
+
+	/** @param array<string, mixed> $requestOverrides */
+	public function resolve(string|\BackedEnum $policyKey, array $requestOverrides = [], ?array $activeContext = null): ResolvedPolicy {
+		return $this->resolver->resolve(
+			$this->registry->get($policyKey),
+			$this->contextFactory->forCurrentUser($requestOverrides, $activeContext),
+		);
+	}
+
+	/** @param array<string, mixed> $requestOverrides */
+	public function resolveForUserId(string|\BackedEnum $policyKey, ?string $userId, array $requestOverrides = [], ?array $activeContext = null): ResolvedPolicy {
+		return $this->resolver->resolve(
+			$this->registry->get($policyKey),
+			$this->contextFactory->forUserId($userId, $requestOverrides, $activeContext),
+		);
+	}
+
+	/** @param array<string, mixed> $requestOverrides */
+	public function resolveForUser(string|\BackedEnum $policyKey, ?IUser $user, array $requestOverrides = [], ?array $activeContext = null): ResolvedPolicy {
+		return $this->resolver->resolve(
+			$this->registry->get($policyKey),
+			$this->contextFactory->forUser($user, $requestOverrides, $activeContext),
+		);
+	}
+
+	/** @return array<string, ResolvedPolicy> */
+	public function resolveKnownPolicies(array $requestOverrides = [], ?array $activeContext = null): array {
+		$context = $this->contextFactory->forCurrentUser($requestOverrides, $activeContext);
+		$definitions = [];
+		foreach (array_keys(PolicyProviders::BY_KEY) as $policyKey) {
+			$definitions[] = $this->registry->get($policyKey);
+		}
+
+		return $this->resolver->resolveMany($definitions, $context);
+	}
+
+	public function getSystemPolicy(string|\BackedEnum $policyKey): ?PolicyLayer {
+		$definition = $this->registry->get($policyKey);
+		return $this->source->loadSystemPolicy($definition->key());
+	}
+
+	public function getUserPreferenceForUserId(string|\BackedEnum $policyKey, string $userId): ?PolicyLayer {
+		$definition = $this->registry->get($policyKey);
+		$context = $this->contextFactory->forUserId($userId);
+		return $this->source->loadUserPreference($definition->key(), $context);
+	}
+
+	public function saveSystem(string|\BackedEnum $policyKey, mixed $value, bool $allowChildOverride = false): ResolvedPolicy {
+		$context = $this->contextFactory->forCurrentUser();
+		$definition = $this->registry->get($policyKey);
+		$normalizedValue = $value === null
+			? $definition->normalizeValue($definition->defaultSystemValue())
+			: $definition->normalizeValue($value);
+
+		$definition->validateValue($normalizedValue, $context);
+		$this->source->saveSystemPolicy($definition->key(), $normalizedValue, $allowChildOverride);
+
+		return $this->resolver->resolve($definition, $context);
+	}
+
+	public function getGroupPolicy(string|\BackedEnum $policyKey, string $groupId): ?PolicyLayer {
+		$definition = $this->registry->get($policyKey);
+		return $this->source->loadGroupPolicyConfig($definition->key(), $groupId);
+	}
+
+	public function saveGroupPolicy(string|\BackedEnum $policyKey, string $groupId, mixed $value, bool $allowChildOverride): PolicyLayer {
+		$definition = $this->registry->get($policyKey);
+		$context = $this->contextFactory->forCurrentUser();
+		$normalizedValue = $definition->normalizeValue($value);
+		$definition->validateValue($normalizedValue, $context);
+		$this->source->saveGroupPolicy($definition->key(), $groupId, $normalizedValue, $allowChildOverride);
+
+		return $this->source->loadGroupPolicyConfig($definition->key(), $groupId)
+			?? (new PolicyLayer())
+				->setScope('group')
+				->setVisibleToChild(true)
+				->setAllowChildOverride(true)
+				->setAllowedValues([]);
+	}
+
+	public function clearGroupPolicy(string|\BackedEnum $policyKey, string $groupId): ?PolicyLayer {
+		$definition = $this->registry->get($policyKey);
+		$this->source->clearGroupPolicy($definition->key(), $groupId);
+
+		return $this->source->loadGroupPolicyConfig($definition->key(), $groupId);
+	}
+
+	public function saveUserPreference(string|\BackedEnum $policyKey, mixed $value): ResolvedPolicy {
+		$context = $this->contextFactory->forCurrentUser();
+		$definition = $this->registry->get($policyKey);
+		$resolved = $this->resolver->resolve($definition, $context);
+		if (!$resolved->canSaveAsUserDefault()) {
+			throw new \InvalidArgumentException('Saving a user preference is not allowed for ' . $definition->key());
+		}
+
+		$normalizedValue = $definition->normalizeValue($value);
+		$definition->validateValue($normalizedValue, $context);
+		$this->source->saveUserPreference($definition->key(), $context, $normalizedValue);
+
+		return $this->resolver->resolve($definition, $context);
+	}
+
+	public function clearUserPreference(string|\BackedEnum $policyKey): ResolvedPolicy {
+		$context = $this->contextFactory->forCurrentUser();
+		$definition = $this->registry->get($policyKey);
+		$this->source->clearUserPreference($definition->key(), $context);
+
+		return $this->resolver->resolve($definition, $context);
+	}
+
+	public function saveUserPreferenceForUserId(string|\BackedEnum $policyKey, string $userId, mixed $value): ?PolicyLayer {
+		$context = $this->contextFactory->forUserId($userId);
+		$definition = $this->registry->get($policyKey);
+		$resolved = $this->resolver->resolve($definition, $context);
+		if (!$resolved->canSaveAsUserDefault() && !$this->contextFactory->isCurrentActorSystemAdmin()) {
+			throw new \InvalidArgumentException('Saving a user preference is not allowed for ' . $definition->key());
+		}
+
+		$normalizedValue = $definition->normalizeValue($value);
+		$definition->validateValue($normalizedValue, $context);
+		$this->source->saveUserPreference($definition->key(), $context, $normalizedValue);
+
+		return $this->source->loadUserPreference($definition->key(), $context)
+			?? (new PolicyLayer())
+				->setScope('user')
+				->setValue($normalizedValue);
+	}
+
+	public function clearUserPreferenceForUserId(string|\BackedEnum $policyKey, string $userId): ?PolicyLayer {
+		$context = $this->contextFactory->forUserId($userId);
+		$definition = $this->registry->get($policyKey);
+		$this->source->clearUserPreference($definition->key(), $context);
+
+		return $this->source->loadUserPreference($definition->key(), $context);
+	}
+}
diff --git a/lib/Service/Policy/Provider/DocMdp/DocMdpPolicy.php b/lib/Service/Policy/Provider/DocMdp/DocMdpPolicy.php
new file mode 100644
index 0000000000..c40bea3928
--- /dev/null
+++ b/lib/Service/Policy/Provider/DocMdp/DocMdpPolicy.php
@@ -0,0 +1,63 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Libresign\Service\Policy\Provider\DocMdp;
+
+use OCA\Libresign\Enum\DocMdpLevel;
+use OCA\Libresign\Service\Policy\Contract\IPolicyDefinition;
+use OCA\Libresign\Service\Policy\Contract\IPolicyDefinitionProvider;
+use OCA\Libresign\Service\Policy\Model\PolicySpec;
+
+final class DocMdpPolicy implements IPolicyDefinitionProvider {
+	public const KEY = 'docmdp';
+	public const SYSTEM_APP_CONFIG_KEY = 'docmdp_level';
+
+	#[\Override]
+	public function keys(): array {
+		return [
+			self::KEY,
+		];
+	}
+
+	#[\Override]
+	public function get(string|\BackedEnum $policyKey): IPolicyDefinition {
+		return match ($this->normalizePolicyKey($policyKey)) {
+			self::KEY => new PolicySpec(
+				key: self::KEY,
+				defaultSystemValue: DocMdpLevel::NOT_CERTIFIED->value,
+				allowedValues: [
+					DocMdpLevel::NOT_CERTIFIED->value,
+					DocMdpLevel::CERTIFIED_NO_CHANGES_ALLOWED->value,
+					DocMdpLevel::CERTIFIED_FORM_FILLING->value,
+					DocMdpLevel::CERTIFIED_FORM_FILLING_AND_ANNOTATIONS->value,
+				],
+				normalizer: static function (mixed $rawValue): mixed {
+					if ($rawValue instanceof DocMdpLevel) {
+						return $rawValue->value;
+					}
+
+					if (is_int($rawValue)) {
+						return $rawValue;
+					}
+
+					return $rawValue;
+				},
+				appConfigKey: self::SYSTEM_APP_CONFIG_KEY,
+			),
+			default => throw new \InvalidArgumentException('Unknown policy key: ' . $this->normalizePolicyKey($policyKey)),
+		};
+	}
+
+	private function normalizePolicyKey(string|\BackedEnum $policyKey): string {
+		if ($policyKey instanceof \BackedEnum) {
+			return (string)$policyKey->value;
+		}
+
+		return $policyKey;
+	}
+}
diff --git a/lib/Service/Policy/Provider/Footer/AddFooterPolicy.php b/lib/Service/Policy/Provider/Footer/AddFooterPolicy.php
new file mode 100644
index 0000000000..4cb77465d5
--- /dev/null
+++ b/lib/Service/Policy/Provider/Footer/AddFooterPolicy.php
@@ -0,0 +1,59 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Libresign\Service\Policy\Provider\Footer;
+
+use OCA\Libresign\Service\Policy\Contract\IPolicyDefinition;
+use OCA\Libresign\Service\Policy\Contract\IPolicyDefinitionProvider;
+use OCA\Libresign\Service\Policy\Model\PolicySpec;
+
+final class AddFooterPolicy implements IPolicyDefinitionProvider {
+	public const KEY = 'add_footer';
+	public const SYSTEM_APP_CONFIG_KEY = 'add_footer';
+
+	#[\Override]
+	public function keys(): array {
+		return [
+			self::KEY,
+		];
+	}
+
+	#[\Override]
+	public function get(string|\BackedEnum $policyKey): IPolicyDefinition {
+		return match ($this->normalizePolicyKey($policyKey)) {
+			self::KEY => new PolicySpec(
+				key: self::KEY,
+				defaultSystemValue: SignatureFooterPolicyValue::encode(SignatureFooterPolicyValue::defaults()),
+				allowedValues: static fn (): array => [],
+				normalizer: static function (mixed $rawValue): mixed {
+					return SignatureFooterPolicyValue::encode(SignatureFooterPolicyValue::normalize($rawValue));
+				},
+				validator: static function (mixed $value): void {
+					if (!is_string($value) || trim($value) === '') {
+						throw new \InvalidArgumentException('Invalid value for ' . self::KEY);
+					}
+
+					$decoded = json_decode($value, true);
+					if (!is_array($decoded)) {
+						throw new \InvalidArgumentException('Invalid value for ' . self::KEY);
+					}
+				},
+				appConfigKey: self::SYSTEM_APP_CONFIG_KEY,
+			),
+			default => throw new \InvalidArgumentException('Unknown policy key: ' . $this->normalizePolicyKey($policyKey)),
+		};
+	}
+
+	private function normalizePolicyKey(string|\BackedEnum $policyKey): string {
+		if ($policyKey instanceof \BackedEnum) {
+			return (string)$policyKey->value;
+		}
+
+		return $policyKey;
+	}
+}
diff --git a/lib/Service/Policy/Provider/Footer/SignatureFooterPolicyValue.php b/lib/Service/Policy/Provider/Footer/SignatureFooterPolicyValue.php
new file mode 100644
index 0000000000..2b675e5bec
--- /dev/null
+++ b/lib/Service/Policy/Provider/Footer/SignatureFooterPolicyValue.php
@@ -0,0 +1,94 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Libresign\Service\Policy\Provider\Footer;
+
+final class SignatureFooterPolicyValue {
+	/** @return array{enabled: bool, writeQrcodeOnFooter: bool, validationSite: string, customizeFooterTemplate: bool} */
+	public static function defaults(): array {
+		return [
+			'enabled' => true,
+			'writeQrcodeOnFooter' => true,
+			'validationSite' => '',
+			'customizeFooterTemplate' => false,
+		];
+	}
+
+	/** @return array{enabled: bool, writeQrcodeOnFooter: bool, validationSite: string, customizeFooterTemplate: bool} */
+	public static function normalize(mixed $rawValue): array {
+		$defaults = self::defaults();
+
+		if (is_array($rawValue)) {
+			return [
+				'enabled' => self::toBool($rawValue['enabled'] ?? $rawValue['addFooter'] ?? $defaults['enabled']),
+				'writeQrcodeOnFooter' => self::toBool($rawValue['writeQrcodeOnFooter'] ?? $rawValue['write_qrcode_on_footer'] ?? $defaults['writeQrcodeOnFooter']),
+				'validationSite' => self::toString($rawValue['validationSite'] ?? $rawValue['validation_site'] ?? $defaults['validationSite']),
+				'customizeFooterTemplate' => self::toBool($rawValue['customizeFooterTemplate'] ?? $rawValue['customize_footer_template'] ?? $defaults['customizeFooterTemplate']),
+			];
+		}
+
+		if (is_bool($rawValue) || is_int($rawValue)) {
+			$defaults['enabled'] = self::toBool($rawValue);
+			return $defaults;
+		}
+
+		if (is_string($rawValue)) {
+			$trimmedValue = trim($rawValue);
+			if ($trimmedValue === '') {
+				return $defaults;
+			}
+
+			$decoded = json_decode($trimmedValue, true);
+			if (is_array($decoded)) {
+				return self::normalize($decoded);
+			}
+
+			$defaults['enabled'] = self::toBool($trimmedValue);
+			return $defaults;
+		}
+
+		return $defaults;
+	}
+
+	public static function encode(array $value): string {
+		return (string)json_encode(self::normalize($value), JSON_UNESCAPED_SLASHES);
+	}
+
+	public static function isEnabled(mixed $rawValue): bool {
+		return self::normalize($rawValue)['enabled'];
+	}
+
+	public static function isQrCodeEnabled(mixed $rawValue): bool {
+		$normalized = self::normalize($rawValue);
+		return $normalized['enabled'] && $normalized['writeQrcodeOnFooter'];
+	}
+
+	private static function toBool(mixed $rawValue): bool {
+		if (is_bool($rawValue)) {
+			return $rawValue;
+		}
+
+		if (is_int($rawValue)) {
+			return $rawValue === 1;
+		}
+
+		if (is_string($rawValue)) {
+			return in_array(strtolower(trim($rawValue)), ['1', 'true', 'yes', 'on'], true);
+		}
+
+		return (bool)$rawValue;
+	}
+
+	private static function toString(mixed $rawValue): string {
+		if (!is_scalar($rawValue)) {
+			return '';
+		}
+
+		return trim((string)$rawValue);
+	}
+}
diff --git a/lib/Service/Policy/Provider/PolicyProviders.php b/lib/Service/Policy/Provider/PolicyProviders.php
new file mode 100644
index 0000000000..aa9438335f
--- /dev/null
+++ b/lib/Service/Policy/Provider/PolicyProviders.php
@@ -0,0 +1,22 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Libresign\Service\Policy\Provider;
+
+use OCA\Libresign\Service\Policy\Provider\DocMdp\DocMdpPolicy;
+use OCA\Libresign\Service\Policy\Provider\Footer\AddFooterPolicy;
+use OCA\Libresign\Service\Policy\Provider\Signature\SignatureFlowPolicy;
+
+final class PolicyProviders {
+	/** @var array<string, class-string> */
+	public const BY_KEY = [
+		AddFooterPolicy::KEY => AddFooterPolicy::class,
+		DocMdpPolicy::KEY => DocMdpPolicy::class,
+		SignatureFlowPolicy::KEY => SignatureFlowPolicy::class,
+	];
+}
diff --git a/lib/Service/Policy/Provider/Signature/SignatureFlowPolicy.php b/lib/Service/Policy/Provider/Signature/SignatureFlowPolicy.php
new file mode 100644
index 0000000000..9976c158b9
--- /dev/null
+++ b/lib/Service/Policy/Provider/Signature/SignatureFlowPolicy.php
@@ -0,0 +1,59 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Libresign\Service\Policy\Provider\Signature;
+
+use OCA\Libresign\Enum\SignatureFlow;
+use OCA\Libresign\Service\Policy\Contract\IPolicyDefinition;
+use OCA\Libresign\Service\Policy\Contract\IPolicyDefinitionProvider;
+use OCA\Libresign\Service\Policy\Model\PolicySpec;
+
+final class SignatureFlowPolicy implements IPolicyDefinitionProvider {
+	public const KEY = 'signature_flow';
+	public const SYSTEM_APP_CONFIG_KEY = 'policy.signature_flow.system';
+
+	#[\Override]
+	public function keys(): array {
+		return [
+			self::KEY,
+		];
+	}
+
+	#[\Override]
+	public function get(string|\BackedEnum $policyKey): IPolicyDefinition {
+		return match ($this->normalizePolicyKey($policyKey)) {
+			self::KEY => new PolicySpec(
+				key: self::KEY,
+				defaultSystemValue: SignatureFlow::NONE->value,
+				allowedValues: [
+					SignatureFlow::NONE->value,
+					SignatureFlow::PARALLEL->value,
+					SignatureFlow::ORDERED_NUMERIC->value,
+				],
+				normalizer: static function (mixed $rawValue): mixed {
+					if ($rawValue instanceof SignatureFlow) {
+						return $rawValue->value;
+					}
+
+					return $rawValue;
+				},
+				appConfigKey: self::SYSTEM_APP_CONFIG_KEY,
+				resolutionMode: PolicySpec::RESOLUTION_MODE_VALUE_CHOICE,
+			),
+			default => throw new \InvalidArgumentException('Unknown policy key: ' . $this->normalizePolicyKey($policyKey)),
+		};
+	}
+
+	private function normalizePolicyKey(string|\BackedEnum $policyKey): string {
+		if ($policyKey instanceof \BackedEnum) {
+			return (string)$policyKey->value;
+		}
+
+		return $policyKey;
+	}
+}
diff --git a/lib/Service/Policy/Runtime/DefaultPolicyResolver.php b/lib/Service/Policy/Runtime/DefaultPolicyResolver.php
new file mode 100644
index 0000000000..768bf23b50
--- /dev/null
+++ b/lib/Service/Policy/Runtime/DefaultPolicyResolver.php
@@ -0,0 +1,332 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Libresign\Service\Policy\Runtime;
+
+use OCA\Libresign\Service\Policy\Contract\IPolicyDefinition;
+use OCA\Libresign\Service\Policy\Contract\IPolicyResolver;
+use OCA\Libresign\Service\Policy\Contract\IPolicySource;
+use OCA\Libresign\Service\Policy\Model\PolicyContext;
+use OCA\Libresign\Service\Policy\Model\PolicyLayer;
+use OCA\Libresign\Service\Policy\Model\ResolvedPolicy;
+
+final class DefaultPolicyResolver implements IPolicyResolver {
+	public function __construct(
+		private IPolicySource $source,
+	) {
+	}
+
+	#[\Override]
+	public function resolve(IPolicyDefinition $definition, PolicyContext $context): ResolvedPolicy {
+		$policyKey = $definition->key();
+		$resolved = (new ResolvedPolicy())
+			->setPolicyKey($policyKey)
+			->setAllowedValues($definition->allowedValues($context));
+
+		$systemLayer = $this->source->loadSystemPolicy($policyKey);
+		$groupLayers = $this->source->loadGroupPolicies($policyKey, $context);
+
+		$currentValue = $definition->defaultSystemValue();
+		$currentSourceScope = 'system';
+		$currentBlockedBy = null;
+		$canOverrideBelow = false;
+		$visible = true;
+
+		if ($systemLayer !== null) {
+			[$currentValue, $currentSourceScope, $canOverrideBelow, $visible] = $this->applyLayer(
+				$definition,
+				$resolved,
+				$systemLayer,
+				$context,
+				$currentValue,
+				$currentSourceScope,
+				true,
+				$visible,
+			);
+		}
+
+		if ($definition->resolutionMode() === 'value_choice') {
+			[$currentValue, $currentSourceScope, $canOverrideBelow, $visible] = $this->applyValueChoiceGroupLayers(
+				$definition,
+				$resolved,
+				$groupLayers,
+				$context,
+				$currentValue,
+				$currentSourceScope,
+				$canOverrideBelow,
+				$visible,
+			);
+		} else {
+			foreach ($groupLayers as $layer) {
+				[$currentValue, $currentSourceScope, $canOverrideBelow, $visible] = $this->applyLayer(
+					$definition,
+					$resolved,
+					$layer,
+					$context,
+					$currentValue,
+					$currentSourceScope,
+					$canOverrideBelow,
+					$visible,
+				);
+			}
+		}
+
+		$userPreference = $this->source->loadUserPreference($policyKey, $context);
+		if ($userPreference !== null) {
+			if ($this->canApplyLowerLayer($definition, $resolved, $userPreference, $canOverrideBelow, $visible, $context)) {
+				$currentValue = $definition->normalizeValue($userPreference->getValue());
+				$definition->validateValue($currentValue, $context);
+				$currentSourceScope = $userPreference->getScope();
+			} else {
+				$this->source->clearUserPreference($policyKey, $context);
+				$currentBlockedBy = $currentSourceScope;
+				$resolved->setPreferenceWasCleared(true);
+			}
+		}
+
+		$requestOverride = $this->source->loadRequestOverride($policyKey, $context);
+		if ($requestOverride !== null) {
+			if ($this->canApplyLowerLayer($definition, $resolved, $requestOverride, $canOverrideBelow, $visible, $context)) {
+				$currentValue = $definition->normalizeValue($requestOverride->getValue());
+				$definition->validateValue($currentValue, $context);
+				$currentSourceScope = $requestOverride->getScope();
+			} elseif ($currentBlockedBy === null) {
+				$currentBlockedBy = $currentSourceScope;
+			}
+		}
+
+		$resolved
+			->setEffectiveValue($currentValue)
+			->setSourceScope($currentSourceScope)
+			->setVisible($visible)
+			->setEditableByCurrentActor($visible && $canOverrideBelow)
+			->setCanSaveAsUserDefault($visible && $canOverrideBelow)
+			->setCanUseAsRequestOverride($visible && $canOverrideBelow)
+			->setBlockedBy($currentBlockedBy);
+
+		return $resolved;
+	}
+
+	/**
+	 * @param list<PolicyLayer> $layers
+	 * @return array{0: mixed, 1: string, 2: bool, 3: bool}
+	 */
+	private function applyValueChoiceGroupLayers(
+		IPolicyDefinition $definition,
+		ResolvedPolicy $resolved,
+		array $layers,
+		PolicyContext $context,
+		mixed $currentValue,
+		string $currentSourceScope,
+		bool $canOverrideBelow,
+		bool $visible,
+	): array {
+		if ($layers === [] || !$visible || !$canOverrideBelow) {
+			return [$currentValue, $currentSourceScope, $canOverrideBelow, $visible];
+		}
+
+		$upstreamAllowedValues = $resolved->getAllowedValues();
+		$combinedChoices = [];
+		$groupDefaultValues = [];
+		$hasVisibleLayer = false;
+
+		foreach ($layers as $layer) {
+			if (!$layer->isVisibleToChild()) {
+				continue;
+			}
+
+			$hasVisibleLayer = true;
+			$layerChoices = $this->resolveValueChoiceLayerChoices($definition, $layer, $upstreamAllowedValues, $context);
+			$combinedChoices = $this->mergeUnionAllowedValues(
+				$definition->allowedValues($context),
+				$combinedChoices,
+				$layerChoices,
+			);
+
+			$normalizedDefault = $definition->normalizeValue($layer->getValue());
+			if ($layer->getValue() !== null && in_array($normalizedDefault, $combinedChoices, true) && !in_array($normalizedDefault, $groupDefaultValues, true)) {
+				$groupDefaultValues[] = $normalizedDefault;
+			}
+		}
+
+		if (!$hasVisibleLayer || $combinedChoices === []) {
+			return [$currentValue, $currentSourceScope, false, $visible && $hasVisibleLayer];
+		}
+
+		$resolved->setAllowedValues($combinedChoices);
+
+		return [
+			$this->pickValueChoiceDefault($definition, $currentValue, $combinedChoices, $groupDefaultValues, $context),
+			'group',
+			count($combinedChoices) > 1,
+			true,
+		];
+	}
+
+	#[\Override]
+	/** @param list<IPolicyDefinition> $definitions */
+	public function resolveMany(array $definitions, PolicyContext $context): array {
+		$resolved = [];
+		foreach ($definitions as $definition) {
+			if (!$definition instanceof IPolicyDefinition) {
+				continue;
+			}
+
+			$resolved[$definition->key()] = $this->resolve($definition, $context);
+		}
+		return $resolved;
+	}
+
+	private function applyLayer(
+		IPolicyDefinition $definition,
+		ResolvedPolicy $resolved,
+		PolicyLayer $layer,
+		PolicyContext $context,
+		mixed $currentValue,
+		string $currentSourceScope,
+		bool $canOverrideBelow,
+		bool $visible,
+	): array {
+		$visible = $visible && $layer->isVisibleToChild();
+		$resolved->setAllowedValues($this->mergeAllowedValues($resolved->getAllowedValues(), $layer->getAllowedValues()));
+
+		if ($layer->getValue() !== null && $canOverrideBelow) {
+			$currentValue = $definition->normalizeValue($layer->getValue());
+			$definition->validateValue($currentValue, $context);
+			$currentSourceScope = $layer->getScope();
+		}
+
+		$canOverrideBelow = $canOverrideBelow && $layer->isAllowChildOverride();
+
+		return [$currentValue, $currentSourceScope, $canOverrideBelow, $visible];
+	}
+
+	private function canApplyLowerLayer(
+		IPolicyDefinition $definition,
+		ResolvedPolicy $resolved,
+		PolicyLayer $layer,
+		bool $canOverrideBelow,
+		bool $visible,
+		PolicyContext $context,
+	): bool {
+		if (!$visible || !$canOverrideBelow || $layer->getValue() === null) {
+			return false;
+		}
+
+		$value = $definition->normalizeValue($layer->getValue());
+		$allowedValues = $resolved->getAllowedValues();
+		if ($allowedValues !== [] && !in_array($value, $allowedValues, true)) {
+			return false;
+		}
+
+		$definition->validateValue($value, $context);
+		return true;
+	}
+
+	/** @param list<mixed> $currentAllowedValues
+	 * @param list<mixed> $layerAllowedValues
+	 * @return list<mixed>
+	 */
+	private function mergeAllowedValues(array $currentAllowedValues, array $layerAllowedValues): array {
+		if ($layerAllowedValues === []) {
+			return $currentAllowedValues;
+		}
+
+		if ($currentAllowedValues === []) {
+			return $layerAllowedValues;
+		}
+
+		return array_values(array_intersect($currentAllowedValues, $layerAllowedValues));
+	}
+
+	/**
+	 * @param list<mixed> $upstreamAllowedValues
+	 * @return list<mixed>
+	 */
+	private function resolveValueChoiceLayerChoices(
+		IPolicyDefinition $definition,
+		PolicyLayer $layer,
+		array $upstreamAllowedValues,
+		PolicyContext $context,
+	): array {
+		if ($layer->isAllowChildOverride()) {
+			$choices = $layer->getAllowedValues() === []
+				? $upstreamAllowedValues
+				: array_values(array_intersect($upstreamAllowedValues, $layer->getAllowedValues()));
+
+			$defaultValue = $definition->normalizeValue($definition->defaultSystemValue());
+			return array_values(array_filter(
+				$choices,
+				static fn (mixed $choice): bool => $choice !== $defaultValue,
+			));
+		}
+
+		if ($layer->getValue() === null) {
+			return [];
+		}
+
+		$value = $definition->normalizeValue($layer->getValue());
+		if ($upstreamAllowedValues !== [] && !in_array($value, $upstreamAllowedValues, true)) {
+			return [];
+		}
+
+		$definition->validateValue($value, $context);
+		return [$value];
+	}
+
+	/**
+	 * @param list<mixed> $canonicalOrder
+	 * @param list<mixed> $currentValues
+	 * @param list<mixed> $newValues
+	 * @return list<mixed>
+	 */
+	private function mergeUnionAllowedValues(array $canonicalOrder, array $currentValues, array $newValues): array {
+		$merged = [];
+		foreach ($canonicalOrder as $candidate) {
+			if ((in_array($candidate, $currentValues, true) || in_array($candidate, $newValues, true)) && !in_array($candidate, $merged, true)) {
+				$merged[] = $candidate;
+			}
+		}
+
+		foreach ([$currentValues, $newValues] as $values) {
+			foreach ($values as $candidate) {
+				if (!in_array($candidate, $merged, true)) {
+					$merged[] = $candidate;
+				}
+			}
+		}
+
+		return $merged;
+	}
+
+	/**
+	 * @param list<mixed> $allowedValues
+	 * @param list<mixed> $groupDefaultValues
+	 */
+	private function pickValueChoiceDefault(
+		IPolicyDefinition $definition,
+		mixed $currentValue,
+		array $allowedValues,
+		array $groupDefaultValues,
+		PolicyContext $context,
+	): mixed {
+		$normalizedCurrentValue = $definition->normalizeValue($currentValue);
+		$defaultValue = $definition->normalizeValue($definition->defaultSystemValue());
+
+		if (count($groupDefaultValues) === 1 && in_array($groupDefaultValues[0], $allowedValues, true)) {
+			return $groupDefaultValues[0];
+		}
+
+		if ($normalizedCurrentValue !== $defaultValue && in_array($normalizedCurrentValue, $allowedValues, true)) {
+			return $normalizedCurrentValue;
+		}
+
+		$orderedAllowedValues = $this->mergeUnionAllowedValues($definition->allowedValues($context), [], $allowedValues);
+		return $orderedAllowedValues[0] ?? $normalizedCurrentValue;
+	}
+}
diff --git a/lib/Service/Policy/Runtime/PolicyContextFactory.php b/lib/Service/Policy/Runtime/PolicyContextFactory.php
new file mode 100644
index 0000000000..34f7f63c53
--- /dev/null
+++ b/lib/Service/Policy/Runtime/PolicyContextFactory.php
@@ -0,0 +1,72 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Libresign\Service\Policy\Runtime;
+
+use OCA\Libresign\Service\Policy\Model\PolicyContext;
+use OCP\IGroupManager;
+use OCP\IUser;
+use OCP\IUserManager;
+use OCP\IUserSession;
+
+final class PolicyContextFactory {
+	public function __construct(
+		private IUserManager $userManager,
+		private IGroupManager $groupManager,
+		private IUserSession $userSession,
+	) {
+	}
+
+	/** @param array<string, mixed> $requestOverrides */
+	public function forCurrentUser(array $requestOverrides = [], ?array $activeContext = null): PolicyContext {
+		return $this->forUser($this->userSession->getUser(), $requestOverrides, $activeContext);
+	}
+
+	public function isCurrentActorSystemAdmin(): bool {
+		$user = $this->userSession->getUser();
+		if ($user === null) {
+			return false;
+		}
+
+		return $this->groupManager->isAdmin($user->getUID());
+	}
+
+	/** @param array<string, mixed> $requestOverrides */
+	public function forUser(?IUser $user, array $requestOverrides = [], ?array $activeContext = null): PolicyContext {
+		return $this->build($user?->getUID(), $user, $requestOverrides, $activeContext);
+	}
+
+	/** @param array<string, mixed> $requestOverrides */
+	public function forUserId(?string $userId, array $requestOverrides = [], ?array $activeContext = null): PolicyContext {
+		$user = null;
+		if ($userId !== null && $userId !== '') {
+			$loadedUser = $this->userManager->get($userId);
+			if ($loadedUser instanceof IUser) {
+				$user = $loadedUser;
+			}
+		}
+
+		return $this->build($userId, $user, $requestOverrides, $activeContext);
+	}
+
+	/** @param array<string, mixed> $requestOverrides */
+	private function build(?string $userId, ?IUser $user, array $requestOverrides = [], ?array $activeContext = null): PolicyContext {
+		$context = (new PolicyContext())
+			->setRequestOverrides($requestOverrides)
+			->setActiveContext($activeContext);
+
+		if ($userId !== null && $userId !== '') {
+			$context->setUserId($userId);
+			if ($user instanceof IUser) {
+				$context->setGroups($this->groupManager->getUserGroupIds($user));
+			}
+		}
+
+		return $context;
+	}
+}
diff --git a/lib/Service/Policy/Runtime/PolicyRegistry.php b/lib/Service/Policy/Runtime/PolicyRegistry.php
new file mode 100644
index 0000000000..3dff68ceed
--- /dev/null
+++ b/lib/Service/Policy/Runtime/PolicyRegistry.php
@@ -0,0 +1,57 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Libresign\Service\Policy\Runtime;
+
+use OCA\Libresign\Service\Policy\Contract\IPolicyDefinition;
+use OCA\Libresign\Service\Policy\Contract\IPolicyDefinitionProvider;
+use OCA\Libresign\Service\Policy\Provider\PolicyProviders;
+use Psr\Container\ContainerInterface;
+
+final class PolicyRegistry {
+	/** @var array<string, IPolicyDefinition> */
+	private array $definitions = [];
+
+	public function __construct(
+		private ContainerInterface $container,
+	) {
+	}
+
+	public function get(string|\BackedEnum $policyKey): IPolicyDefinition {
+		$policyKeyValue = $this->normalizePolicyKey($policyKey);
+		$definition = $this->definitions[$policyKeyValue] ?? null;
+		if ($definition instanceof IPolicyDefinition) {
+			return $definition;
+		}
+
+		$providerClass = PolicyProviders::BY_KEY[$policyKeyValue] ?? null;
+		if (!is_string($providerClass) || $providerClass === '') {
+			throw new \InvalidArgumentException('Unknown policy key: ' . $policyKeyValue);
+		}
+
+		$provider = $this->container->get($providerClass);
+		if (!$provider instanceof IPolicyDefinitionProvider) {
+			throw new \UnexpectedValueException('Invalid policy provider: ' . $providerClass);
+		}
+
+		$definition = $provider->get($policyKeyValue);
+		if ($definition->key() !== $policyKeyValue) {
+			throw new \InvalidArgumentException('Policy provider returned mismatched key: ' . $definition->key());
+		}
+
+		return $this->definitions[$policyKeyValue] = $definition;
+	}
+
+	private function normalizePolicyKey(string|\BackedEnum $policyKey): string {
+		if ($policyKey instanceof \BackedEnum) {
+			return (string)$policyKey->value;
+		}
+
+		return $policyKey;
+	}
+}
diff --git a/lib/Service/Policy/Runtime/PolicySource.php b/lib/Service/Policy/Runtime/PolicySource.php
new file mode 100644
index 0000000000..643733f80a
--- /dev/null
+++ b/lib/Service/Policy/Runtime/PolicySource.php
@@ -0,0 +1,386 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Libresign\Service\Policy\Runtime;
+
+use OCA\Libresign\Db\PermissionSet;
+use OCA\Libresign\Db\PermissionSetBinding;
+use OCA\Libresign\Db\PermissionSetBindingMapper;
+use OCA\Libresign\Db\PermissionSetMapper;
+use OCA\Libresign\Service\Policy\Contract\IPolicySource;
+use OCA\Libresign\Service\Policy\Model\PolicyContext;
+use OCA\Libresign\Service\Policy\Model\PolicyLayer;
+use OCP\AppFramework\Db\DoesNotExistException;
+use OCP\AppFramework\Services\IAppConfig;
+
+class PolicySource implements IPolicySource {
+	public function __construct(
+		private IAppConfig $appConfig,
+		private PermissionSetMapper $permissionSetMapper,
+		private PermissionSetBindingMapper $bindingMapper,
+		private PolicyRegistry $registry,
+	) {
+	}
+
+	#[\Override]
+	public function loadSystemPolicy(string $policyKey): ?PolicyLayer {
+		$definition = $this->registry->get($policyKey);
+		$defaultValue = $definition->normalizeValue($definition->defaultSystemValue());
+		$hasExplicitSystemValue = $this->appConfig->hasAppKey($definition->getAppConfigKey());
+		$storedValue = $hasExplicitSystemValue
+			? $this->readSystemValue($definition->getAppConfigKey(), $defaultValue)
+			: null;
+		$value = $hasExplicitSystemValue
+			? $definition->normalizeValue($storedValue)
+			: $defaultValue;
+
+		$layer = (new PolicyLayer())
+			->setScope($hasExplicitSystemValue ? 'global' : 'system')
+			->setValue($value)
+			->setVisibleToChild(true);
+
+		if (!$hasExplicitSystemValue) {
+			return $layer->setAllowChildOverride(true);
+		}
+
+		if ($value === $defaultValue) {
+			$allowChildOverride = $this->appConfig->getAppValueString(
+				$this->getSystemAllowOverrideConfigKey($definition->getAppConfigKey()),
+				'0',
+			) === '1';
+
+			if ($allowChildOverride) {
+				// Explicitly persisted default value ("let users choose")
+				return $layer
+					->setAllowChildOverride(true)
+					->setAllowedValues([]);
+			}
+
+			return $layer->setAllowChildOverride(true);
+		}
+
+		$allowChildOverride = $this->appConfig->getAppValueString(
+			$this->getSystemAllowOverrideConfigKey($definition->getAppConfigKey()),
+			'0',
+		) === '1';
+
+		return $layer
+			->setAllowChildOverride($allowChildOverride)
+			->setAllowedValues($allowChildOverride ? [] : [$value]);
+	}
+
+	#[\Override]
+	public function loadGroupPolicies(string $policyKey, PolicyContext $context): array {
+		$groupIds = $this->resolveGroupIds($context);
+		if ($groupIds === []) {
+			return [];
+		}
+
+		$bindingsByTargetId = [];
+		foreach ($this->bindingMapper->findByTargets('group', $groupIds) as $binding) {
+			$bindingsByTargetId[$binding->getTargetId()] = $binding;
+		}
+
+		$permissionSetIds = [];
+		foreach ($bindingsByTargetId as $binding) {
+			$permissionSetIds[] = $binding->getPermissionSetId();
+		}
+
+		$permissionSetsById = [];
+		foreach ($this->permissionSetMapper->findByIds(array_values(array_unique($permissionSetIds))) as $permissionSet) {
+			$permissionSetsById[$permissionSet->getId()] = $permissionSet;
+		}
+
+		$layers = [];
+
+		foreach ($groupIds as $groupId) {
+			$binding = $bindingsByTargetId[$groupId] ?? null;
+			if (!$binding instanceof PermissionSetBinding) {
+				continue;
+			}
+
+			$permissionSet = $permissionSetsById[$binding->getPermissionSetId()] ?? null;
+			if (!$permissionSet instanceof PermissionSet) {
+				continue;
+			}
+
+			$policyConfig = $permissionSet->getDecodedPolicyJson()[$policyKey] ?? null;
+			if (!is_array($policyConfig)) {
+				continue;
+			}
+
+			$layers[] = (new PolicyLayer())
+				->setScope('group')
+				->setValue($policyConfig['defaultValue'] ?? null)
+				->setAllowChildOverride((bool)($policyConfig['allowChildOverride'] ?? false))
+				->setVisibleToChild((bool)($policyConfig['visibleToChild'] ?? true))
+				->setAllowedValues(is_array($policyConfig['allowedValues'] ?? null) ? $policyConfig['allowedValues'] : []);
+		}
+
+		return $layers;
+	}
+
+	#[\Override]
+	public function loadCirclePolicies(string $policyKey, PolicyContext $context): array {
+		return [];
+	}
+
+	#[\Override]
+	public function loadUserPreference(string $policyKey, PolicyContext $context): ?PolicyLayer {
+		$userId = $context->getUserId();
+		if ($userId === null || $userId === '') {
+			return null;
+		}
+
+		$definition = $this->registry->get($policyKey);
+		$value = $this->appConfig->getUserValue($userId, $definition->getUserPreferenceKey(), '');
+		if ($value === '') {
+			return null;
+		}
+
+		return (new PolicyLayer())
+			->setScope('user')
+			->setValue($definition->normalizeValue($value));
+	}
+
+	#[\Override]
+	public function loadRequestOverride(string $policyKey, PolicyContext $context): ?PolicyLayer {
+		$requestOverrides = $context->getRequestOverrides();
+		if (!array_key_exists($policyKey, $requestOverrides)) {
+			return null;
+		}
+
+		$definition = $this->registry->get($policyKey);
+
+		return (new PolicyLayer())
+			->setScope('request')
+			->setValue($definition->normalizeValue($requestOverrides[$policyKey]));
+	}
+
+	#[\Override]
+	public function loadGroupPolicyConfig(string $policyKey, string $groupId): ?PolicyLayer {
+		$permissionSet = $this->findPermissionSetByGroupId($groupId);
+		if (!$permissionSet instanceof PermissionSet) {
+			return null;
+		}
+
+		$policyConfig = $permissionSet->getDecodedPolicyJson()[$policyKey] ?? null;
+		if (!is_array($policyConfig)) {
+			return null;
+		}
+
+		return $this->createGroupPolicyLayer($policyConfig);
+	}
+
+	#[\Override]
+	public function saveSystemPolicy(string $policyKey, mixed $value, bool $allowChildOverride = false): void {
+		$definition = $this->registry->get($policyKey);
+		$normalizedValue = $definition->normalizeValue($value);
+		$defaultValue = $definition->normalizeValue($definition->defaultSystemValue());
+		$allowOverrideConfigKey = $this->getSystemAllowOverrideConfigKey($definition->getAppConfigKey());
+
+		if ($normalizedValue === $defaultValue) {
+			if ($allowChildOverride) {
+				$this->writeSystemValue($definition->getAppConfigKey(), $normalizedValue);
+				$this->appConfig->setAppValueString($allowOverrideConfigKey, '1');
+				return;
+			}
+
+			$this->appConfig->deleteAppValue($definition->getAppConfigKey());
+			$this->appConfig->deleteAppValue($allowOverrideConfigKey);
+			return;
+		}
+
+		$this->writeSystemValue($definition->getAppConfigKey(), $normalizedValue);
+		$this->appConfig->setAppValueString($allowOverrideConfigKey, $allowChildOverride ? '1' : '0');
+	}
+
+	private function readSystemValue(string $key, mixed $defaultValue): mixed {
+		if (is_int($defaultValue)) {
+			return $this->appConfig->getAppValueInt($key, $defaultValue);
+		}
+
+		if (is_bool($defaultValue)) {
+			return $this->appConfig->getAppValueBool($key, $defaultValue);
+		}
+
+		if (is_float($defaultValue)) {
+			return $this->appConfig->getAppValueFloat($key, $defaultValue);
+		}
+
+		if (is_array($defaultValue)) {
+			return $this->appConfig->getAppValueArray($key, $defaultValue);
+		}
+
+		return $this->appConfig->getAppValueString($key, (string)$defaultValue);
+	}
+
+	private function writeSystemValue(string $key, mixed $value): void {
+		if (is_int($value)) {
+			$this->appConfig->setAppValueInt($key, $value);
+			return;
+		}
+
+		if (is_bool($value)) {
+			$this->appConfig->setAppValueBool($key, $value);
+			return;
+		}
+
+		if (is_float($value)) {
+			$this->appConfig->setAppValueFloat($key, $value);
+			return;
+		}
+
+		if (is_array($value)) {
+			$this->appConfig->setAppValueArray($key, $value);
+			return;
+		}
+
+		$this->appConfig->setAppValueString($key, (string)$value);
+	}
+
+	private function getSystemAllowOverrideConfigKey(string $policyConfigKey): string {
+		return $policyConfigKey . '.allow_child_override';
+	}
+
+	#[\Override]
+	public function saveGroupPolicy(string $policyKey, string $groupId, mixed $value, bool $allowChildOverride): void {
+		$definition = $this->registry->get($policyKey);
+		$normalizedValue = $definition->normalizeValue($value);
+		$permissionSet = $this->findPermissionSetByGroupId($groupId);
+		$now = new \DateTime('now', new \DateTimeZone('UTC'));
+
+		if (!$permissionSet instanceof PermissionSet) {
+			$permissionSet = new PermissionSet();
+			$permissionSet->setName('group:' . $groupId);
+			$permissionSet->setScopeType('group');
+			$permissionSet->setCreatedAt($now);
+		}
+
+		$policyJson = $permissionSet->getDecodedPolicyJson();
+		$policyJson[$policyKey] = [
+			'defaultValue' => $normalizedValue,
+			'allowChildOverride' => $allowChildOverride,
+			'visibleToChild' => true,
+			'allowedValues' => $allowChildOverride ? [] : [$normalizedValue],
+		];
+
+		$permissionSet->setPolicyJson($policyJson);
+		$permissionSet->setUpdatedAt($now);
+
+		if ($permissionSet->getId() > 0) {
+			$this->permissionSetMapper->update($permissionSet);
+			return;
+		}
+
+		/** @var PermissionSet $permissionSet */
+		$permissionSet = $this->permissionSetMapper->insert($permissionSet);
+
+		$binding = new PermissionSetBinding();
+		$binding->setPermissionSetId($permissionSet->getId());
+		$binding->setTargetType('group');
+		$binding->setTargetId($groupId);
+		$binding->setCreatedAt($now);
+
+		$this->bindingMapper->insert($binding);
+	}
+
+	#[\Override]
+	public function clearGroupPolicy(string $policyKey, string $groupId): void {
+		$binding = $this->findBindingByGroupId($groupId);
+		if (!$binding instanceof PermissionSetBinding) {
+			return;
+		}
+
+		$permissionSet = $this->findPermissionSetByBinding($binding);
+		if (!$permissionSet instanceof PermissionSet) {
+			return;
+		}
+
+		$policyJson = $permissionSet->getDecodedPolicyJson();
+		unset($policyJson[$policyKey]);
+
+		if ($policyJson === []) {
+			$this->bindingMapper->delete($binding);
+			$this->permissionSetMapper->delete($permissionSet);
+			return;
+		}
+
+		$permissionSet->setPolicyJson($policyJson);
+		$permissionSet->setUpdatedAt(new \DateTime('now', new \DateTimeZone('UTC')));
+		$this->permissionSetMapper->update($permissionSet);
+	}
+
+	#[\Override]
+	public function saveUserPreference(string $policyKey, PolicyContext $context, mixed $value): void {
+		$userId = $context->getUserId();
+		if ($userId === null || $userId === '') {
+			throw new \InvalidArgumentException('A signed-in user is required to save a policy preference.');
+		}
+
+		$definition = $this->registry->get($policyKey);
+		$normalizedValue = $definition->normalizeValue($value);
+		$this->appConfig->setUserValue($userId, $definition->getUserPreferenceKey(), (string)$normalizedValue);
+	}
+
+	#[\Override]
+	public function clearUserPreference(string $policyKey, PolicyContext $context): void {
+		$userId = $context->getUserId();
+		if ($userId === null || $userId === '') {
+			return;
+		}
+
+		$definition = $this->registry->get($policyKey);
+		$this->appConfig->deleteUserValue($userId, $definition->getUserPreferenceKey());
+	}
+
+	/** @return list<string> */
+	private function resolveGroupIds(PolicyContext $context): array {
+		$activeContext = $context->getActiveContext();
+		if (($activeContext['type'] ?? null) === 'group' && is_string($activeContext['id'] ?? null)) {
+			return [$activeContext['id']];
+		}
+
+		return $context->getGroups();
+	}
+
+	/** @param array<string, mixed> $policyConfig */
+	private function createGroupPolicyLayer(array $policyConfig): PolicyLayer {
+		return (new PolicyLayer())
+			->setScope('group')
+			->setValue($policyConfig['defaultValue'] ?? null)
+			->setAllowChildOverride((bool)($policyConfig['allowChildOverride'] ?? false))
+			->setVisibleToChild((bool)($policyConfig['visibleToChild'] ?? true))
+			->setAllowedValues(is_array($policyConfig['allowedValues'] ?? null) ? $policyConfig['allowedValues'] : []);
+	}
+
+	private function findBindingByGroupId(string $groupId): ?PermissionSetBinding {
+		try {
+			return $this->bindingMapper->getByTarget('group', $groupId);
+		} catch (DoesNotExistException) {
+			return null;
+		}
+	}
+
+	private function findPermissionSetByBinding(PermissionSetBinding $binding): ?PermissionSet {
+		try {
+			return $this->permissionSetMapper->getById($binding->getPermissionSetId());
+		} catch (DoesNotExistException) {
+			return null;
+		}
+	}
+
+	private function findPermissionSetByGroupId(string $groupId): ?PermissionSet {
+		$binding = $this->findBindingByGroupId($groupId);
+		if (!$binding instanceof PermissionSetBinding) {
+			return null;
+		}
+
+		return $this->findPermissionSetByBinding($binding);
+	}
+}
diff --git a/lib/Service/RequestSignatureService.php b/lib/Service/RequestSignatureService.php
index 78320822ec..c6beced524 100644
--- a/lib/Service/RequestSignatureService.php
+++ b/lib/Service/RequestSignatureService.php
@@ -8,13 +8,13 @@
 
 namespace OCA\Libresign\Service;
 
-use OCA\Libresign\AppInfo\Application;
 use OCA\Libresign\Db\File as FileEntity;
 use OCA\Libresign\Db\FileElementMapper;
 use OCA\Libresign\Db\FileMapper;
 use OCA\Libresign\Db\IdentifyMethodMapper;
 use OCA\Libresign\Db\SignRequest as SignRequestEntity;
 use OCA\Libresign\Db\SignRequestMapper;
+use OCA\Libresign\Enum\DocMdpLevel;
 use OCA\Libresign\Enum\FileStatus;
 use OCA\Libresign\Enum\SignatureFlow;
 use OCA\Libresign\Events\SignRequestCanceledEvent;
@@ -27,6 +27,10 @@
 use OCA\Libresign\Service\Envelope\EnvelopeService;
 use OCA\Libresign\Service\File\Pdf\PdfMetadataExtractor;
 use OCA\Libresign\Service\IdentifyMethod\IIdentifyMethod;
+use OCA\Libresign\Service\Policy\Model\ResolvedPolicy;
+use OCA\Libresign\Service\Policy\PolicyService;
+use OCA\Libresign\Service\Policy\Provider\DocMdp\DocMdpPolicy;
+use OCA\Libresign\Service\Policy\Provider\Signature\SignatureFlowPolicy;
 use OCA\Libresign\Service\SignRequest\SignRequestService;
 use OCP\EventDispatcher\IEventDispatcher;
 use OCP\Files\IMimeTypeDetector;
@@ -67,6 +71,7 @@ public function __construct(
 		protected EnvelopeFileRelocator $envelopeFileRelocator,
 		protected FileUploadHelper $uploadHelper,
 		protected SignRequestService $signRequestService,
+		protected PolicyService $policyService,
 	) {
 	}
 
@@ -317,6 +322,7 @@ public function saveFile(array $data): FileEntity {
 		if (!empty($data['uuid'])) {
 			$file = $this->fileMapper->getByUuid($data['uuid']);
 			$this->updateSignatureFlowIfAllowed($file, $data);
+			$this->updateDocMdpLevelFromPolicy($file, $data);
 			if (!empty($data['name'])) {
 				$file->setName($data['name']);
 				$this->fileService->update($file);
@@ -333,6 +339,7 @@ public function saveFile(array $data): FileEntity {
 			try {
 				$file = $this->fileMapper->getByNodeId($fileId);
 				$this->updateSignatureFlowIfAllowed($file, $data);
+				$this->updateDocMdpLevelFromPolicy($file, $data);
 				return $this->fileStatusService->updateFileStatusIfUpgrade($file, $data['status'] ?? 0);
 			} catch (\Throwable) {
 			}
@@ -374,51 +381,109 @@ public function saveFile(array $data): FileEntity {
 		}
 
 		$this->setSignatureFlow($file, $data);
-		$this->setDocMdpLevelFromGlobalConfig($file);
+		$this->setDocMdpLevelFromPolicy($file, $data);
 
 		$this->fileMapper->insert($file);
 		return $file;
 	}
 
 	private function updateSignatureFlowIfAllowed(FileEntity $file, array $data): void {
-		$adminFlow = $this->appConfig->getValueString(Application::APP_ID, 'signature_flow', SignatureFlow::NONE->value);
-		$adminForcedConfig = $adminFlow !== SignatureFlow::NONE->value;
+		$requestOverrides = $this->getSignatureFlowRequestOverrides($data);
+		$resolvedPolicy = $this->policyService->resolveForUserId(
+			SignatureFlowPolicy::KEY,
+			$file->getUserId(),
+			$requestOverrides,
+		);
+		$this->assertSignatureFlowOverrideAllowed($requestOverrides, $resolvedPolicy);
+		$newFlow = SignatureFlow::from((string)$resolvedPolicy->getEffectiveValue());
+		$metadataBeforeUpdate = $file->getMetadata() ?? [];
+		$this->storePolicySnapshot($file, $resolvedPolicy);
+		$metadataChanged = ($file->getMetadata() ?? []) !== $metadataBeforeUpdate;
+
+		if ($file->getSignatureFlowEnum() !== $newFlow || $metadataChanged) {
+			$file->setSignatureFlowEnum($newFlow);
+			$this->fileService->update($file);
+		}
+	}
 
-		if ($adminForcedConfig) {
-			$adminFlowEnum = SignatureFlow::from($adminFlow);
-			if ($file->getSignatureFlowEnum() !== $adminFlowEnum) {
-				$file->setSignatureFlowEnum($adminFlowEnum);
-				$this->fileService->update($file);
-			}
-			return;
+	private function setSignatureFlow(FileEntity $file, array $data): void {
+		$user = ($data['userManager'] ?? null) instanceof IUser ? $data['userManager'] : null;
+		$requestOverrides = $this->getSignatureFlowRequestOverrides($data);
+		$resolvedPolicy = $this->policyService->resolveForUser(
+			SignatureFlowPolicy::KEY,
+			$user,
+			$requestOverrides,
+		);
+		$this->assertSignatureFlowOverrideAllowed($requestOverrides, $resolvedPolicy);
+		$file->setSignatureFlowEnum(SignatureFlow::from((string)$resolvedPolicy->getEffectiveValue()));
+		$this->storePolicySnapshot($file, $resolvedPolicy);
+	}
+
+	/** @return array<string, string> */
+	private function getSignatureFlowRequestOverrides(array $data): array {
+		if (!isset($data['signatureFlow']) || empty($data['signatureFlow'])) {
+			return [];
 		}
 
-		if (isset($data['signatureFlow']) && !empty($data['signatureFlow'])) {
-			$newFlow = SignatureFlow::from($data['signatureFlow']);
-			if ($file->getSignatureFlowEnum() !== $newFlow) {
-				$file->setSignatureFlowEnum($newFlow);
-				$this->fileService->update($file);
-			}
+		return [SignatureFlowPolicy::KEY => (string)$data['signatureFlow']];
+	}
+
+	/** @param array<string, string> $requestOverrides */
+	private function assertSignatureFlowOverrideAllowed(array $requestOverrides, ResolvedPolicy $resolvedPolicy): void {
+		if ($requestOverrides === [] || $resolvedPolicy->canUseAsRequestOverride()) {
+			return;
 		}
+
+		$blockedBy = $resolvedPolicy->getBlockedBy() ?? $resolvedPolicy->getSourceScope();
+		throw new LibresignException($this->l10n->t('Signature flow override is blocked by %s.', [$blockedBy]), 422);
 	}
 
-	private function setSignatureFlow(FileEntity $file, array $data): void {
-		$adminFlow = $this->appConfig->getValueString(Application::APP_ID, 'signature_flow', SignatureFlow::NONE->value);
+	private function storePolicySnapshot(FileEntity $file, ResolvedPolicy $resolvedPolicy): void {
+		$metadata = $file->getMetadata() ?? [];
+		$policySnapshot = $metadata['policy_snapshot'] ?? [];
+		$policySnapshot[$resolvedPolicy->getPolicyKey()] = [
+			'effectiveValue' => $resolvedPolicy->getEffectiveValue(),
+			'sourceScope' => $resolvedPolicy->getSourceScope(),
+		];
+		$metadata['policy_snapshot'] = $policySnapshot;
+		$file->setMetadata($metadata);
+	}
 
-		if (isset($data['signatureFlow']) && !empty($data['signatureFlow'])) {
-			$file->setSignatureFlowEnum(SignatureFlow::from($data['signatureFlow']));
-		} elseif ($adminFlow !== SignatureFlow::NONE->value) {
-			$file->setSignatureFlowEnum(SignatureFlow::from($adminFlow));
-		} else {
-			$file->setSignatureFlowEnum(SignatureFlow::NONE);
+	private function updateDocMdpLevelFromPolicy(FileEntity $file, array $data): void {
+		$resolvedPolicy = $this->policyService->resolveForUserId(
+			DocMdpPolicy::KEY,
+			$file->getUserId(),
+			$this->getDocMdpRequestOverrides($data),
+		);
+		$newLevel = DocMdpLevel::tryFrom((int)$resolvedPolicy->getEffectiveValue()) ?? DocMdpLevel::NOT_CERTIFIED;
+		$metadataBeforeUpdate = $file->getMetadata() ?? [];
+		$this->storePolicySnapshot($file, $resolvedPolicy);
+		$metadataChanged = ($file->getMetadata() ?? []) !== $metadataBeforeUpdate;
+
+		if ($file->getDocmdpLevelEnum() !== $newLevel || $metadataChanged) {
+			$file->setDocmdpLevelEnum($newLevel);
+			$this->fileService->update($file);
 		}
 	}
 
-	private function setDocMdpLevelFromGlobalConfig(FileEntity $file): void {
-		if ($this->docMdpConfigService->isEnabled()) {
-			$docmdpLevel = $this->docMdpConfigService->getLevel();
-			$file->setDocmdpLevelEnum($docmdpLevel);
+	private function setDocMdpLevelFromPolicy(FileEntity $file, array $data): void {
+		$user = ($data['userManager'] ?? null) instanceof IUser ? $data['userManager'] : null;
+		$resolvedPolicy = $this->policyService->resolveForUser(
+			DocMdpPolicy::KEY,
+			$user,
+			$this->getDocMdpRequestOverrides($data),
+		);
+		$file->setDocmdpLevelEnum(DocMdpLevel::tryFrom((int)$resolvedPolicy->getEffectiveValue()) ?? DocMdpLevel::NOT_CERTIFIED);
+		$this->storePolicySnapshot($file, $resolvedPolicy);
+	}
+
+	/** @return array<string, int> */
+	private function getDocMdpRequestOverrides(array $data): array {
+		if (!isset($data['docmdpLevel']) || $data['docmdpLevel'] === null || $data['docmdpLevel'] === '') {
+			return [];
 		}
+
+		return [DocMdpPolicy::KEY => (int)$data['docmdpLevel']];
 	}
 
 	private function getFileMetadata(\OCP\Files\Node $node): array {
diff --git a/lib/Service/SignFileService.php b/lib/Service/SignFileService.php
index 93f243bdb2..527f189c17 100644
--- a/lib/Service/SignFileService.php
+++ b/lib/Service/SignFileService.php
@@ -594,6 +594,22 @@ private function addCredentialsToJobArgs(array $args, SignRequestEntity $signReq
 		return $args;
 	}
 
+	private function runWithVolatileActiveUser(?IUser $user, callable $callback): mixed {
+		$currentUser = $this->userSession->getUser();
+
+		if ($user === null || $currentUser?->getUID() === $user->getUID()) {
+			return $callback();
+		}
+
+		$this->userSession->setVolatileActiveUser($user);
+
+		try {
+			return $callback();
+		} finally {
+			$this->userSession->setVolatileActiveUser($currentUser);
+		}
+	}
+
 	/**
 	 * @return DateTimeInterface|null Last signed date
 	 */
@@ -614,7 +630,11 @@ private function signSequentially(array $signRequests): ?DateTimeInterface {
 			$this->validateDocMdpAllowsSignatures();
 
 			try {
-				$signedFile = $this->getEngine()->sign();
+				$engine = $this->getEngine();
+				$signedFile = $this->runWithVolatileActiveUser(
+					$this->fileToSign?->getOwner(),
+					fn (): File => $engine->sign(),
+				);
 			} catch (LibresignException|Exception $e) {
 				$this->cleanupUnsignedSignedFile();
 				$this->recordSignatureAttempt($e);
@@ -1439,7 +1459,8 @@ private function createSignedFile(File $originalFile, string $content): File {
 			$this->l10n->t('signed') . '.' . $originalFile->getExtension(),
 			basename($originalFile->getPath())
 		);
-		$owner = $originalFile->getOwner()->getUID();
+		$owner = $originalFile->getOwner();
+		$ownerUid = $owner->getUID();
 
 		$fileId = $this->libreSignFile->getId();
 		$extension = $originalFile->getExtension();
@@ -1447,9 +1468,12 @@ private function createSignedFile(File $originalFile, string $content): File {
 
 		try {
 			/** @var \OCP\Files\Folder */
-			$parentFolder = $this->root->getUserFolder($owner)->getFirstNodeById($originalFile->getParentId());
+			$parentFolder = $this->root->getUserFolder($ownerUid)->getFirstNodeById($originalFile->getParentId());
 
-			$this->createdSignedFile = $parentFolder->newFile($uniqueFilename, $content);
+			$this->createdSignedFile = $this->runWithVolatileActiveUser(
+				$owner,
+				fn (): File => $parentFolder->newFile($uniqueFilename, $content),
+			);
 
 			return $this->createdSignedFile;
 		} catch (NotPermittedException) {
diff --git a/lib/Settings/Admin.php b/lib/Settings/Admin.php
index 411b28d16a..ac1458128e 100644
--- a/lib/Settings/Admin.php
+++ b/lib/Settings/Admin.php
@@ -11,15 +11,18 @@
 use OCA\Libresign\AppInfo\Application;
 use OCA\Libresign\Exception\LibresignException;
 use OCA\Libresign\Handler\CertificateEngine\CertificateEngineFactory;
+use OCA\Libresign\Service\AccountService;
 use OCA\Libresign\Service\CertificatePolicyService;
 use OCA\Libresign\Service\DocMdp\ConfigService as DocMdpConfigService;
 use OCA\Libresign\Service\FooterService;
 use OCA\Libresign\Service\IdentifyMethodService;
+use OCA\Libresign\Service\Policy\PolicyService;
 use OCA\Libresign\Service\SignatureBackgroundService;
 use OCA\Libresign\Service\SignatureTextService;
 use OCP\AppFramework\Http\TemplateResponse;
 use OCP\AppFramework\Services\IInitialState;
 use OCP\IAppConfig;
+use OCP\IUserSession;
 use OCP\Settings\ISettings;
 use OCP\Util;
 
@@ -33,6 +36,8 @@ class Admin implements ISettings {
 
 	public function __construct(
 		private IInitialState $initialState,
+		private AccountService $accountService,
+		private IUserSession $userSession,
 		private IdentifyMethodService $identifyMethodService,
 		private CertificateEngineFactory $certificateEngineFactory,
 		private CertificatePolicyService $certificatePolicyService,
@@ -41,12 +46,14 @@ public function __construct(
 		private SignatureBackgroundService $signatureBackgroundService,
 		private FooterService $footerService,
 		private DocMdpConfigService $docMdpConfigService,
+		private PolicyService $policyService,
 	) {
 	}
 	#[\Override]
 	public function getForm(): TemplateResponse {
 		Util::addScript(Application::APP_ID, 'libresign-settings');
 		Util::addStyle(Application::APP_ID, 'libresign-settings');
+		$this->initialState->provideInitialState('config', $this->accountService->getConfig($this->userSession->getUser()));
 		try {
 			$signatureParsed = $this->signatureTextService->parse();
 			$this->initialState->provideInitialState('signature_text_parsed', $signatureParsed['parsed']);
@@ -87,7 +94,13 @@ public function getForm(): TemplateResponse {
 		$this->initialState->provideInitialState('tsa_username', $this->appConfig->getValueString(Application::APP_ID, 'tsa_username', ''));
 		$this->initialState->provideInitialState('tsa_password', $this->appConfig->getValueString(Application::APP_ID, 'tsa_password', self::PASSWORD_PLACEHOLDER));
 		$this->initialState->provideInitialState('docmdp_config', $this->docMdpConfigService->getConfig());
-		$this->initialState->provideInitialState('signature_flow', $this->appConfig->getValueString(Application::APP_ID, 'signature_flow', \OCA\Libresign\Enum\SignatureFlow::NONE->value));
+		$resolvedPolicies = [];
+		foreach ($this->policyService->resolveKnownPolicies() as $policyKey => $resolvedPolicy) {
+			$resolvedPolicies[$policyKey] = $resolvedPolicy->toArray();
+		}
+		$this->initialState->provideInitialState('effective_policies', [
+			'policies' => $resolvedPolicies,
+		]);
 		$this->initialState->provideInitialState('signing_mode', $this->getSigningModeInitialState());
 		$this->initialState->provideInitialState('worker_type', $this->getWorkerTypeInitialState());
 		$this->initialState->provideInitialState('identification_documents', $this->appConfig->getValueBool(Application::APP_ID, 'identification_documents', false));
diff --git a/openapi-administration.json b/openapi-administration.json
index 849c63dc64..48e5a2bfa7 100644
--- a/openapi-administration.json
+++ b/openapi-administration.json
@@ -374,6 +374,87 @@
                     }
                 }
             },
+            "EffectivePolicyResponse": {
+                "type": "object",
+                "required": [
+                    "policy"
+                ],
+                "properties": {
+                    "policy": {
+                        "$ref": "#/components/schemas/EffectivePolicyState"
+                    }
+                }
+            },
+            "EffectivePolicyState": {
+                "type": "object",
+                "required": [
+                    "policyKey",
+                    "effectiveValue",
+                    "sourceScope",
+                    "visible",
+                    "editableByCurrentActor",
+                    "allowedValues",
+                    "canSaveAsUserDefault",
+                    "canUseAsRequestOverride",
+                    "preferenceWasCleared",
+                    "blockedBy"
+                ],
+                "properties": {
+                    "policyKey": {
+                        "type": "string"
+                    },
+                    "effectiveValue": {
+                        "$ref": "#/components/schemas/EffectivePolicyValue"
+                    },
+                    "sourceScope": {
+                        "type": "string"
+                    },
+                    "visible": {
+                        "type": "boolean"
+                    },
+                    "editableByCurrentActor": {
+                        "type": "boolean"
+                    },
+                    "allowedValues": {
+                        "type": "array",
+                        "items": {
+                            "$ref": "#/components/schemas/EffectivePolicyValue"
+                        }
+                    },
+                    "canSaveAsUserDefault": {
+                        "type": "boolean"
+                    },
+                    "canUseAsRequestOverride": {
+                        "type": "boolean"
+                    },
+                    "preferenceWasCleared": {
+                        "type": "boolean"
+                    },
+                    "blockedBy": {
+                        "type": "string",
+                        "nullable": true
+                    }
+                }
+            },
+            "EffectivePolicyValue": {
+                "nullable": true,
+                "anyOf": [
+                    {
+                        "type": "boolean"
+                    },
+                    {
+                        "type": "integer",
+                        "format": "int64"
+                    },
+                    {
+                        "type": "number",
+                        "format": "double"
+                    },
+                    {
+                        "type": "string"
+                    }
+                ]
+            },
             "EngineHandler": {
                 "type": "object",
                 "required": [
@@ -799,6 +880,114 @@
                         ]
                     }
                 }
+            },
+            "SystemPolicyResponse": {
+                "type": "object",
+                "required": [
+                    "policy"
+                ],
+                "properties": {
+                    "policy": {
+                        "$ref": "#/components/schemas/SystemPolicyState"
+                    }
+                }
+            },
+            "SystemPolicyState": {
+                "type": "object",
+                "required": [
+                    "policyKey",
+                    "scope",
+                    "value",
+                    "allowChildOverride",
+                    "visibleToChild",
+                    "allowedValues"
+                ],
+                "properties": {
+                    "policyKey": {
+                        "type": "string"
+                    },
+                    "scope": {
+                        "type": "string",
+                        "enum": [
+                            "system",
+                            "global"
+                        ]
+                    },
+                    "value": {
+                        "$ref": "#/components/schemas/EffectivePolicyValue",
+                        "nullable": true
+                    },
+                    "allowChildOverride": {
+                        "type": "boolean"
+                    },
+                    "visibleToChild": {
+                        "type": "boolean"
+                    },
+                    "allowedValues": {
+                        "type": "array",
+                        "items": {
+                            "$ref": "#/components/schemas/EffectivePolicyValue"
+                        }
+                    }
+                }
+            },
+            "SystemPolicyWriteResponse": {
+                "allOf": [
+                    {
+                        "$ref": "#/components/schemas/MessageResponse"
+                    },
+                    {
+                        "$ref": "#/components/schemas/EffectivePolicyResponse"
+                    }
+                ]
+            },
+            "UserPolicyResponse": {
+                "type": "object",
+                "required": [
+                    "policy"
+                ],
+                "properties": {
+                    "policy": {
+                        "$ref": "#/components/schemas/UserPolicyState"
+                    }
+                }
+            },
+            "UserPolicyState": {
+                "type": "object",
+                "required": [
+                    "policyKey",
+                    "scope",
+                    "targetId",
+                    "value"
+                ],
+                "properties": {
+                    "policyKey": {
+                        "type": "string"
+                    },
+                    "scope": {
+                        "type": "string",
+                        "enum": [
+                            "user"
+                        ]
+                    },
+                    "targetId": {
+                        "type": "string"
+                    },
+                    "value": {
+                        "$ref": "#/components/schemas/EffectivePolicyValue",
+                        "nullable": true
+                    }
+                }
+            },
+            "UserPolicyWriteResponse": {
+                "allOf": [
+                    {
+                        "$ref": "#/components/schemas/MessageResponse"
+                    },
+                    {
+                        "$ref": "#/components/schemas/UserPolicyResponse"
+                    }
+                ]
             }
         }
     },
@@ -3315,10 +3504,10 @@
                 }
             }
         },
-        "/ocs/v2.php/apps/libresign/api/{apiVersion}/admin/signature-flow/config": {
+        "/ocs/v2.php/apps/libresign/api/{apiVersion}/admin/docmdp/config": {
             "post": {
-                "operationId": "admin-set-signature-flow-config",
-                "summary": "Set signature flow configuration",
+                "operationId": "admin-set-doc-mdp-config",
+                "summary": "Configure DocMDP signature restrictions",
                 "description": "This endpoint requires admin access",
                 "tags": [
                     "admin"
@@ -3343,12 +3532,13 @@
                                 "properties": {
                                     "enabled": {
                                         "type": "boolean",
-                                        "description": "Whether to force a signature flow for all documents"
+                                        "description": "Whether to enable DocMDP restrictions"
                                     },
-                                    "mode": {
-                                        "type": "string",
-                                        "nullable": true,
-                                        "description": "Signature flow mode: 'parallel' or 'ordered_numeric' (only used when enabled is true)"
+                                    "defaultLevel": {
+                                        "type": "integer",
+                                        "format": "int64",
+                                        "default": 2,
+                                        "description": "DocMDP level: 1 (no changes), 2 (fill forms), 3 (add annotations)"
                                     }
                                 }
                             }
@@ -3411,7 +3601,7 @@
                         }
                     },
                     "400": {
-                        "description": "Invalid signature flow mode provided",
+                        "description": "Invalid DocMDP level provided",
                         "content": {
                             "application/json": {
                                 "schema": {
@@ -3473,10 +3663,10 @@
                 }
             }
         },
-        "/ocs/v2.php/apps/libresign/api/{apiVersion}/admin/docmdp/config": {
-            "post": {
-                "operationId": "admin-set-doc-mdp-config",
-                "summary": "Configure DocMDP signature restrictions",
+        "/ocs/v2.php/apps/libresign/api/{apiVersion}/admin/active-signings": {
+            "get": {
+                "operationId": "admin-get-active-signings",
+                "summary": "Get list of files currently being signed (status = SIGNING_IN_PROGRESS)",
                 "description": "This endpoint requires admin access",
                 "tags": [
                     "admin"
@@ -3489,31 +3679,6 @@
                         "basic_auth": []
                     }
                 ],
-                "requestBody": {
-                    "required": true,
-                    "content": {
-                        "application/json": {
-                            "schema": {
-                                "type": "object",
-                                "required": [
-                                    "enabled"
-                                ],
-                                "properties": {
-                                    "enabled": {
-                                        "type": "boolean",
-                                        "description": "Whether to enable DocMDP restrictions"
-                                    },
-                                    "defaultLevel": {
-                                        "type": "integer",
-                                        "format": "int64",
-                                        "default": 2,
-                                        "description": "DocMDP level: 1 (no changes), 2 (fill forms), 3 (add annotations)"
-                                    }
-                                }
-                            }
-                        }
-                    }
-                },
                 "parameters": [
                     {
                         "name": "apiVersion",
@@ -3540,37 +3705,7 @@
                 ],
                 "responses": {
                     "200": {
-                        "description": "Configuration saved successfully",
-                        "content": {
-                            "application/json": {
-                                "schema": {
-                                    "type": "object",
-                                    "required": [
-                                        "ocs"
-                                    ],
-                                    "properties": {
-                                        "ocs": {
-                                            "type": "object",
-                                            "required": [
-                                                "meta",
-                                                "data"
-                                            ],
-                                            "properties": {
-                                                "meta": {
-                                                    "$ref": "#/components/schemas/OCSMeta"
-                                                },
-                                                "data": {
-                                                    "$ref": "#/components/schemas/MessageResponse"
-                                                }
-                                            }
-                                        }
-                                    }
-                                }
-                            }
-                        }
-                    },
-                    "400": {
-                        "description": "Invalid DocMDP level provided",
+                        "description": "List of active signings",
                         "content": {
                             "application/json": {
                                 "schema": {
@@ -3590,7 +3725,7 @@
                                                     "$ref": "#/components/schemas/OCSMeta"
                                                 },
                                                 "data": {
-                                                    "$ref": "#/components/schemas/ErrorResponse"
+                                                    "$ref": "#/components/schemas/ActiveSigningsResponse"
                                                 }
                                             }
                                         }
@@ -3600,7 +3735,7 @@
                         }
                     },
                     "500": {
-                        "description": "Internal server error",
+                        "description": "",
                         "content": {
                             "application/json": {
                                 "schema": {
@@ -3632,13 +3767,13 @@
                 }
             }
         },
-        "/ocs/v2.php/apps/libresign/api/{apiVersion}/admin/active-signings": {
+        "/ocs/v2.php/apps/libresign/api/{apiVersion}/crl/list": {
             "get": {
-                "operationId": "admin-get-active-signings",
-                "summary": "Get list of files currently being signed (status = SIGNING_IN_PROGRESS)",
+                "operationId": "crl_api-list",
+                "summary": "List CRL entries with pagination and filters",
                 "description": "This endpoint requires admin access",
                 "tags": [
-                    "admin"
+                    "crl_api"
                 ],
                 "security": [
                     {
@@ -3662,117 +3797,13 @@
                         }
                     },
                     {
-                        "name": "OCS-APIRequest",
-                        "in": "header",
-                        "description": "Required to be true for the API request to pass",
-                        "required": true,
+                        "name": "page",
+                        "in": "query",
+                        "description": "Page number (1-based)",
                         "schema": {
-                            "type": "boolean",
-                            "default": true
-                        }
-                    }
-                ],
-                "responses": {
-                    "200": {
-                        "description": "List of active signings",
-                        "content": {
-                            "application/json": {
-                                "schema": {
-                                    "type": "object",
-                                    "required": [
-                                        "ocs"
-                                    ],
-                                    "properties": {
-                                        "ocs": {
-                                            "type": "object",
-                                            "required": [
-                                                "meta",
-                                                "data"
-                                            ],
-                                            "properties": {
-                                                "meta": {
-                                                    "$ref": "#/components/schemas/OCSMeta"
-                                                },
-                                                "data": {
-                                                    "$ref": "#/components/schemas/ActiveSigningsResponse"
-                                                }
-                                            }
-                                        }
-                                    }
-                                }
-                            }
-                        }
-                    },
-                    "500": {
-                        "description": "",
-                        "content": {
-                            "application/json": {
-                                "schema": {
-                                    "type": "object",
-                                    "required": [
-                                        "ocs"
-                                    ],
-                                    "properties": {
-                                        "ocs": {
-                                            "type": "object",
-                                            "required": [
-                                                "meta",
-                                                "data"
-                                            ],
-                                            "properties": {
-                                                "meta": {
-                                                    "$ref": "#/components/schemas/OCSMeta"
-                                                },
-                                                "data": {
-                                                    "$ref": "#/components/schemas/ErrorResponse"
-                                                }
-                                            }
-                                        }
-                                    }
-                                }
-                            }
-                        }
-                    }
-                }
-            }
-        },
-        "/ocs/v2.php/apps/libresign/api/{apiVersion}/crl/list": {
-            "get": {
-                "operationId": "crl_api-list",
-                "summary": "List CRL entries with pagination and filters",
-                "description": "This endpoint requires admin access",
-                "tags": [
-                    "crl_api"
-                ],
-                "security": [
-                    {
-                        "bearer_auth": []
-                    },
-                    {
-                        "basic_auth": []
-                    }
-                ],
-                "parameters": [
-                    {
-                        "name": "apiVersion",
-                        "in": "path",
-                        "required": true,
-                        "schema": {
-                            "type": "string",
-                            "enum": [
-                                "v1"
-                            ],
-                            "default": "v1"
-                        }
-                    },
-                    {
-                        "name": "page",
-                        "in": "query",
-                        "description": "Page number (1-based)",
-                        "schema": {
-                            "type": "integer",
-                            "format": "int64",
-                            "nullable": true
+                            "type": "integer",
+                            "format": "int64",
+                            "nullable": true
                         }
                     },
                     {
@@ -4076,6 +4107,579 @@
                 }
             }
         },
+        "/ocs/v2.php/apps/libresign/api/{apiVersion}/policies/system/{policyKey}": {
+            "get": {
+                "operationId": "policy-get-system",
+                "summary": "Read explicit system policy configuration",
+                "description": "This endpoint requires admin access",
+                "tags": [
+                    "policy"
+                ],
+                "security": [
+                    {
+                        "bearer_auth": []
+                    },
+                    {
+                        "basic_auth": []
+                    }
+                ],
+                "parameters": [
+                    {
+                        "name": "apiVersion",
+                        "in": "path",
+                        "required": true,
+                        "schema": {
+                            "type": "string",
+                            "enum": [
+                                "v1"
+                            ],
+                            "default": "v1"
+                        }
+                    },
+                    {
+                        "name": "policyKey",
+                        "in": "path",
+                        "description": "Policy identifier to read from the system layer.",
+                        "required": true,
+                        "schema": {
+                            "type": "string",
+                            "pattern": "^[a-z0-9_]+$"
+                        }
+                    },
+                    {
+                        "name": "OCS-APIRequest",
+                        "in": "header",
+                        "description": "Required to be true for the API request to pass",
+                        "required": true,
+                        "schema": {
+                            "type": "boolean",
+                            "default": true
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "content": {
+                            "application/json": {
+                                "schema": {
+                                    "type": "object",
+                                    "required": [
+                                        "ocs"
+                                    ],
+                                    "properties": {
+                                        "ocs": {
+                                            "type": "object",
+                                            "required": [
+                                                "meta",
+                                                "data"
+                                            ],
+                                            "properties": {
+                                                "meta": {
+                                                    "$ref": "#/components/schemas/OCSMeta"
+                                                },
+                                                "data": {
+                                                    "$ref": "#/components/schemas/SystemPolicyResponse"
+                                                }
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            },
+            "post": {
+                "operationId": "policy-set-system",
+                "summary": "Save a system-level policy value",
+                "description": "This endpoint requires admin access",
+                "tags": [
+                    "policy"
+                ],
+                "security": [
+                    {
+                        "bearer_auth": []
+                    },
+                    {
+                        "basic_auth": []
+                    }
+                ],
+                "requestBody": {
+                    "required": false,
+                    "content": {
+                        "application/json": {
+                            "schema": {
+                                "type": "object",
+                                "properties": {
+                                    "value": {
+                                        "nullable": true,
+                                        "description": "Policy value to persist. Null resets the policy to its default system value.",
+                                        "anyOf": [
+                                            {
+                                                "type": "boolean"
+                                            },
+                                            {
+                                                "type": "integer",
+                                                "format": "int64"
+                                            },
+                                            {
+                                                "type": "number",
+                                                "format": "double"
+                                            },
+                                            {
+                                                "type": "string"
+                                            }
+                                        ]
+                                    },
+                                    "allowChildOverride": {
+                                        "type": "boolean",
+                                        "default": false,
+                                        "description": "Whether lower layers may override this system default."
+                                    }
+                                }
+                            }
+                        }
+                    }
+                },
+                "parameters": [
+                    {
+                        "name": "apiVersion",
+                        "in": "path",
+                        "required": true,
+                        "schema": {
+                            "type": "string",
+                            "enum": [
+                                "v1"
+                            ],
+                            "default": "v1"
+                        }
+                    },
+                    {
+                        "name": "policyKey",
+                        "in": "path",
+                        "description": "Policy identifier to persist at the system layer.",
+                        "required": true,
+                        "schema": {
+                            "type": "string",
+                            "pattern": "^[a-z0-9_]+$"
+                        }
+                    },
+                    {
+                        "name": "OCS-APIRequest",
+                        "in": "header",
+                        "description": "Required to be true for the API request to pass",
+                        "required": true,
+                        "schema": {
+                            "type": "boolean",
+                            "default": true
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "content": {
+                            "application/json": {
+                                "schema": {
+                                    "type": "object",
+                                    "required": [
+                                        "ocs"
+                                    ],
+                                    "properties": {
+                                        "ocs": {
+                                            "type": "object",
+                                            "required": [
+                                                "meta",
+                                                "data"
+                                            ],
+                                            "properties": {
+                                                "meta": {
+                                                    "$ref": "#/components/schemas/OCSMeta"
+                                                },
+                                                "data": {
+                                                    "$ref": "#/components/schemas/SystemPolicyWriteResponse"
+                                                }
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    },
+                    "400": {
+                        "description": "Invalid policy value",
+                        "content": {
+                            "application/json": {
+                                "schema": {
+                                    "type": "object",
+                                    "required": [
+                                        "ocs"
+                                    ],
+                                    "properties": {
+                                        "ocs": {
+                                            "type": "object",
+                                            "required": [
+                                                "meta",
+                                                "data"
+                                            ],
+                                            "properties": {
+                                                "meta": {
+                                                    "$ref": "#/components/schemas/OCSMeta"
+                                                },
+                                                "data": {
+                                                    "$ref": "#/components/schemas/ErrorResponse"
+                                                }
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        },
+        "/ocs/v2.php/apps/libresign/api/{apiVersion}/policies/user/{userId}/{policyKey}": {
+            "get": {
+                "operationId": "policy-get-user-policy-for-user",
+                "summary": "Read a user-level policy preference for a target user (admin scope)",
+                "description": "This endpoint requires admin access",
+                "tags": [
+                    "policy"
+                ],
+                "security": [
+                    {
+                        "bearer_auth": []
+                    },
+                    {
+                        "basic_auth": []
+                    }
+                ],
+                "parameters": [
+                    {
+                        "name": "apiVersion",
+                        "in": "path",
+                        "required": true,
+                        "schema": {
+                            "type": "string",
+                            "enum": [
+                                "v1"
+                            ],
+                            "default": "v1"
+                        }
+                    },
+                    {
+                        "name": "userId",
+                        "in": "path",
+                        "description": "Target user identifier that receives the policy preference.",
+                        "required": true,
+                        "schema": {
+                            "type": "string",
+                            "pattern": "^[^/]+$"
+                        }
+                    },
+                    {
+                        "name": "policyKey",
+                        "in": "path",
+                        "description": "Policy identifier to read for the selected user.",
+                        "required": true,
+                        "schema": {
+                            "type": "string",
+                            "pattern": "^[a-z0-9_]+$"
+                        }
+                    },
+                    {
+                        "name": "OCS-APIRequest",
+                        "in": "header",
+                        "description": "Required to be true for the API request to pass",
+                        "required": true,
+                        "schema": {
+                            "type": "boolean",
+                            "default": true
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "content": {
+                            "application/json": {
+                                "schema": {
+                                    "type": "object",
+                                    "required": [
+                                        "ocs"
+                                    ],
+                                    "properties": {
+                                        "ocs": {
+                                            "type": "object",
+                                            "required": [
+                                                "meta",
+                                                "data"
+                                            ],
+                                            "properties": {
+                                                "meta": {
+                                                    "$ref": "#/components/schemas/OCSMeta"
+                                                },
+                                                "data": {
+                                                    "$ref": "#/components/schemas/UserPolicyResponse"
+                                                }
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            },
+            "put": {
+                "operationId": "policy-set-user-policy-for-user",
+                "summary": "Save a user policy preference for a target user (admin scope)",
+                "description": "This endpoint requires admin access",
+                "tags": [
+                    "policy"
+                ],
+                "security": [
+                    {
+                        "bearer_auth": []
+                    },
+                    {
+                        "basic_auth": []
+                    }
+                ],
+                "requestBody": {
+                    "required": false,
+                    "content": {
+                        "application/json": {
+                            "schema": {
+                                "type": "object",
+                                "properties": {
+                                    "value": {
+                                        "nullable": true,
+                                        "description": "Policy value to persist as target user preference.",
+                                        "anyOf": [
+                                            {
+                                                "type": "boolean"
+                                            },
+                                            {
+                                                "type": "integer",
+                                                "format": "int64"
+                                            },
+                                            {
+                                                "type": "number",
+                                                "format": "double"
+                                            },
+                                            {
+                                                "type": "string"
+                                            }
+                                        ]
+                                    }
+                                }
+                            }
+                        }
+                    }
+                },
+                "parameters": [
+                    {
+                        "name": "apiVersion",
+                        "in": "path",
+                        "required": true,
+                        "schema": {
+                            "type": "string",
+                            "enum": [
+                                "v1"
+                            ],
+                            "default": "v1"
+                        }
+                    },
+                    {
+                        "name": "userId",
+                        "in": "path",
+                        "description": "Target user identifier that receives the policy preference.",
+                        "required": true,
+                        "schema": {
+                            "type": "string",
+                            "pattern": "^[^/]+$"
+                        }
+                    },
+                    {
+                        "name": "policyKey",
+                        "in": "path",
+                        "description": "Policy identifier to persist for the target user.",
+                        "required": true,
+                        "schema": {
+                            "type": "string",
+                            "pattern": "^[a-z0-9_]+$"
+                        }
+                    },
+                    {
+                        "name": "OCS-APIRequest",
+                        "in": "header",
+                        "description": "Required to be true for the API request to pass",
+                        "required": true,
+                        "schema": {
+                            "type": "boolean",
+                            "default": true
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "content": {
+                            "application/json": {
+                                "schema": {
+                                    "type": "object",
+                                    "required": [
+                                        "ocs"
+                                    ],
+                                    "properties": {
+                                        "ocs": {
+                                            "type": "object",
+                                            "required": [
+                                                "meta",
+                                                "data"
+                                            ],
+                                            "properties": {
+                                                "meta": {
+                                                    "$ref": "#/components/schemas/OCSMeta"
+                                                },
+                                                "data": {
+                                                    "$ref": "#/components/schemas/UserPolicyWriteResponse"
+                                                }
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    },
+                    "400": {
+                        "description": "Invalid policy value",
+                        "content": {
+                            "application/json": {
+                                "schema": {
+                                    "type": "object",
+                                    "required": [
+                                        "ocs"
+                                    ],
+                                    "properties": {
+                                        "ocs": {
+                                            "type": "object",
+                                            "required": [
+                                                "meta",
+                                                "data"
+                                            ],
+                                            "properties": {
+                                                "meta": {
+                                                    "$ref": "#/components/schemas/OCSMeta"
+                                                },
+                                                "data": {
+                                                    "$ref": "#/components/schemas/ErrorResponse"
+                                                }
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            },
+            "delete": {
+                "operationId": "policy-clear-user-policy-for-user",
+                "summary": "Clear a user policy preference for a target user (admin scope)",
+                "description": "This endpoint requires admin access",
+                "tags": [
+                    "policy"
+                ],
+                "security": [
+                    {
+                        "bearer_auth": []
+                    },
+                    {
+                        "basic_auth": []
+                    }
+                ],
+                "parameters": [
+                    {
+                        "name": "apiVersion",
+                        "in": "path",
+                        "required": true,
+                        "schema": {
+                            "type": "string",
+                            "enum": [
+                                "v1"
+                            ],
+                            "default": "v1"
+                        }
+                    },
+                    {
+                        "name": "userId",
+                        "in": "path",
+                        "description": "Target user identifier that receives the policy preference removal.",
+                        "required": true,
+                        "schema": {
+                            "type": "string",
+                            "pattern": "^[^/]+$"
+                        }
+                    },
+                    {
+                        "name": "policyKey",
+                        "in": "path",
+                        "description": "Policy identifier to clear for the target user.",
+                        "required": true,
+                        "schema": {
+                            "type": "string",
+                            "pattern": "^[a-z0-9_]+$"
+                        }
+                    },
+                    {
+                        "name": "OCS-APIRequest",
+                        "in": "header",
+                        "description": "Required to be true for the API request to pass",
+                        "required": true,
+                        "schema": {
+                            "type": "boolean",
+                            "default": true
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "content": {
+                            "application/json": {
+                                "schema": {
+                                    "type": "object",
+                                    "required": [
+                                        "ocs"
+                                    ],
+                                    "properties": {
+                                        "ocs": {
+                                            "type": "object",
+                                            "required": [
+                                                "meta",
+                                                "data"
+                                            ],
+                                            "properties": {
+                                                "meta": {
+                                                    "$ref": "#/components/schemas/OCSMeta"
+                                                },
+                                                "data": {
+                                                    "$ref": "#/components/schemas/UserPolicyWriteResponse"
+                                                }
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        },
         "/ocs/v2.php/apps/libresign/api/{apiVersion}/setting/has-root-cert": {
             "get": {
                 "operationId": "setting-has-root-cert",
diff --git a/openapi-full.json b/openapi-full.json
index 157caffe52..044ceafec5 100644
--- a/openapi-full.json
+++ b/openapi-full.json
@@ -947,6 +947,101 @@
                     }
                 }
             },
+            "EffectivePoliciesResponse": {
+                "type": "object",
+                "required": [
+                    "policies"
+                ],
+                "properties": {
+                    "policies": {
+                        "type": "object",
+                        "additionalProperties": {
+                            "$ref": "#/components/schemas/EffectivePolicyState"
+                        }
+                    }
+                }
+            },
+            "EffectivePolicyResponse": {
+                "type": "object",
+                "required": [
+                    "policy"
+                ],
+                "properties": {
+                    "policy": {
+                        "$ref": "#/components/schemas/EffectivePolicyState"
+                    }
+                }
+            },
+            "EffectivePolicyState": {
+                "type": "object",
+                "required": [
+                    "policyKey",
+                    "effectiveValue",
+                    "sourceScope",
+                    "visible",
+                    "editableByCurrentActor",
+                    "allowedValues",
+                    "canSaveAsUserDefault",
+                    "canUseAsRequestOverride",
+                    "preferenceWasCleared",
+                    "blockedBy"
+                ],
+                "properties": {
+                    "policyKey": {
+                        "type": "string"
+                    },
+                    "effectiveValue": {
+                        "$ref": "#/components/schemas/EffectivePolicyValue"
+                    },
+                    "sourceScope": {
+                        "type": "string"
+                    },
+                    "visible": {
+                        "type": "boolean"
+                    },
+                    "editableByCurrentActor": {
+                        "type": "boolean"
+                    },
+                    "allowedValues": {
+                        "type": "array",
+                        "items": {
+                            "$ref": "#/components/schemas/EffectivePolicyValue"
+                        }
+                    },
+                    "canSaveAsUserDefault": {
+                        "type": "boolean"
+                    },
+                    "canUseAsRequestOverride": {
+                        "type": "boolean"
+                    },
+                    "preferenceWasCleared": {
+                        "type": "boolean"
+                    },
+                    "blockedBy": {
+                        "type": "string",
+                        "nullable": true
+                    }
+                }
+            },
+            "EffectivePolicyValue": {
+                "nullable": true,
+                "anyOf": [
+                    {
+                        "type": "boolean"
+                    },
+                    {
+                        "type": "integer",
+                        "format": "int64"
+                    },
+                    {
+                        "type": "number",
+                        "format": "double"
+                    },
+                    {
+                        "type": "string"
+                    }
+                ]
+            },
             "EngineHandler": {
                 "type": "object",
                 "required": [
@@ -1447,6 +1542,84 @@
                     }
                 }
             },
+            "GroupPolicyResponse": {
+                "type": "object",
+                "required": [
+                    "policy"
+                ],
+                "properties": {
+                    "policy": {
+                        "$ref": "#/components/schemas/GroupPolicyState"
+                    }
+                }
+            },
+            "GroupPolicyState": {
+                "type": "object",
+                "required": [
+                    "policyKey",
+                    "scope",
+                    "targetId",
+                    "value",
+                    "allowChildOverride",
+                    "visibleToChild",
+                    "allowedValues"
+                ],
+                "properties": {
+                    "policyKey": {
+                        "type": "string"
+                    },
+                    "scope": {
+                        "type": "string",
+                        "enum": [
+                            "group"
+                        ]
+                    },
+                    "targetId": {
+                        "type": "string"
+                    },
+                    "value": {
+                        "$ref": "#/components/schemas/EffectivePolicyValue",
+                        "nullable": true
+                    },
+                    "allowChildOverride": {
+                        "type": "boolean"
+                    },
+                    "visibleToChild": {
+                        "type": "boolean"
+                    },
+                    "allowedValues": {
+                        "type": "array",
+                        "items": {
+                            "$ref": "#/components/schemas/EffectivePolicyValue"
+                        }
+                    }
+                }
+            },
+            "GroupPolicyWriteRequest": {
+                "type": "object",
+                "required": [
+                    "value",
+                    "allowChildOverride"
+                ],
+                "properties": {
+                    "value": {
+                        "$ref": "#/components/schemas/EffectivePolicyValue"
+                    },
+                    "allowChildOverride": {
+                        "type": "boolean"
+                    }
+                }
+            },
+            "GroupPolicyWriteResponse": {
+                "allOf": [
+                    {
+                        "$ref": "#/components/schemas/MessageResponse"
+                    },
+                    {
+                        "$ref": "#/components/schemas/GroupPolicyResponse"
+                    }
+                ]
+            },
             "HasRootCertResponse": {
                 "type": "object",
                 "required": [
@@ -1862,6 +2035,37 @@
                     }
                 }
             },
+            "PolicySnapshotEntry": {
+                "type": "object",
+                "required": [
+                    "effectiveValue",
+                    "sourceScope"
+                ],
+                "properties": {
+                    "effectiveValue": {
+                        "type": "string"
+                    },
+                    "sourceScope": {
+                        "type": "string"
+                    }
+                }
+            },
+            "PolicySnapshotNumericEntry": {
+                "type": "object",
+                "required": [
+                    "effectiveValue",
+                    "sourceScope"
+                ],
+                "properties": {
+                    "effectiveValue": {
+                        "type": "integer",
+                        "format": "int64"
+                    },
+                    "sourceScope": {
+                        "type": "string"
+                    }
+                }
+            },
             "ProgressError": {
                 "type": "object",
                 "required": [
@@ -2516,6 +2720,77 @@
                     }
                 }
             },
+            "SystemPolicyResponse": {
+                "type": "object",
+                "required": [
+                    "policy"
+                ],
+                "properties": {
+                    "policy": {
+                        "$ref": "#/components/schemas/SystemPolicyState"
+                    }
+                }
+            },
+            "SystemPolicyState": {
+                "type": "object",
+                "required": [
+                    "policyKey",
+                    "scope",
+                    "value",
+                    "allowChildOverride",
+                    "visibleToChild",
+                    "allowedValues"
+                ],
+                "properties": {
+                    "policyKey": {
+                        "type": "string"
+                    },
+                    "scope": {
+                        "type": "string",
+                        "enum": [
+                            "system",
+                            "global"
+                        ]
+                    },
+                    "value": {
+                        "$ref": "#/components/schemas/EffectivePolicyValue",
+                        "nullable": true
+                    },
+                    "allowChildOverride": {
+                        "type": "boolean"
+                    },
+                    "visibleToChild": {
+                        "type": "boolean"
+                    },
+                    "allowedValues": {
+                        "type": "array",
+                        "items": {
+                            "$ref": "#/components/schemas/EffectivePolicyValue"
+                        }
+                    }
+                }
+            },
+            "SystemPolicyWriteRequest": {
+                "type": "object",
+                "required": [
+                    "value"
+                ],
+                "properties": {
+                    "value": {
+                        "$ref": "#/components/schemas/EffectivePolicyValue"
+                    }
+                }
+            },
+            "SystemPolicyWriteResponse": {
+                "allOf": [
+                    {
+                        "$ref": "#/components/schemas/MessageResponse"
+                    },
+                    {
+                        "$ref": "#/components/schemas/EffectivePolicyResponse"
+                    }
+                ]
+            },
             "UserElement": {
                 "type": "object",
                 "required": [
@@ -2598,6 +2873,54 @@
                     }
                 }
             },
+            "UserPolicyResponse": {
+                "type": "object",
+                "required": [
+                    "policy"
+                ],
+                "properties": {
+                    "policy": {
+                        "$ref": "#/components/schemas/UserPolicyState"
+                    }
+                }
+            },
+            "UserPolicyState": {
+                "type": "object",
+                "required": [
+                    "policyKey",
+                    "scope",
+                    "targetId",
+                    "value"
+                ],
+                "properties": {
+                    "policyKey": {
+                        "type": "string"
+                    },
+                    "scope": {
+                        "type": "string",
+                        "enum": [
+                            "user"
+                        ]
+                    },
+                    "targetId": {
+                        "type": "string"
+                    },
+                    "value": {
+                        "$ref": "#/components/schemas/EffectivePolicyValue",
+                        "nullable": true
+                    }
+                }
+            },
+            "UserPolicyWriteResponse": {
+                "allOf": [
+                    {
+                        "$ref": "#/components/schemas/MessageResponse"
+                    },
+                    {
+                        "$ref": "#/components/schemas/UserPolicyResponse"
+                    }
+                ]
+            },
             "ValidateMetadata": {
                 "type": "object",
                 "required": [
@@ -2635,6 +2958,9 @@
                     "original_file_deleted": {
                         "type": "boolean"
                     },
+                    "policy_snapshot": {
+                        "$ref": "#/components/schemas/ValidatePolicySnapshot"
+                    },
                     "pdfVersion": {
                         "type": "string"
                     },
@@ -2643,6 +2969,17 @@
                     }
                 }
             },
+            "ValidatePolicySnapshot": {
+                "type": "object",
+                "properties": {
+                    "docmdp": {
+                        "$ref": "#/components/schemas/PolicySnapshotNumericEntry"
+                    },
+                    "signature_flow": {
+                        "$ref": "#/components/schemas/PolicySnapshotEntry"
+                    }
+                }
+            },
             "ValidatedChildFile": {
                 "type": "object",
                 "required": [
@@ -8019,13 +8356,12 @@
                 }
             }
         },
-        "/ocs/v2.php/apps/libresign/api/{apiVersion}/request-signature": {
-            "post": {
-                "operationId": "request_signature-request",
-                "summary": "Request signature",
-                "description": "Request that a file be signed by a list of signers. Each signer in the signers array can optionally include a 'signingOrder' field to control the order of signatures when ordered signing flow is enabled. The returned `data` always includes `filesCount` and `files`. For `nodeType=file`, `filesCount=1` and `files` contains the current file. For `nodeType=envelope`, `files` contains envelope child files.",
+        "/ocs/v2.php/apps/libresign/api/{apiVersion}/policies/effective": {
+            "get": {
+                "operationId": "policy-effective",
+                "summary": "Effective policies bootstrap",
                 "tags": [
-                    "request_signature"
+                    "policy"
                 ],
                 "security": [
                     {
@@ -8035,66 +8371,6 @@
                         "basic_auth": []
                     }
                 ],
-                "requestBody": {
-                    "required": false,
-                    "content": {
-                        "application/json": {
-                            "schema": {
-                                "type": "object",
-                                "properties": {
-                                    "signers": {
-                                        "type": "array",
-                                        "default": [],
-                                        "description": "Collection of signers who must sign the document. Use identifyMethods as the canonical format. Other supported fields: displayName, description, notify, signingOrder, status",
-                                        "items": {
-                                            "$ref": "#/components/schemas/NewSigner"
-                                        }
-                                    },
-                                    "name": {
-                                        "type": "string",
-                                        "default": "",
-                                        "description": "The name of file to sign"
-                                    },
-                                    "settings": {
-                                        "$ref": "#/components/schemas/FolderSettings",
-                                        "default": [],
-                                        "description": "Settings to define how and where the file should be stored"
-                                    },
-                                    "file": {
-                                        "$ref": "#/components/schemas/NewFile",
-                                        "default": [],
-                                        "description": "File object. Supports nodeId, url, base64 or path."
-                                    },
-                                    "files": {
-                                        "type": "array",
-                                        "default": [],
-                                        "description": "Multiple files to create an envelope (optional, use either file or files). Each file supports nodeId, url, base64 or path.",
-                                        "items": {
-                                            "$ref": "#/components/schemas/NewFile"
-                                        }
-                                    },
-                                    "callback": {
-                                        "type": "string",
-                                        "nullable": true,
-                                        "description": "URL that will receive a POST after the document is signed"
-                                    },
-                                    "status": {
-                                        "type": "integer",
-                                        "format": "int64",
-                                        "nullable": true,
-                                        "default": 1,
-                                        "description": "Numeric code of status * 0 - no signers * 1 - signed * 2 - pending"
-                                    },
-                                    "signatureFlow": {
-                                        "type": "string",
-                                        "nullable": true,
-                                        "description": "Signature flow mode: 'parallel' or 'ordered_numeric'. If not provided, uses global configuration"
-                                    }
-                                }
-                            }
-                        }
-                    }
-                },
                 "parameters": [
                     {
                         "name": "apiVersion",
@@ -8141,44 +8417,7 @@
                                                     "$ref": "#/components/schemas/OCSMeta"
                                                 },
                                                 "data": {
-                                                    "$ref": "#/components/schemas/DetailedFileResponse"
-                                                }
-                                            }
-                                        }
-                                    }
-                                }
-                            }
-                        }
-                    },
-                    "422": {
-                        "description": "Unauthorized",
-                        "content": {
-                            "application/json": {
-                                "schema": {
-                                    "type": "object",
-                                    "required": [
-                                        "ocs"
-                                    ],
-                                    "properties": {
-                                        "ocs": {
-                                            "type": "object",
-                                            "required": [
-                                                "meta",
-                                                "data"
-                                            ],
-                                            "properties": {
-                                                "meta": {
-                                                    "$ref": "#/components/schemas/OCSMeta"
-                                                },
-                                                "data": {
-                                                    "anyOf": [
-                                                        {
-                                                            "$ref": "#/components/schemas/MessageResponse"
-                                                        },
-                                                        {
-                                                            "$ref": "#/components/schemas/ActionErrorResponse"
-                                                        }
-                                                    ]
+                                                    "$ref": "#/components/schemas/EffectivePoliciesResponse"
                                                 }
                                             }
                                         }
@@ -8188,13 +8427,14 @@
                         }
                     }
                 }
-            },
-            "patch": {
-                "operationId": "request_signature-update-sign",
-                "summary": "Updates signatures data",
-                "description": "It is necessary to inform the UUID of the file and a list of signers.",
+            }
+        },
+        "/ocs/v2.php/apps/libresign/api/{apiVersion}/policies/group/{groupId}/{policyKey}": {
+            "get": {
+                "operationId": "policy-get-group",
+                "summary": "Read a group-level policy value",
                 "tags": [
-                    "request_signature"
+                    "policy"
                 ],
                 "security": [
                     {
@@ -8204,83 +8444,6 @@
                         "basic_auth": []
                     }
                 ],
-                "requestBody": {
-                    "required": false,
-                    "content": {
-                        "application/json": {
-                            "schema": {
-                                "type": "object",
-                                "properties": {
-                                    "signers": {
-                                        "type": "array",
-                                        "nullable": true,
-                                        "default": [],
-                                        "description": "Collection of signers who must sign the document. Use identifyMethods as the canonical format.",
-                                        "items": {
-                                            "$ref": "#/components/schemas/NewSigner"
-                                        }
-                                    },
-                                    "uuid": {
-                                        "type": "string",
-                                        "nullable": true,
-                                        "description": "UUID of sign request. The signer UUID is what the person receives via email when asked to sign. This is not the file UUID."
-                                    },
-                                    "visibleElements": {
-                                        "type": "array",
-                                        "nullable": true,
-                                        "description": "Visible elements on document",
-                                        "items": {
-                                            "$ref": "#/components/schemas/VisibleElement"
-                                        }
-                                    },
-                                    "file": {
-                                        "nullable": true,
-                                        "default": [],
-                                        "description": "File object. Supports nodeId, url, base64 or path when creating a new request.",
-                                        "anyOf": [
-                                            {
-                                                "$ref": "#/components/schemas/NewFile"
-                                            },
-                                            {
-                                                "type": "array",
-                                                "maxItems": 0
-                                            }
-                                        ]
-                                    },
-                                    "status": {
-                                        "type": "integer",
-                                        "format": "int64",
-                                        "nullable": true,
-                                        "description": "Numeric code of status * 0 - no signers * 1 - signed * 2 - pending"
-                                    },
-                                    "signatureFlow": {
-                                        "type": "string",
-                                        "nullable": true,
-                                        "description": "Signature flow mode: 'parallel' or 'ordered_numeric'. If not provided, uses global configuration"
-                                    },
-                                    "name": {
-                                        "type": "string",
-                                        "nullable": true,
-                                        "description": "The name of file to sign"
-                                    },
-                                    "settings": {
-                                        "$ref": "#/components/schemas/FolderSettings",
-                                        "default": [],
-                                        "description": "Settings to define how and where the file should be stored"
-                                    },
-                                    "files": {
-                                        "type": "array",
-                                        "default": [],
-                                        "description": "Multiple files to create an envelope (optional, use either file or files). Each file supports nodeId, url, base64 or path.",
-                                        "items": {
-                                            "$ref": "#/components/schemas/NewFile"
-                                        }
-                                    }
-                                }
-                            }
-                        }
-                    }
-                },
                 "parameters": [
                     {
                         "name": "apiVersion",
@@ -8294,6 +8457,26 @@
                             "default": "v1"
                         }
                     },
+                    {
+                        "name": "groupId",
+                        "in": "path",
+                        "description": "Group identifier that receives the policy binding.",
+                        "required": true,
+                        "schema": {
+                            "type": "string",
+                            "pattern": "^[^/]+$"
+                        }
+                    },
+                    {
+                        "name": "policyKey",
+                        "in": "path",
+                        "description": "Policy identifier to read for the selected group.",
+                        "required": true,
+                        "schema": {
+                            "type": "string",
+                            "pattern": "^[a-z0-9_]+$"
+                        }
+                    },
                     {
                         "name": "OCS-APIRequest",
                         "in": "header",
@@ -8327,7 +8510,7 @@
                                                     "$ref": "#/components/schemas/OCSMeta"
                                                 },
                                                 "data": {
-                                                    "$ref": "#/components/schemas/DetailedFileResponse"
+                                                    "$ref": "#/components/schemas/GroupPolicyResponse"
                                                 }
                                             }
                                         }
@@ -8336,8 +8519,8 @@
                             }
                         }
                     },
-                    "422": {
-                        "description": "Unauthorized",
+                    "403": {
+                        "description": "Forbidden",
                         "content": {
                             "application/json": {
                                 "schema": {
@@ -8357,14 +8540,7 @@
                                                     "$ref": "#/components/schemas/OCSMeta"
                                                 },
                                                 "data": {
-                                                    "anyOf": [
-                                                        {
-                                                            "$ref": "#/components/schemas/MessageResponse"
-                                                        },
-                                                        {
-                                                            "$ref": "#/components/schemas/ActionErrorResponse"
-                                                        }
-                                                    ]
+                                                    "$ref": "#/components/schemas/ErrorResponse"
                                                 }
                                             }
                                         }
@@ -8374,15 +8550,12 @@
                         }
                     }
                 }
-            }
-        },
-        "/ocs/v2.php/apps/libresign/api/{apiVersion}/sign/file_id/{fileId}/{signRequestId}": {
-            "delete": {
-                "operationId": "request_signature-delete-one-request-signature-using-file-id",
-                "summary": "Delete sign request",
-                "description": "You can only request exclusion as any sign",
+            },
+            "put": {
+                "operationId": "policy-set-group",
+                "summary": "Save a group-level policy value",
                 "tags": [
-                    "request_signature"
+                    "policy"
                 ],
                 "security": [
                     {
@@ -8392,6 +8565,43 @@
                         "basic_auth": []
                     }
                 ],
+                "requestBody": {
+                    "required": false,
+                    "content": {
+                        "application/json": {
+                            "schema": {
+                                "type": "object",
+                                "properties": {
+                                    "value": {
+                                        "nullable": true,
+                                        "description": "Policy value to persist for the group.",
+                                        "anyOf": [
+                                            {
+                                                "type": "boolean"
+                                            },
+                                            {
+                                                "type": "integer",
+                                                "format": "int64"
+                                            },
+                                            {
+                                                "type": "number",
+                                                "format": "double"
+                                            },
+                                            {
+                                                "type": "string"
+                                            }
+                                        ]
+                                    },
+                                    "allowChildOverride": {
+                                        "type": "boolean",
+                                        "default": false,
+                                        "description": "Whether users and requests below this group may override the group default."
+                                    }
+                                }
+                            }
+                        }
+                    }
+                },
                 "parameters": [
                     {
                         "name": "apiVersion",
@@ -8406,23 +8616,23 @@
                         }
                     },
                     {
-                        "name": "fileId",
+                        "name": "groupId",
                         "in": "path",
-                        "description": "LibreSign file ID",
+                        "description": "Group identifier that receives the policy binding.",
                         "required": true,
                         "schema": {
-                            "type": "integer",
-                            "format": "int64"
+                            "type": "string",
+                            "pattern": "^[^/]+$"
                         }
                     },
                     {
-                        "name": "signRequestId",
+                        "name": "policyKey",
                         "in": "path",
-                        "description": "The sign request id",
+                        "description": "Policy identifier to persist at the group layer.",
                         "required": true,
                         "schema": {
-                            "type": "integer",
-                            "format": "int64"
+                            "type": "string",
+                            "pattern": "^[a-z0-9_]+$"
                         }
                     },
                     {
@@ -8458,7 +8668,7 @@
                                                     "$ref": "#/components/schemas/OCSMeta"
                                                 },
                                                 "data": {
-                                                    "$ref": "#/components/schemas/MessageResponse"
+                                                    "$ref": "#/components/schemas/GroupPolicyWriteResponse"
                                                 }
                                             }
                                         }
@@ -8467,8 +8677,8 @@
                             }
                         }
                     },
-                    "401": {
-                        "description": "Failed",
+                    "400": {
+                        "description": "Invalid policy value",
                         "content": {
                             "application/json": {
                                 "schema": {
@@ -8488,7 +8698,7 @@
                                                     "$ref": "#/components/schemas/OCSMeta"
                                                 },
                                                 "data": {
-                                                    "$ref": "#/components/schemas/MessageResponse"
+                                                    "$ref": "#/components/schemas/ErrorResponse"
                                                 }
                                             }
                                         }
@@ -8497,8 +8707,8 @@
                             }
                         }
                     },
-                    "422": {
-                        "description": "Failed",
+                    "403": {
+                        "description": "Forbidden",
                         "content": {
                             "application/json": {
                                 "schema": {
@@ -8518,7 +8728,7 @@
                                                     "$ref": "#/components/schemas/OCSMeta"
                                                 },
                                                 "data": {
-                                                    "$ref": "#/components/schemas/ActionErrorResponse"
+                                                    "$ref": "#/components/schemas/ErrorResponse"
                                                 }
                                             }
                                         }
@@ -8528,15 +8738,12 @@
                         }
                     }
                 }
-            }
-        },
-        "/ocs/v2.php/apps/libresign/api/{apiVersion}/sign/file_id/{fileId}": {
+            },
             "delete": {
-                "operationId": "request_signature-delete-all-request-signature-using-file-id",
-                "summary": "Delete sign request",
-                "description": "You can only request exclusion as any sign",
+                "operationId": "policy-clear-group",
+                "summary": "Clear a group-level policy value",
                 "tags": [
-                    "request_signature"
+                    "policy"
                 ],
                 "security": [
                     {
@@ -8560,19 +8767,29 @@
                         }
                     },
                     {
-                        "name": "fileId",
+                        "name": "groupId",
                         "in": "path",
-                        "description": "LibreSign file ID",
+                        "description": "Group identifier that receives the policy binding.",
                         "required": true,
                         "schema": {
-                            "type": "integer",
-                            "format": "int64"
+                            "type": "string",
+                            "pattern": "^[^/]+$"
                         }
                     },
                     {
-                        "name": "OCS-APIRequest",
-                        "in": "header",
-                        "description": "Required to be true for the API request to pass",
+                        "name": "policyKey",
+                        "in": "path",
+                        "description": "Policy identifier to clear for the selected group.",
+                        "required": true,
+                        "schema": {
+                            "type": "string",
+                            "pattern": "^[a-z0-9_]+$"
+                        }
+                    },
+                    {
+                        "name": "OCS-APIRequest",
+                        "in": "header",
+                        "description": "Required to be true for the API request to pass",
                         "required": true,
                         "schema": {
                             "type": "boolean",
@@ -8602,37 +8819,7 @@
                                                     "$ref": "#/components/schemas/OCSMeta"
                                                 },
                                                 "data": {
-                                                    "$ref": "#/components/schemas/MessageResponse"
-                                                }
-                                            }
-                                        }
-                                    }
-                                }
-                            }
-                        }
-                    },
-                    "401": {
-                        "description": "Failed",
-                        "content": {
-                            "application/json": {
-                                "schema": {
-                                    "type": "object",
-                                    "required": [
-                                        "ocs"
-                                    ],
-                                    "properties": {
-                                        "ocs": {
-                                            "type": "object",
-                                            "required": [
-                                                "meta",
-                                                "data"
-                                            ],
-                                            "properties": {
-                                                "meta": {
-                                                    "$ref": "#/components/schemas/OCSMeta"
-                                                },
-                                                "data": {
-                                                    "$ref": "#/components/schemas/MessageResponse"
+                                                    "$ref": "#/components/schemas/GroupPolicyWriteResponse"
                                                 }
                                             }
                                         }
@@ -8641,8 +8828,8 @@
                             }
                         }
                     },
-                    "422": {
-                        "description": "Failed",
+                    "403": {
+                        "description": "Forbidden",
                         "content": {
                             "application/json": {
                                 "schema": {
@@ -8662,7 +8849,7 @@
                                                     "$ref": "#/components/schemas/OCSMeta"
                                                 },
                                                 "data": {
-                                                    "$ref": "#/components/schemas/ActionErrorResponse"
+                                                    "$ref": "#/components/schemas/ErrorResponse"
                                                 }
                                             }
                                         }
@@ -8672,15 +8859,16 @@
                         }
                     }
                 }
-            },
-            "post": {
-                "operationId": "sign_file-sign-using-file-id",
-                "summary": "Sign a file using file Id",
+            }
+        },
+        "/ocs/v2.php/apps/libresign/api/{apiVersion}/policies/user/{policyKey}": {
+            "put": {
+                "operationId": "policy-set-user-preference",
+                "summary": "Save a user policy preference",
                 "tags": [
-                    "sign_file"
+                    "policy"
                 ],
                 "security": [
-                    {},
                     {
                         "bearer_auth": []
                     },
@@ -8689,41 +8877,31 @@
                     }
                 ],
                 "requestBody": {
-                    "required": true,
+                    "required": false,
                     "content": {
                         "application/json": {
                             "schema": {
                                 "type": "object",
-                                "required": [
-                                    "method"
-                                ],
                                 "properties": {
-                                    "method": {
-                                        "type": "string",
-                                        "description": "Signature method"
-                                    },
-                                    "elements": {
-                                        "type": "object",
-                                        "default": {},
-                                        "description": "List of visible elements",
-                                        "additionalProperties": {
-                                            "type": "object"
-                                        }
-                                    },
-                                    "identifyValue": {
-                                        "type": "string",
-                                        "default": "",
-                                        "description": "Identify value"
-                                    },
-                                    "token": {
-                                        "type": "string",
-                                        "default": "",
-                                        "description": "Token, commonly send by email"
-                                    },
-                                    "async": {
-                                        "type": "boolean",
-                                        "default": false,
-                                        "description": "Execute signing asynchronously when possible"
+                                    "value": {
+                                        "nullable": true,
+                                        "description": "Policy value to persist as the current user's default.",
+                                        "anyOf": [
+                                            {
+                                                "type": "boolean"
+                                            },
+                                            {
+                                                "type": "integer",
+                                                "format": "int64"
+                                            },
+                                            {
+                                                "type": "number",
+                                                "format": "double"
+                                            },
+                                            {
+                                                "type": "string"
+                                            }
+                                        ]
                                     }
                                 }
                             }
@@ -8744,13 +8922,13 @@
                         }
                     },
                     {
-                        "name": "fileId",
+                        "name": "policyKey",
                         "in": "path",
-                        "description": "Id of LibreSign file",
+                        "description": "Policy identifier to persist for the current user.",
                         "required": true,
                         "schema": {
-                            "type": "integer",
-                            "format": "int64"
+                            "type": "string",
+                            "pattern": "^[a-z0-9_]+$"
                         }
                     },
                     {
@@ -8786,7 +8964,7 @@
                                                     "$ref": "#/components/schemas/OCSMeta"
                                                 },
                                                 "data": {
-                                                    "$ref": "#/components/schemas/SignActionResponse"
+                                                    "$ref": "#/components/schemas/SystemPolicyWriteResponse"
                                                 }
                                             }
                                         }
@@ -8795,8 +8973,8 @@
                             }
                         }
                     },
-                    "422": {
-                        "description": "Error",
+                    "400": {
+                        "description": "Invalid policy value",
                         "content": {
                             "application/json": {
                                 "schema": {
@@ -8816,7 +8994,7 @@
                                                     "$ref": "#/components/schemas/OCSMeta"
                                                 },
                                                 "data": {
-                                                    "$ref": "#/components/schemas/SignActionErrorResponse"
+                                                    "$ref": "#/components/schemas/ErrorResponse"
                                                 }
                                             }
                                         }
@@ -8826,17 +9004,14 @@
                         }
                     }
                 }
-            }
-        },
-        "/ocs/v2.php/apps/libresign/api/{apiVersion}/sign/uuid/{uuid}": {
-            "post": {
-                "operationId": "sign_file-sign-using-uuid",
-                "summary": "Sign a file using file UUID",
+            },
+            "delete": {
+                "operationId": "policy-clear-user-preference",
+                "summary": "Clear a user policy preference",
                 "tags": [
-                    "sign_file"
+                    "policy"
                 ],
                 "security": [
-                    {},
                     {
                         "bearer_auth": []
                     },
@@ -8844,48 +9019,6 @@
                         "basic_auth": []
                     }
                 ],
-                "requestBody": {
-                    "required": true,
-                    "content": {
-                        "application/json": {
-                            "schema": {
-                                "type": "object",
-                                "required": [
-                                    "method"
-                                ],
-                                "properties": {
-                                    "method": {
-                                        "type": "string",
-                                        "description": "Signature method"
-                                    },
-                                    "elements": {
-                                        "type": "object",
-                                        "default": {},
-                                        "description": "List of visible elements",
-                                        "additionalProperties": {
-                                            "type": "object"
-                                        }
-                                    },
-                                    "identifyValue": {
-                                        "type": "string",
-                                        "default": "",
-                                        "description": "Identify value"
-                                    },
-                                    "token": {
-                                        "type": "string",
-                                        "default": "",
-                                        "description": "Token, commonly send by email"
-                                    },
-                                    "async": {
-                                        "type": "boolean",
-                                        "default": false,
-                                        "description": "Execute signing asynchronously when possible"
-                                    }
-                                }
-                            }
-                        }
-                    }
-                },
                 "parameters": [
                     {
                         "name": "apiVersion",
@@ -8900,12 +9033,13 @@
                         }
                     },
                     {
-                        "name": "uuid",
+                        "name": "policyKey",
                         "in": "path",
-                        "description": "UUID of LibreSign file",
+                        "description": "Policy identifier to clear for the current user.",
                         "required": true,
                         "schema": {
-                            "type": "string"
+                            "type": "string",
+                            "pattern": "^[a-z0-9_]+$"
                         }
                     },
                     {
@@ -8941,37 +9075,7 @@
                                                     "$ref": "#/components/schemas/OCSMeta"
                                                 },
                                                 "data": {
-                                                    "$ref": "#/components/schemas/SignActionResponse"
-                                                }
-                                            }
-                                        }
-                                    }
-                                }
-                            }
-                        }
-                    },
-                    "422": {
-                        "description": "Error",
-                        "content": {
-                            "application/json": {
-                                "schema": {
-                                    "type": "object",
-                                    "required": [
-                                        "ocs"
-                                    ],
-                                    "properties": {
-                                        "ocs": {
-                                            "type": "object",
-                                            "required": [
-                                                "meta",
-                                                "data"
-                                            ],
-                                            "properties": {
-                                                "meta": {
-                                                    "$ref": "#/components/schemas/OCSMeta"
-                                                },
-                                                "data": {
-                                                    "$ref": "#/components/schemas/SignActionErrorResponse"
+                                                    "$ref": "#/components/schemas/SystemPolicyWriteResponse"
                                                 }
                                             }
                                         }
@@ -8983,106 +9087,15 @@
                 }
             }
         },
-        "/ocs/v2.php/apps/libresign/api/{apiVersion}/sign/uuid/{uuid}/renew/{method}": {
+        "/ocs/v2.php/apps/libresign/api/{apiVersion}/request-signature": {
             "post": {
-                "operationId": "sign_file-sign-renew",
-                "summary": "Renew the signature method",
+                "operationId": "request_signature-request",
+                "summary": "Request signature",
+                "description": "Request that a file be signed by a list of signers. Each signer in the signers array can optionally include a 'signingOrder' field to control the order of signatures when ordered signing flow is enabled. The returned `data` always includes `filesCount` and `files`. For `nodeType=file`, `filesCount=1` and `files` contains the current file. For `nodeType=envelope`, `files` contains envelope child files.",
                 "tags": [
-                    "sign_file"
+                    "request_signature"
                 ],
                 "security": [
-                    {},
-                    {
-                        "bearer_auth": []
-                    },
-                    {
-                        "basic_auth": []
-                    }
-                ],
-                "parameters": [
-                    {
-                        "name": "apiVersion",
-                        "in": "path",
-                        "required": true,
-                        "schema": {
-                            "type": "string",
-                            "enum": [
-                                "v1"
-                            ],
-                            "default": "v1"
-                        }
-                    },
-                    {
-                        "name": "uuid",
-                        "in": "path",
-                        "required": true,
-                        "schema": {
-                            "type": "string"
-                        }
-                    },
-                    {
-                        "name": "method",
-                        "in": "path",
-                        "description": "Signature method",
-                        "required": true,
-                        "schema": {
-                            "type": "string"
-                        }
-                    },
-                    {
-                        "name": "OCS-APIRequest",
-                        "in": "header",
-                        "description": "Required to be true for the API request to pass",
-                        "required": true,
-                        "schema": {
-                            "type": "boolean",
-                            "default": true
-                        }
-                    }
-                ],
-                "responses": {
-                    "200": {
-                        "description": "OK",
-                        "content": {
-                            "application/json": {
-                                "schema": {
-                                    "type": "object",
-                                    "required": [
-                                        "ocs"
-                                    ],
-                                    "properties": {
-                                        "ocs": {
-                                            "type": "object",
-                                            "required": [
-                                                "meta",
-                                                "data"
-                                            ],
-                                            "properties": {
-                                                "meta": {
-                                                    "$ref": "#/components/schemas/OCSMeta"
-                                                },
-                                                "data": {
-                                                    "$ref": "#/components/schemas/MessageResponse"
-                                                }
-                                            }
-                                        }
-                                    }
-                                }
-                            }
-                        }
-                    }
-                }
-            }
-        },
-        "/ocs/v2.php/apps/libresign/api/{apiVersion}/sign/uuid/{uuid}/code": {
-            "post": {
-                "operationId": "sign_file-get-code-using-uuid",
-                "summary": "Get code to sign the document using UUID",
-                "tags": [
-                    "sign_file"
-                ],
-                "security": [
-                    {},
                     {
                         "bearer_auth": []
                     },
@@ -9097,24 +9110,53 @@
                             "schema": {
                                 "type": "object",
                                 "properties": {
-                                    "identifyMethod": {
+                                    "signers": {
+                                        "type": "array",
+                                        "default": [],
+                                        "description": "Collection of signers who must sign the document. Use identifyMethods as the canonical format. Other supported fields: displayName, description, notify, signingOrder, status",
+                                        "items": {
+                                            "$ref": "#/components/schemas/NewSigner"
+                                        }
+                                    },
+                                    "name": {
                                         "type": "string",
-                                        "nullable": true,
-                                        "enum": [
-                                            "account",
-                                            "email"
-                                        ],
-                                        "description": "Identify signer method"
+                                        "default": "",
+                                        "description": "The name of file to sign"
                                     },
-                                    "signMethod": {
+                                    "settings": {
+                                        "$ref": "#/components/schemas/FolderSettings",
+                                        "default": [],
+                                        "description": "Settings to define how and where the file should be stored"
+                                    },
+                                    "file": {
+                                        "$ref": "#/components/schemas/NewFile",
+                                        "default": [],
+                                        "description": "File object. Supports nodeId, url, base64 or path."
+                                    },
+                                    "files": {
+                                        "type": "array",
+                                        "default": [],
+                                        "description": "Multiple files to create an envelope (optional, use either file or files). Each file supports nodeId, url, base64 or path.",
+                                        "items": {
+                                            "$ref": "#/components/schemas/NewFile"
+                                        }
+                                    },
+                                    "callback": {
                                         "type": "string",
                                         "nullable": true,
-                                        "description": "Method used to sign the document, i.e. emailToken, account, clickToSign, smsToken, signalToken, telegramToken, whatsappToken, xmppToken"
+                                        "description": "URL that will receive a POST after the document is signed"
                                     },
-                                    "identify": {
+                                    "status": {
+                                        "type": "integer",
+                                        "format": "int64",
+                                        "nullable": true,
+                                        "default": 1,
+                                        "description": "Numeric code of status * 0 - no signers * 1 - signed * 2 - pending"
+                                    },
+                                    "signatureFlow": {
                                         "type": "string",
                                         "nullable": true,
-                                        "description": "Identify value, i.e. the signer email, account or phone number"
+                                        "description": "Signature flow mode: 'parallel' or 'ordered_numeric'. If not provided, uses the effective policy resolution."
                                     }
                                 }
                             }
@@ -9134,15 +9176,6 @@
                             "default": "v1"
                         }
                     },
-                    {
-                        "name": "uuid",
-                        "in": "path",
-                        "description": "UUID of LibreSign file",
-                        "required": true,
-                        "schema": {
-                            "type": "string"
-                        }
-                    },
                     {
                         "name": "OCS-APIRequest",
                         "in": "header",
@@ -9176,7 +9209,7 @@
                                                     "$ref": "#/components/schemas/OCSMeta"
                                                 },
                                                 "data": {
-                                                    "$ref": "#/components/schemas/MessageResponse"
+                                                    "$ref": "#/components/schemas/DetailedFileResponse"
                                                 }
                                             }
                                         }
@@ -9186,7 +9219,7 @@
                         }
                     },
                     "422": {
-                        "description": "Error",
+                        "description": "Unauthorized",
                         "content": {
                             "application/json": {
                                 "schema": {
@@ -9206,7 +9239,14 @@
                                                     "$ref": "#/components/schemas/OCSMeta"
                                                 },
                                                 "data": {
-                                                    "$ref": "#/components/schemas/MessageResponse"
+                                                    "anyOf": [
+                                                        {
+                                                            "$ref": "#/components/schemas/MessageResponse"
+                                                        },
+                                                        {
+                                                            "$ref": "#/components/schemas/ActionErrorResponse"
+                                                        }
+                                                    ]
                                                 }
                                             }
                                         }
@@ -9216,17 +9256,15 @@
                         }
                     }
                 }
-            }
-        },
-        "/ocs/v2.php/apps/libresign/api/{apiVersion}/sign/file_id/{fileId}/code": {
-            "post": {
-                "operationId": "sign_file-get-code-using-file-id",
-                "summary": "Get code to sign the document using FileID",
+            },
+            "patch": {
+                "operationId": "request_signature-update-sign",
+                "summary": "Updates signatures data",
+                "description": "It is necessary to inform the UUID of the file and a list of signers.",
                 "tags": [
-                    "sign_file"
+                    "request_signature"
                 ],
                 "security": [
-                    {},
                     {
                         "bearer_auth": []
                     },
@@ -9241,24 +9279,70 @@
                             "schema": {
                                 "type": "object",
                                 "properties": {
-                                    "identifyMethod": {
+                                    "signers": {
+                                        "type": "array",
+                                        "nullable": true,
+                                        "default": [],
+                                        "description": "Collection of signers who must sign the document. Use identifyMethods as the canonical format.",
+                                        "items": {
+                                            "$ref": "#/components/schemas/NewSigner"
+                                        }
+                                    },
+                                    "uuid": {
                                         "type": "string",
                                         "nullable": true,
-                                        "enum": [
-                                            "account",
-                                            "email"
-                                        ],
-                                        "description": "Identify signer method"
+                                        "description": "UUID of sign request. The signer UUID is what the person receives via email when asked to sign. This is not the file UUID."
                                     },
-                                    "signMethod": {
+                                    "visibleElements": {
+                                        "type": "array",
+                                        "nullable": true,
+                                        "description": "Visible elements on document",
+                                        "items": {
+                                            "$ref": "#/components/schemas/VisibleElement"
+                                        }
+                                    },
+                                    "file": {
+                                        "nullable": true,
+                                        "default": [],
+                                        "description": "File object. Supports nodeId, url, base64 or path when creating a new request.",
+                                        "anyOf": [
+                                            {
+                                                "$ref": "#/components/schemas/NewFile"
+                                            },
+                                            {
+                                                "type": "array",
+                                                "maxItems": 0
+                                            }
+                                        ]
+                                    },
+                                    "status": {
+                                        "type": "integer",
+                                        "format": "int64",
+                                        "nullable": true,
+                                        "description": "Numeric code of status * 0 - no signers * 1 - signed * 2 - pending"
+                                    },
+                                    "signatureFlow": {
                                         "type": "string",
                                         "nullable": true,
-                                        "description": "Method used to sign the document, i.e. emailToken, account, clickToSign, smsToken, signalToken, telegramToken, whatsappToken, xmppToken"
+                                        "description": "Signature flow mode: 'parallel' or 'ordered_numeric'. If not provided, uses the effective policy resolution."
                                     },
-                                    "identify": {
+                                    "name": {
                                         "type": "string",
                                         "nullable": true,
-                                        "description": "Identify value, i.e. the signer email, account or phone number"
+                                        "description": "The name of file to sign"
+                                    },
+                                    "settings": {
+                                        "$ref": "#/components/schemas/FolderSettings",
+                                        "default": [],
+                                        "description": "Settings to define how and where the file should be stored"
+                                    },
+                                    "files": {
+                                        "type": "array",
+                                        "default": [],
+                                        "description": "Multiple files to create an envelope (optional, use either file or files). Each file supports nodeId, url, base64 or path.",
+                                        "items": {
+                                            "$ref": "#/components/schemas/NewFile"
+                                        }
                                     }
                                 }
                             }
@@ -9278,16 +9362,6 @@
                             "default": "v1"
                         }
                     },
-                    {
-                        "name": "fileId",
-                        "in": "path",
-                        "description": "Id of LibreSign file",
-                        "required": true,
-                        "schema": {
-                            "type": "integer",
-                            "format": "int64"
-                        }
-                    },
                     {
                         "name": "OCS-APIRequest",
                         "in": "header",
@@ -9321,7 +9395,7 @@
                                                     "$ref": "#/components/schemas/OCSMeta"
                                                 },
                                                 "data": {
-                                                    "$ref": "#/components/schemas/MessageResponse"
+                                                    "$ref": "#/components/schemas/DetailedFileResponse"
                                                 }
                                             }
                                         }
@@ -9331,7 +9405,7 @@
                         }
                     },
                     "422": {
-                        "description": "Error",
+                        "description": "Unauthorized",
                         "content": {
                             "application/json": {
                                 "schema": {
@@ -9351,7 +9425,14 @@
                                                     "$ref": "#/components/schemas/OCSMeta"
                                                 },
                                                 "data": {
-                                                    "$ref": "#/components/schemas/MessageResponse"
+                                                    "anyOf": [
+                                                        {
+                                                            "$ref": "#/components/schemas/MessageResponse"
+                                                        },
+                                                        {
+                                                            "$ref": "#/components/schemas/ActionErrorResponse"
+                                                        }
+                                                    ]
                                                 }
                                             }
                                         }
@@ -9363,15 +9444,15 @@
                 }
             }
         },
-        "/ocs/v2.php/apps/libresign/api/{apiVersion}/signature/elements": {
-            "post": {
-                "operationId": "signature_elements-create-signature-element",
-                "summary": "Create signature element",
+        "/ocs/v2.php/apps/libresign/api/{apiVersion}/sign/file_id/{fileId}/{signRequestId}": {
+            "delete": {
+                "operationId": "request_signature-delete-one-request-signature-using-file-id",
+                "summary": "Delete sign request",
+                "description": "You can only request exclusion as any sign",
                 "tags": [
-                    "signature_elements"
+                    "request_signature"
                 ],
                 "security": [
-                    {},
                     {
                         "bearer_auth": []
                     },
@@ -9379,28 +9460,6 @@
                         "basic_auth": []
                     }
                 ],
-                "requestBody": {
-                    "required": true,
-                    "content": {
-                        "application/json": {
-                            "schema": {
-                                "type": "object",
-                                "required": [
-                                    "elements"
-                                ],
-                                "properties": {
-                                    "elements": {
-                                        "type": "object",
-                                        "description": "Element object",
-                                        "additionalProperties": {
-                                            "type": "object"
-                                        }
-                                    }
-                                }
-                            }
-                        }
-                    }
-                },
                 "parameters": [
                     {
                         "name": "apiVersion",
@@ -9415,9 +9474,29 @@
                         }
                     },
                     {
-                        "name": "OCS-APIRequest",
-                        "in": "header",
-                        "description": "Required to be true for the API request to pass",
+                        "name": "fileId",
+                        "in": "path",
+                        "description": "LibreSign file ID",
+                        "required": true,
+                        "schema": {
+                            "type": "integer",
+                            "format": "int64"
+                        }
+                    },
+                    {
+                        "name": "signRequestId",
+                        "in": "path",
+                        "description": "The sign request id",
+                        "required": true,
+                        "schema": {
+                            "type": "integer",
+                            "format": "int64"
+                        }
+                    },
+                    {
+                        "name": "OCS-APIRequest",
+                        "in": "header",
+                        "description": "Required to be true for the API request to pass",
                         "required": true,
                         "schema": {
                             "type": "boolean",
@@ -9428,36 +9507,6 @@
                 "responses": {
                     "200": {
                         "description": "OK",
-                        "content": {
-                            "application/json": {
-                                "schema": {
-                                    "type": "object",
-                                    "required": [
-                                        "ocs"
-                                    ],
-                                    "properties": {
-                                        "ocs": {
-                                            "type": "object",
-                                            "required": [
-                                                "meta",
-                                                "data"
-                                            ],
-                                            "properties": {
-                                                "meta": {
-                                                    "$ref": "#/components/schemas/OCSMeta"
-                                                },
-                                                "data": {
-                                                    "$ref": "#/components/schemas/UserElementsMessageResponse"
-                                                }
-                                            }
-                                        }
-                                    }
-                                }
-                            }
-                        }
-                    },
-                    "422": {
-                        "description": "Invalid data",
                         "content": {
                             "application/json": {
                                 "schema": {
@@ -9485,51 +9534,9 @@
                                 }
                             }
                         }
-                    }
-                }
-            },
-            "get": {
-                "operationId": "signature_elements-get-signature-elements",
-                "summary": "Get signature elements",
-                "tags": [
-                    "signature_elements"
-                ],
-                "security": [
-                    {},
-                    {
-                        "bearer_auth": []
-                    },
-                    {
-                        "basic_auth": []
-                    }
-                ],
-                "parameters": [
-                    {
-                        "name": "apiVersion",
-                        "in": "path",
-                        "required": true,
-                        "schema": {
-                            "type": "string",
-                            "enum": [
-                                "v1"
-                            ],
-                            "default": "v1"
-                        }
                     },
-                    {
-                        "name": "OCS-APIRequest",
-                        "in": "header",
-                        "description": "Required to be true for the API request to pass",
-                        "required": true,
-                        "schema": {
-                            "type": "boolean",
-                            "default": true
-                        }
-                    }
-                ],
-                "responses": {
-                    "200": {
-                        "description": "OK",
+                    "401": {
+                        "description": "Failed",
                         "content": {
                             "application/json": {
                                 "schema": {
@@ -9549,7 +9556,7 @@
                                                     "$ref": "#/components/schemas/OCSMeta"
                                                 },
                                                 "data": {
-                                                    "$ref": "#/components/schemas/UserElementsResponse"
+                                                    "$ref": "#/components/schemas/MessageResponse"
                                                 }
                                             }
                                         }
@@ -9558,8 +9565,8 @@
                             }
                         }
                     },
-                    "404": {
-                        "description": "Invalid data",
+                    "422": {
+                        "description": "Failed",
                         "content": {
                             "application/json": {
                                 "schema": {
@@ -9579,7 +9586,7 @@
                                                     "$ref": "#/components/schemas/OCSMeta"
                                                 },
                                                 "data": {
-                                                    "$ref": "#/components/schemas/MessageResponse"
+                                                    "$ref": "#/components/schemas/ActionErrorResponse"
                                                 }
                                             }
                                         }
@@ -9591,15 +9598,15 @@
                 }
             }
         },
-        "/ocs/v2.php/apps/libresign/api/{apiVersion}/signature/elements/preview/{nodeId}": {
-            "get": {
-                "operationId": "signature_elements-get-signature-element-preview",
-                "summary": "Get preview of signature elements of",
+        "/ocs/v2.php/apps/libresign/api/{apiVersion}/sign/file_id/{fileId}": {
+            "delete": {
+                "operationId": "request_signature-delete-all-request-signature-using-file-id",
+                "summary": "Delete sign request",
+                "description": "You can only request exclusion as any sign",
                 "tags": [
-                    "signature_elements"
+                    "request_signature"
                 ],
                 "security": [
-                    {},
                     {
                         "bearer_auth": []
                     },
@@ -9621,9 +9628,9 @@
                         }
                     },
                     {
-                        "name": "nodeId",
+                        "name": "fileId",
                         "in": "path",
-                        "description": "Node id of a Nextcloud file",
+                        "description": "LibreSign file ID",
                         "required": true,
                         "schema": {
                             "type": "integer",
@@ -9644,17 +9651,6 @@
                 "responses": {
                     "200": {
                         "description": "OK",
-                        "content": {
-                            "*/*": {
-                                "schema": {
-                                    "type": "string",
-                                    "format": "binary"
-                                }
-                            }
-                        }
-                    },
-                    "404": {
-                        "description": "Invalid data",
                         "content": {
                             "application/json": {
                                 "schema": {
@@ -9674,7 +9670,7 @@
                                                     "$ref": "#/components/schemas/OCSMeta"
                                                 },
                                                 "data": {
-                                                    "type": "object"
+                                                    "$ref": "#/components/schemas/MessageResponse"
                                                 }
                                             }
                                         }
@@ -9682,62 +9678,9 @@
                                 }
                             }
                         }
-                    }
-                }
-            }
-        },
-        "/ocs/v2.php/apps/libresign/api/{apiVersion}/signature/elements/{nodeId}": {
-            "get": {
-                "operationId": "signature_elements-get-signature-element",
-                "summary": "Get signature element of signer",
-                "tags": [
-                    "signature_elements"
-                ],
-                "security": [
-                    {
-                        "bearer_auth": []
-                    },
-                    {
-                        "basic_auth": []
-                    }
-                ],
-                "parameters": [
-                    {
-                        "name": "apiVersion",
-                        "in": "path",
-                        "required": true,
-                        "schema": {
-                            "type": "string",
-                            "enum": [
-                                "v1"
-                            ],
-                            "default": "v1"
-                        }
-                    },
-                    {
-                        "name": "nodeId",
-                        "in": "path",
-                        "description": "Node id of a Nextcloud file",
-                        "required": true,
-                        "schema": {
-                            "type": "integer",
-                            "format": "int64"
-                        }
                     },
-                    {
-                        "name": "OCS-APIRequest",
-                        "in": "header",
-                        "description": "Required to be true for the API request to pass",
-                        "required": true,
-                        "schema": {
-                            "type": "boolean",
-                            "default": true
-                        }
-                    }
-                ],
-                "responses": {
-                    "200": {
-                        "description": "OK",
+                    "401": {
+                        "description": "Failed",
                         "content": {
                             "application/json": {
                                 "schema": {
@@ -9757,7 +9700,7 @@
                                                     "$ref": "#/components/schemas/OCSMeta"
                                                 },
                                                 "data": {
-                                                    "$ref": "#/components/schemas/UserElement"
+                                                    "$ref": "#/components/schemas/MessageResponse"
                                                 }
                                             }
                                         }
@@ -9766,8 +9709,8 @@
                             }
                         }
                     },
-                    "404": {
-                        "description": "Invalid data",
+                    "422": {
+                        "description": "Failed",
                         "content": {
                             "application/json": {
                                 "schema": {
@@ -9787,7 +9730,7 @@
                                                     "$ref": "#/components/schemas/OCSMeta"
                                                 },
                                                 "data": {
-                                                    "$ref": "#/components/schemas/MessageResponse"
+                                                    "$ref": "#/components/schemas/ActionErrorResponse"
                                                 }
                                             }
                                         }
@@ -9798,11 +9741,11 @@
                     }
                 }
             },
-            "patch": {
-                "operationId": "signature_elements-patch-signature-element",
-                "summary": "Update signature element",
+            "post": {
+                "operationId": "sign_file-sign-using-file-id",
+                "summary": "Sign a file using file Id",
                 "tags": [
-                    "signature_elements"
+                    "sign_file"
                 ],
                 "security": [
                     {},
@@ -9814,24 +9757,41 @@
                     }
                 ],
                 "requestBody": {
-                    "required": false,
+                    "required": true,
                     "content": {
                         "application/json": {
                             "schema": {
                                 "type": "object",
+                                "required": [
+                                    "method"
+                                ],
                                 "properties": {
-                                    "type": {
+                                    "method": {
                                         "type": "string",
-                                        "default": "",
-                                        "description": "The type of signature element"
+                                        "description": "Signature method"
                                     },
-                                    "file": {
+                                    "elements": {
                                         "type": "object",
                                         "default": {},
-                                        "description": "Element object",
+                                        "description": "List of visible elements",
                                         "additionalProperties": {
                                             "type": "object"
                                         }
+                                    },
+                                    "identifyValue": {
+                                        "type": "string",
+                                        "default": "",
+                                        "description": "Identify value"
+                                    },
+                                    "token": {
+                                        "type": "string",
+                                        "default": "",
+                                        "description": "Token, commonly send by email"
+                                    },
+                                    "async": {
+                                        "type": "boolean",
+                                        "default": false,
+                                        "description": "Execute signing asynchronously when possible"
                                     }
                                 }
                             }
@@ -9852,9 +9812,9 @@
                         }
                     },
                     {
-                        "name": "nodeId",
+                        "name": "fileId",
                         "in": "path",
-                        "description": "Node id of a Nextcloud file",
+                        "description": "Id of LibreSign file",
                         "required": true,
                         "schema": {
                             "type": "integer",
@@ -9894,7 +9854,7 @@
                                                     "$ref": "#/components/schemas/OCSMeta"
                                                 },
                                                 "data": {
-                                                    "$ref": "#/components/schemas/UserElementsMessageResponse"
+                                                    "$ref": "#/components/schemas/SignActionResponse"
                                                 }
                                             }
                                         }
@@ -9924,7 +9884,7 @@
                                                     "$ref": "#/components/schemas/OCSMeta"
                                                 },
                                                 "data": {
-                                                    "$ref": "#/components/schemas/MessageResponse"
+                                                    "$ref": "#/components/schemas/SignActionErrorResponse"
                                                 }
                                             }
                                         }
@@ -9934,12 +9894,14 @@
                         }
                     }
                 }
-            },
-            "delete": {
-                "operationId": "signature_elements-delete-signature-element",
-                "summary": "Delete signature element",
+            }
+        },
+        "/ocs/v2.php/apps/libresign/api/{apiVersion}/sign/uuid/{uuid}": {
+            "post": {
+                "operationId": "sign_file-sign-using-uuid",
+                "summary": "Sign a file using file UUID",
                 "tags": [
-                    "signature_elements"
+                    "sign_file"
                 ],
                 "security": [
                     {},
@@ -9950,7 +9912,49 @@
                         "basic_auth": []
                     }
                 ],
-                "parameters": [
+                "requestBody": {
+                    "required": true,
+                    "content": {
+                        "application/json": {
+                            "schema": {
+                                "type": "object",
+                                "required": [
+                                    "method"
+                                ],
+                                "properties": {
+                                    "method": {
+                                        "type": "string",
+                                        "description": "Signature method"
+                                    },
+                                    "elements": {
+                                        "type": "object",
+                                        "default": {},
+                                        "description": "List of visible elements",
+                                        "additionalProperties": {
+                                            "type": "object"
+                                        }
+                                    },
+                                    "identifyValue": {
+                                        "type": "string",
+                                        "default": "",
+                                        "description": "Identify value"
+                                    },
+                                    "token": {
+                                        "type": "string",
+                                        "default": "",
+                                        "description": "Token, commonly send by email"
+                                    },
+                                    "async": {
+                                        "type": "boolean",
+                                        "default": false,
+                                        "description": "Execute signing asynchronously when possible"
+                                    }
+                                }
+                            }
+                        }
+                    }
+                },
+                "parameters": [
                     {
                         "name": "apiVersion",
                         "in": "path",
@@ -9964,13 +9968,12 @@
                         }
                     },
                     {
-                        "name": "nodeId",
+                        "name": "uuid",
                         "in": "path",
-                        "description": "Node id of a Nextcloud file",
+                        "description": "UUID of LibreSign file",
                         "required": true,
                         "schema": {
-                            "type": "integer",
-                            "format": "int64"
+                            "type": "string"
                         }
                     },
                     {
@@ -10006,7 +10009,7 @@
                                                     "$ref": "#/components/schemas/OCSMeta"
                                                 },
                                                 "data": {
-                                                    "$ref": "#/components/schemas/MessageResponse"
+                                                    "$ref": "#/components/schemas/SignActionResponse"
                                                 }
                                             }
                                         }
@@ -10015,8 +10018,8 @@
                             }
                         }
                     },
-                    "404": {
-                        "description": "Not found",
+                    "422": {
+                        "description": "Error",
                         "content": {
                             "application/json": {
                                 "schema": {
@@ -10036,7 +10039,7 @@
                                                     "$ref": "#/components/schemas/OCSMeta"
                                                 },
                                                 "data": {
-                                                    "$ref": "#/components/schemas/MessageResponse"
+                                                    "$ref": "#/components/schemas/SignActionErrorResponse"
                                                 }
                                             }
                                         }
@@ -10048,15 +10051,15 @@
                 }
             }
         },
-        "/ocs/v2.php/apps/libresign/api/{apiVersion}/admin/certificate/cfssl": {
+        "/ocs/v2.php/apps/libresign/api/{apiVersion}/sign/uuid/{uuid}/renew/{method}": {
             "post": {
-                "operationId": "admin-generate-certificate-cfssl",
-                "summary": "Generate certificate using CFSSL engine",
-                "description": "This endpoint requires admin access",
+                "operationId": "sign_file-sign-renew",
+                "summary": "Renew the signature method",
                 "tags": [
-                    "admin"
+                    "sign_file"
                 ],
                 "security": [
+                    {},
                     {
                         "bearer_auth": []
                     },
@@ -10064,68 +10067,6 @@
                         "basic_auth": []
                     }
                 ],
-                "requestBody": {
-                    "required": true,
-                    "content": {
-                        "application/json": {
-                            "schema": {
-                                "type": "object",
-                                "required": [
-                                    "rootCert"
-                                ],
-                                "properties": {
-                                    "rootCert": {
-                                        "type": "object",
-                                        "description": "fields of root certificate",
-                                        "required": [
-                                            "commonName",
-                                            "names"
-                                        ],
-                                        "properties": {
-                                            "commonName": {
-                                                "type": "string"
-                                            },
-                                            "names": {
-                                                "type": "object",
-                                                "additionalProperties": {
-                                                    "type": "object",
-                                                    "required": [
-                                                        "value"
-                                                    ],
-                                                    "properties": {
-                                                        "value": {
-                                                            "oneOf": [
-                                                                {
-                                                                    "type": "string"
-                                                                },
-                                                                {
-                                                                    "type": "array",
-                                                                    "items": {
-                                                                        "type": "string"
-                                                                    }
-                                                                }
-                                                            ]
-                                                        }
-                                                    }
-                                                }
-                                            }
-                                        }
-                                    },
-                                    "cfsslUri": {
-                                        "type": "string",
-                                        "default": "",
-                                        "description": "URI of CFSSL API"
-                                    },
-                                    "configPath": {
-                                        "type": "string",
-                                        "default": "",
-                                        "description": "Path of config files of CFSSL"
-                                    }
-                                }
-                            }
-                        }
-                    }
-                },
                 "parameters": [
                     {
                         "name": "apiVersion",
@@ -10139,6 +10080,23 @@
                             "default": "v1"
                         }
                     },
+                    {
+                        "name": "uuid",
+                        "in": "path",
+                        "required": true,
+                        "schema": {
+                            "type": "string"
+                        }
+                    },
+                    {
+                        "name": "method",
+                        "in": "path",
+                        "description": "Signature method",
+                        "required": true,
+                        "schema": {
+                            "type": "string"
+                        }
+                    },
                     {
                         "name": "OCS-APIRequest",
                         "in": "header",
@@ -10153,36 +10111,6 @@
                 "responses": {
                     "200": {
                         "description": "OK",
-                        "content": {
-                            "application/json": {
-                                "schema": {
-                                    "type": "object",
-                                    "required": [
-                                        "ocs"
-                                    ],
-                                    "properties": {
-                                        "ocs": {
-                                            "type": "object",
-                                            "required": [
-                                                "meta",
-                                                "data"
-                                            ],
-                                            "properties": {
-                                                "meta": {
-                                                    "$ref": "#/components/schemas/OCSMeta"
-                                                },
-                                                "data": {
-                                                    "$ref": "#/components/schemas/EngineHandlerResponse"
-                                                }
-                                            }
-                                        }
-                                    }
-                                }
-                            }
-                        }
-                    },
-                    "401": {
-                        "description": "Account not found",
                         "content": {
                             "application/json": {
                                 "schema": {
@@ -10214,15 +10142,15 @@
                 }
             }
         },
-        "/ocs/v2.php/apps/libresign/api/{apiVersion}/admin/certificate/openssl": {
+        "/ocs/v2.php/apps/libresign/api/{apiVersion}/sign/uuid/{uuid}/code": {
             "post": {
-                "operationId": "admin-generate-certificate-open-ssl",
-                "summary": "Generate certificate using OpenSSL engine",
-                "description": "This endpoint requires admin access",
+                "operationId": "sign_file-get-code-using-uuid",
+                "summary": "Get code to sign the document using UUID",
                 "tags": [
-                    "admin"
+                    "sign_file"
                 ],
                 "security": [
+                    {},
                     {
                         "bearer_auth": []
                     },
@@ -10231,56 +10159,30 @@
                     }
                 ],
                 "requestBody": {
-                    "required": true,
+                    "required": false,
                     "content": {
                         "application/json": {
                             "schema": {
                                 "type": "object",
-                                "required": [
-                                    "rootCert"
-                                ],
                                 "properties": {
-                                    "rootCert": {
-                                        "type": "object",
-                                        "description": "fields of root certificate",
-                                        "required": [
-                                            "commonName",
-                                            "names"
+                                    "identifyMethod": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "enum": [
+                                            "account",
+                                            "email"
                                         ],
-                                        "properties": {
-                                            "commonName": {
-                                                "type": "string"
-                                            },
-                                            "names": {
-                                                "type": "object",
-                                                "additionalProperties": {
-                                                    "type": "object",
-                                                    "required": [
-                                                        "value"
-                                                    ],
-                                                    "properties": {
-                                                        "value": {
-                                                            "oneOf": [
-                                                                {
-                                                                    "type": "string"
-                                                                },
-                                                                {
-                                                                    "type": "array",
-                                                                    "items": {
-                                                                        "type": "string"
-                                                                    }
-                                                                }
-                                                            ]
-                                                        }
-                                                    }
-                                                }
-                                            }
-                                        }
+                                        "description": "Identify signer method"
                                     },
-                                    "configPath": {
+                                    "signMethod": {
                                         "type": "string",
-                                        "default": "",
-                                        "description": "Path of config files of CFSSL"
+                                        "nullable": true,
+                                        "description": "Method used to sign the document, i.e. emailToken, account, clickToSign, smsToken, signalToken, telegramToken, whatsappToken, xmppToken"
+                                    },
+                                    "identify": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "description": "Identify value, i.e. the signer email, account or phone number"
                                     }
                                 }
                             }
@@ -10300,6 +10202,15 @@
                             "default": "v1"
                         }
                     },
+                    {
+                        "name": "uuid",
+                        "in": "path",
+                        "description": "UUID of LibreSign file",
+                        "required": true,
+                        "schema": {
+                            "type": "string"
+                        }
+                    },
                     {
                         "name": "OCS-APIRequest",
                         "in": "header",
@@ -10333,7 +10244,7 @@
                                                     "$ref": "#/components/schemas/OCSMeta"
                                                 },
                                                 "data": {
-                                                    "$ref": "#/components/schemas/EngineHandlerResponse"
+                                                    "$ref": "#/components/schemas/MessageResponse"
                                                 }
                                             }
                                         }
@@ -10342,8 +10253,8 @@
                             }
                         }
                     },
-                    "401": {
-                        "description": "Account not found",
+                    "422": {
+                        "description": "Error",
                         "content": {
                             "application/json": {
                                 "schema": {
@@ -10375,15 +10286,15 @@
                 }
             }
         },
-        "/ocs/v2.php/apps/libresign/api/{apiVersion}/admin/certificate/engine": {
+        "/ocs/v2.php/apps/libresign/api/{apiVersion}/sign/file_id/{fileId}/code": {
             "post": {
-                "operationId": "admin-set-certificate-engine",
-                "summary": "Set certificate engine",
-                "description": "Sets the certificate engine (openssl, cfssl, or none) and automatically configures identify_methods when needed\nThis endpoint requires admin access",
+                "operationId": "sign_file-get-code-using-file-id",
+                "summary": "Get code to sign the document using FileID",
                 "tags": [
-                    "admin"
+                    "sign_file"
                 ],
                 "security": [
+                    {},
                     {
                         "bearer_auth": []
                     },
@@ -10392,18 +10303,30 @@
                     }
                 ],
                 "requestBody": {
-                    "required": true,
+                    "required": false,
                     "content": {
                         "application/json": {
                             "schema": {
                                 "type": "object",
-                                "required": [
-                                    "engine"
-                                ],
                                 "properties": {
-                                    "engine": {
+                                    "identifyMethod": {
                                         "type": "string",
-                                        "description": "The certificate engine to use (openssl, cfssl, or none)"
+                                        "nullable": true,
+                                        "enum": [
+                                            "account",
+                                            "email"
+                                        ],
+                                        "description": "Identify signer method"
+                                    },
+                                    "signMethod": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "description": "Method used to sign the document, i.e. emailToken, account, clickToSign, smsToken, signalToken, telegramToken, whatsappToken, xmppToken"
+                                    },
+                                    "identify": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "description": "Identify value, i.e. the signer email, account or phone number"
                                     }
                                 }
                             }
@@ -10423,6 +10346,16 @@
                             "default": "v1"
                         }
                     },
+                    {
+                        "name": "fileId",
+                        "in": "path",
+                        "description": "Id of LibreSign file",
+                        "required": true,
+                        "schema": {
+                            "type": "integer",
+                            "format": "int64"
+                        }
+                    },
                     {
                         "name": "OCS-APIRequest",
                         "in": "header",
@@ -10456,7 +10389,7 @@
                                                     "$ref": "#/components/schemas/OCSMeta"
                                                 },
                                                 "data": {
-                                                    "$ref": "#/components/schemas/CertificateEngineConfigResponse"
+                                                    "$ref": "#/components/schemas/MessageResponse"
                                                 }
                                             }
                                         }
@@ -10465,8 +10398,8 @@
                             }
                         }
                     },
-                    "400": {
-                        "description": "Invalid engine",
+                    "422": {
+                        "description": "Error",
                         "content": {
                             "application/json": {
                                 "schema": {
@@ -10498,15 +10431,15 @@
                 }
             }
         },
-        "/ocs/v2.php/apps/libresign/api/{apiVersion}/admin/certificate": {
-            "get": {
-                "operationId": "admin-load-certificate",
-                "summary": "Load certificate data",
-                "description": "Return all data of root certificate and a field called `generated` with a boolean value.\nThis endpoint requires admin access",
+        "/ocs/v2.php/apps/libresign/api/{apiVersion}/signature/elements": {
+            "post": {
+                "operationId": "signature_elements-create-signature-element",
+                "summary": "Create signature element",
                 "tags": [
-                    "admin"
+                    "signature_elements"
                 ],
                 "security": [
+                    {},
                     {
                         "bearer_auth": []
                     },
@@ -10514,6 +10447,28 @@
                         "basic_auth": []
                     }
                 ],
+                "requestBody": {
+                    "required": true,
+                    "content": {
+                        "application/json": {
+                            "schema": {
+                                "type": "object",
+                                "required": [
+                                    "elements"
+                                ],
+                                "properties": {
+                                    "elements": {
+                                        "type": "object",
+                                        "description": "Element object",
+                                        "additionalProperties": {
+                                            "type": "object"
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    }
+                },
                 "parameters": [
                     {
                         "name": "apiVersion",
@@ -10560,7 +10515,37 @@
                                                     "$ref": "#/components/schemas/OCSMeta"
                                                 },
                                                 "data": {
-                                                    "$ref": "#/components/schemas/CetificateDataGenerated"
+                                                    "$ref": "#/components/schemas/UserElementsMessageResponse"
+                                                }
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    },
+                    "422": {
+                        "description": "Invalid data",
+                        "content": {
+                            "application/json": {
+                                "schema": {
+                                    "type": "object",
+                                    "required": [
+                                        "ocs"
+                                    ],
+                                    "properties": {
+                                        "ocs": {
+                                            "type": "object",
+                                            "required": [
+                                                "meta",
+                                                "data"
+                                            ],
+                                            "properties": {
+                                                "meta": {
+                                                    "$ref": "#/components/schemas/OCSMeta"
+                                                },
+                                                "data": {
+                                                    "$ref": "#/components/schemas/MessageResponse"
                                                 }
                                             }
                                         }
@@ -10570,17 +10555,15 @@
                         }
                     }
                 }
-            }
-        },
-        "/ocs/v2.php/apps/libresign/api/{apiVersion}/admin/configure-check": {
+            },
             "get": {
-                "operationId": "admin-configure-check",
-                "summary": "Check the configuration of LibreSign",
-                "description": "Return the status of necessary configuration and tips to fix the problems.\nThis endpoint requires admin access",
+                "operationId": "signature_elements-get-signature-elements",
+                "summary": "Get signature elements",
                 "tags": [
-                    "admin"
+                    "signature_elements"
                 ],
                 "security": [
+                    {},
                     {
                         "bearer_auth": []
                     },
@@ -10634,7 +10617,37 @@
                                                     "$ref": "#/components/schemas/OCSMeta"
                                                 },
                                                 "data": {
-                                                    "$ref": "#/components/schemas/ConfigureChecksResponse"
+                                                    "$ref": "#/components/schemas/UserElementsResponse"
+                                                }
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    },
+                    "404": {
+                        "description": "Invalid data",
+                        "content": {
+                            "application/json": {
+                                "schema": {
+                                    "type": "object",
+                                    "required": [
+                                        "ocs"
+                                    ],
+                                    "properties": {
+                                        "ocs": {
+                                            "type": "object",
+                                            "required": [
+                                                "meta",
+                                                "data"
+                                            ],
+                                            "properties": {
+                                                "meta": {
+                                                    "$ref": "#/components/schemas/OCSMeta"
+                                                },
+                                                "data": {
+                                                    "$ref": "#/components/schemas/MessageResponse"
                                                 }
                                             }
                                         }
@@ -10646,15 +10659,15 @@
                 }
             }
         },
-        "/ocs/v2.php/apps/libresign/api/{apiVersion}/admin/disable-hate-limit": {
+        "/ocs/v2.php/apps/libresign/api/{apiVersion}/signature/elements/preview/{nodeId}": {
             "get": {
-                "operationId": "admin-disable-hate-limit",
-                "summary": "Disable hate limit to current session",
-                "description": "This will disable hate limit to current session.\nThis endpoint requires admin access",
+                "operationId": "signature_elements-get-signature-element-preview",
+                "summary": "Get preview of signature elements of",
                 "tags": [
-                    "admin"
+                    "signature_elements"
                 ],
                 "security": [
+                    {},
                     {
                         "bearer_auth": []
                     },
@@ -10675,6 +10688,16 @@
                             "default": "v1"
                         }
                     },
+                    {
+                        "name": "nodeId",
+                        "in": "path",
+                        "description": "Node id of a Nextcloud file",
+                        "required": true,
+                        "schema": {
+                            "type": "integer",
+                            "format": "int64"
+                        }
+                    },
                     {
                         "name": "OCS-APIRequest",
                         "in": "header",
@@ -10689,6 +10712,17 @@
                 "responses": {
                     "200": {
                         "description": "OK",
+                        "content": {
+                            "*/*": {
+                                "schema": {
+                                    "type": "string",
+                                    "format": "binary"
+                                }
+                            }
+                        }
+                    },
+                    "404": {
+                        "description": "Invalid data",
                         "content": {
                             "application/json": {
                                 "schema": {
@@ -10707,7 +10741,9 @@
                                                 "meta": {
                                                     "$ref": "#/components/schemas/OCSMeta"
                                                 },
-                                                "data": {}
+                                                "data": {
+                                                    "type": "object"
+                                                }
                                             }
                                         }
                                     }
@@ -10718,13 +10754,12 @@
                 }
             }
         },
-        "/ocs/v2.php/apps/libresign/api/{apiVersion}/admin/signature-background": {
-            "post": {
-                "operationId": "admin-signature-background-save",
-                "summary": "Add custom background image",
-                "description": "This endpoint requires admin access",
+        "/ocs/v2.php/apps/libresign/api/{apiVersion}/signature/elements/{nodeId}": {
+            "get": {
+                "operationId": "signature_elements-get-signature-element",
+                "summary": "Get signature element of signer",
                 "tags": [
-                    "admin"
+                    "signature_elements"
                 ],
                 "security": [
                     {
@@ -10747,6 +10782,16 @@
                             "default": "v1"
                         }
                     },
+                    {
+                        "name": "nodeId",
+                        "in": "path",
+                        "description": "Node id of a Nextcloud file",
+                        "required": true,
+                        "schema": {
+                            "type": "integer",
+                            "format": "int64"
+                        }
+                    },
                     {
                         "name": "OCS-APIRequest",
                         "in": "header",
@@ -10780,7 +10825,7 @@
                                                     "$ref": "#/components/schemas/OCSMeta"
                                                 },
                                                 "data": {
-                                                    "$ref": "#/components/schemas/SuccessStatusResponse"
+                                                    "$ref": "#/components/schemas/UserElement"
                                                 }
                                             }
                                         }
@@ -10789,8 +10834,8 @@
                             }
                         }
                     },
-                    "422": {
-                        "description": "Error",
+                    "404": {
+                        "description": "Invalid data",
                         "content": {
                             "application/json": {
                                 "schema": {
@@ -10810,7 +10855,7 @@
                                                     "$ref": "#/components/schemas/OCSMeta"
                                                 },
                                                 "data": {
-                                                    "$ref": "#/components/schemas/FailureStatusResponse"
+                                                    "$ref": "#/components/schemas/MessageResponse"
                                                 }
                                             }
                                         }
@@ -10821,14 +10866,14 @@
                     }
                 }
             },
-            "get": {
-                "operationId": "admin-signature-background-get",
-                "summary": "Get custom background image",
-                "description": "This endpoint requires admin access",
+            "patch": {
+                "operationId": "signature_elements-patch-signature-element",
+                "summary": "Update signature element",
                 "tags": [
-                    "admin"
+                    "signature_elements"
                 ],
                 "security": [
+                    {},
                     {
                         "bearer_auth": []
                     },
@@ -10836,59 +10881,31 @@
                         "basic_auth": []
                     }
                 ],
-                "parameters": [
-                    {
-                        "name": "apiVersion",
-                        "in": "path",
-                        "required": true,
-                        "schema": {
-                            "type": "string",
-                            "enum": [
-                                "v1"
-                            ],
-                            "default": "v1"
-                        }
-                    },
-                    {
-                        "name": "OCS-APIRequest",
-                        "in": "header",
-                        "description": "Required to be true for the API request to pass",
-                        "required": true,
-                        "schema": {
-                            "type": "boolean",
-                            "default": true
-                        }
-                    }
-                ],
-                "responses": {
-                    "200": {
-                        "description": "Image returned",
-                        "content": {
-                            "*/*": {
-                                "schema": {
-                                    "type": "string",
-                                    "format": "binary"
+                "requestBody": {
+                    "required": false,
+                    "content": {
+                        "application/json": {
+                            "schema": {
+                                "type": "object",
+                                "properties": {
+                                    "type": {
+                                        "type": "string",
+                                        "default": "",
+                                        "description": "The type of signature element"
+                                    },
+                                    "file": {
+                                        "type": "object",
+                                        "default": {},
+                                        "description": "Element object",
+                                        "additionalProperties": {
+                                            "type": "object"
+                                        }
+                                    }
                                 }
                             }
                         }
                     }
-                }
-            },
-            "patch": {
-                "operationId": "admin-signature-background-reset",
-                "summary": "Reset the background image to be the default of LibreSign",
-                "description": "This endpoint requires admin access",
-                "tags": [
-                    "admin"
-                ],
-                "security": [
-                    {
-                        "bearer_auth": []
-                    },
-                    {
-                        "basic_auth": []
-                    }
-                ],
+                },
                 "parameters": [
                     {
                         "name": "apiVersion",
@@ -10902,6 +10919,16 @@
                             "default": "v1"
                         }
                     },
+                    {
+                        "name": "nodeId",
+                        "in": "path",
+                        "description": "Node id of a Nextcloud file",
+                        "required": true,
+                        "schema": {
+                            "type": "integer",
+                            "format": "int64"
+                        }
+                    },
                     {
                         "name": "OCS-APIRequest",
                         "in": "header",
@@ -10915,7 +10942,7 @@
                 ],
                 "responses": {
                     "200": {
-                        "description": "Image reseted to default",
+                        "description": "OK",
                         "content": {
                             "application/json": {
                                 "schema": {
@@ -10935,7 +10962,37 @@
                                                     "$ref": "#/components/schemas/OCSMeta"
                                                 },
                                                 "data": {
-                                                    "$ref": "#/components/schemas/SuccessStatusResponse"
+                                                    "$ref": "#/components/schemas/UserElementsMessageResponse"
+                                                }
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    },
+                    "422": {
+                        "description": "Error",
+                        "content": {
+                            "application/json": {
+                                "schema": {
+                                    "type": "object",
+                                    "required": [
+                                        "ocs"
+                                    ],
+                                    "properties": {
+                                        "ocs": {
+                                            "type": "object",
+                                            "required": [
+                                                "meta",
+                                                "data"
+                                            ],
+                                            "properties": {
+                                                "meta": {
+                                                    "$ref": "#/components/schemas/OCSMeta"
+                                                },
+                                                "data": {
+                                                    "$ref": "#/components/schemas/MessageResponse"
                                                 }
                                             }
                                         }
@@ -10947,13 +11004,13 @@
                 }
             },
             "delete": {
-                "operationId": "admin-signature-background-delete",
-                "summary": "Delete background image",
-                "description": "This endpoint requires admin access",
+                "operationId": "signature_elements-delete-signature-element",
+                "summary": "Delete signature element",
                 "tags": [
-                    "admin"
+                    "signature_elements"
                 ],
                 "security": [
+                    {},
                     {
                         "bearer_auth": []
                     },
@@ -10974,6 +11031,16 @@
                             "default": "v1"
                         }
                     },
+                    {
+                        "name": "nodeId",
+                        "in": "path",
+                        "description": "Node id of a Nextcloud file",
+                        "required": true,
+                        "schema": {
+                            "type": "integer",
+                            "format": "int64"
+                        }
+                    },
                     {
                         "name": "OCS-APIRequest",
                         "in": "header",
@@ -10987,7 +11054,7 @@
                 ],
                 "responses": {
                     "200": {
-                        "description": "Deleted with success",
+                        "description": "OK",
                         "content": {
                             "application/json": {
                                 "schema": {
@@ -11007,7 +11074,37 @@
                                                     "$ref": "#/components/schemas/OCSMeta"
                                                 },
                                                 "data": {
-                                                    "$ref": "#/components/schemas/SuccessStatusResponse"
+                                                    "$ref": "#/components/schemas/MessageResponse"
+                                                }
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    },
+                    "404": {
+                        "description": "Not found",
+                        "content": {
+                            "application/json": {
+                                "schema": {
+                                    "type": "object",
+                                    "required": [
+                                        "ocs"
+                                    ],
+                                    "properties": {
+                                        "ocs": {
+                                            "type": "object",
+                                            "required": [
+                                                "meta",
+                                                "data"
+                                            ],
+                                            "properties": {
+                                                "meta": {
+                                                    "$ref": "#/components/schemas/OCSMeta"
+                                                },
+                                                "data": {
+                                                    "$ref": "#/components/schemas/MessageResponse"
                                                 }
                                             }
                                         }
@@ -11019,10 +11116,10 @@
                 }
             }
         },
-        "/ocs/v2.php/apps/libresign/api/{apiVersion}/admin/signature-text": {
+        "/ocs/v2.php/apps/libresign/api/{apiVersion}/admin/certificate/cfssl": {
             "post": {
-                "operationId": "admin-signature-text-save",
-                "summary": "Save signature text service",
+                "operationId": "admin-generate-certificate-cfssl",
+                "summary": "Generate certificate using CFSSL engine",
                 "description": "This endpoint requires admin access",
                 "tags": [
                     "admin"
@@ -11042,41 +11139,55 @@
                             "schema": {
                                 "type": "object",
                                 "required": [
-                                    "template"
+                                    "rootCert"
                                 ],
                                 "properties": {
-                                    "template": {
-                                        "type": "string",
-                                        "description": "Template to signature text"
-                                    },
-                                    "templateFontSize": {
-                                        "type": "number",
-                                        "format": "double",
-                                        "default": 10,
-                                        "description": "Font size used when print the parsed text of this template at PDF file"
-                                    },
-                                    "signatureFontSize": {
-                                        "type": "number",
-                                        "format": "double",
-                                        "default": 20,
-                                        "description": "Font size used when the signature mode is SIGNAME_AND_DESCRIPTION"
-                                    },
-                                    "signatureWidth": {
-                                        "type": "number",
-                                        "format": "double",
-                                        "default": 350,
-                                        "description": "Signature box width, minimum 1"
+                                    "rootCert": {
+                                        "type": "object",
+                                        "description": "fields of root certificate",
+                                        "required": [
+                                            "commonName",
+                                            "names"
+                                        ],
+                                        "properties": {
+                                            "commonName": {
+                                                "type": "string"
+                                            },
+                                            "names": {
+                                                "type": "object",
+                                                "additionalProperties": {
+                                                    "type": "object",
+                                                    "required": [
+                                                        "value"
+                                                    ],
+                                                    "properties": {
+                                                        "value": {
+                                                            "oneOf": [
+                                                                {
+                                                                    "type": "string"
+                                                                },
+                                                                {
+                                                                    "type": "array",
+                                                                    "items": {
+                                                                        "type": "string"
+                                                                    }
+                                                                }
+                                                            ]
+                                                        }
+                                                    }
+                                                }
+                                            }
+                                        }
                                     },
-                                    "signatureHeight": {
-                                        "type": "number",
-                                        "format": "double",
-                                        "default": 100,
-                                        "description": "Signature box height, minimum 1"
+                                    "cfsslUri": {
+                                        "type": "string",
+                                        "default": "",
+                                        "description": "URI of CFSSL API"
                                     },
-                                    "renderMode": {
+                                    "configPath": {
                                         "type": "string",
-                                        "default": "GRAPHIC_AND_DESCRIPTION",
-                                        "description": "Signature render mode"
+                                        "default": "",
+                                        "description": "Path of config files of CFSSL"
                                     }
                                 }
                             }
@@ -11129,7 +11240,7 @@
                                                     "$ref": "#/components/schemas/OCSMeta"
                                                 },
                                                 "data": {
-                                                    "$ref": "#/components/schemas/SignatureTextSettingsResponse"
+                                                    "$ref": "#/components/schemas/EngineHandlerResponse"
                                                 }
                                             }
                                         }
@@ -11138,8 +11249,8 @@
                             }
                         }
                     },
-                    "400": {
-                        "description": "Bad request",
+                    "401": {
+                        "description": "Account not found",
                         "content": {
                             "application/json": {
                                 "schema": {
@@ -11159,7 +11270,7 @@
                                                     "$ref": "#/components/schemas/OCSMeta"
                                                 },
                                                 "data": {
-                                                    "$ref": "#/components/schemas/ErrorResponse"
+                                                    "$ref": "#/components/schemas/MessageResponse"
                                                 }
                                             }
                                         }
@@ -11169,10 +11280,12 @@
                         }
                     }
                 }
-            },
-            "get": {
-                "operationId": "admin-signature-text-get",
-                "summary": "Get parsed signature text service",
+            }
+        },
+        "/ocs/v2.php/apps/libresign/api/{apiVersion}/admin/certificate/openssl": {
+            "post": {
+                "operationId": "admin-generate-certificate-open-ssl",
+                "summary": "Generate certificate using OpenSSL engine",
                 "description": "This endpoint requires admin access",
                 "tags": [
                     "admin"
@@ -11185,35 +11298,74 @@
                         "basic_auth": []
                     }
                 ],
-                "parameters": [
-                    {
-                        "name": "apiVersion",
-                        "in": "path",
-                        "required": true,
-                        "schema": {
-                            "type": "string",
-                            "enum": [
-                                "v1"
-                            ],
-                            "default": "v1"
-                        }
-                    },
-                    {
-                        "name": "template",
-                        "in": "query",
-                        "description": "Template to signature text",
-                        "schema": {
-                            "type": "string",
-                            "default": ""
+                "requestBody": {
+                    "required": true,
+                    "content": {
+                        "application/json": {
+                            "schema": {
+                                "type": "object",
+                                "required": [
+                                    "rootCert"
+                                ],
+                                "properties": {
+                                    "rootCert": {
+                                        "type": "object",
+                                        "description": "fields of root certificate",
+                                        "required": [
+                                            "commonName",
+                                            "names"
+                                        ],
+                                        "properties": {
+                                            "commonName": {
+                                                "type": "string"
+                                            },
+                                            "names": {
+                                                "type": "object",
+                                                "additionalProperties": {
+                                                    "type": "object",
+                                                    "required": [
+                                                        "value"
+                                                    ],
+                                                    "properties": {
+                                                        "value": {
+                                                            "oneOf": [
+                                                                {
+                                                                    "type": "string"
+                                                                },
+                                                                {
+                                                                    "type": "array",
+                                                                    "items": {
+                                                                        "type": "string"
+                                                                    }
+                                                                }
+                                                            ]
+                                                        }
+                                                    }
+                                                }
+                                            }
+                                        }
+                                    },
+                                    "configPath": {
+                                        "type": "string",
+                                        "default": "",
+                                        "description": "Path of config files of CFSSL"
+                                    }
+                                }
+                            }
                         }
-                    },
+                    }
+                },
+                "parameters": [
                     {
-                        "name": "context",
-                        "in": "query",
-                        "description": "Context for parsing the template",
+                        "name": "apiVersion",
+                        "in": "path",
+                        "required": true,
                         "schema": {
                             "type": "string",
-                            "default": ""
+                            "enum": [
+                                "v1"
+                            ],
+                            "default": "v1"
                         }
                     },
                     {
@@ -11249,7 +11401,7 @@
                                                     "$ref": "#/components/schemas/OCSMeta"
                                                 },
                                                 "data": {
-                                                    "$ref": "#/components/schemas/SignatureTextSettingsResponse"
+                                                    "$ref": "#/components/schemas/EngineHandlerResponse"
                                                 }
                                             }
                                         }
@@ -11258,8 +11410,8 @@
                             }
                         }
                     },
-                    "400": {
-                        "description": "Bad request",
+                    "401": {
+                        "description": "Account not found",
                         "content": {
                             "application/json": {
                                 "schema": {
@@ -11279,7 +11431,7 @@
                                                     "$ref": "#/components/schemas/OCSMeta"
                                                 },
                                                 "data": {
-                                                    "$ref": "#/components/schemas/ErrorResponse"
+                                                    "$ref": "#/components/schemas/MessageResponse"
                                                 }
                                             }
                                         }
@@ -11291,11 +11443,11 @@
                 }
             }
         },
-        "/ocs/v2.php/apps/libresign/api/{apiVersion}/admin/signature-settings": {
-            "get": {
-                "operationId": "admin-get-signature-settings",
-                "summary": "Get signature settings",
-                "description": "This endpoint requires admin access",
+        "/ocs/v2.php/apps/libresign/api/{apiVersion}/admin/certificate/engine": {
+            "post": {
+                "operationId": "admin-set-certificate-engine",
+                "summary": "Set certificate engine",
+                "description": "Sets the certificate engine (openssl, cfssl, or none) and automatically configures identify_methods when needed\nThis endpoint requires admin access",
                 "tags": [
                     "admin"
                 ],
@@ -11307,6 +11459,25 @@
                         "basic_auth": []
                     }
                 ],
+                "requestBody": {
+                    "required": true,
+                    "content": {
+                        "application/json": {
+                            "schema": {
+                                "type": "object",
+                                "required": [
+                                    "engine"
+                                ],
+                                "properties": {
+                                    "engine": {
+                                        "type": "string",
+                                        "description": "The certificate engine to use (openssl, cfssl, or none)"
+                                    }
+                                }
+                            }
+                        }
+                    }
+                },
                 "parameters": [
                     {
                         "name": "apiVersion",
@@ -11353,7 +11524,37 @@
                                                     "$ref": "#/components/schemas/OCSMeta"
                                                 },
                                                 "data": {
-                                                    "$ref": "#/components/schemas/SignatureTemplateSettingsResponse"
+                                                    "$ref": "#/components/schemas/CertificateEngineConfigResponse"
+                                                }
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    },
+                    "400": {
+                        "description": "Invalid engine",
+                        "content": {
+                            "application/json": {
+                                "schema": {
+                                    "type": "object",
+                                    "required": [
+                                        "ocs"
+                                    ],
+                                    "properties": {
+                                        "ocs": {
+                                            "type": "object",
+                                            "required": [
+                                                "meta",
+                                                "data"
+                                            ],
+                                            "properties": {
+                                                "meta": {
+                                                    "$ref": "#/components/schemas/OCSMeta"
+                                                },
+                                                "data": {
+                                                    "$ref": "#/components/schemas/MessageResponse"
                                                 }
                                             }
                                         }
@@ -11365,11 +11566,11 @@
                 }
             }
         },
-        "/ocs/v2.php/apps/libresign/api/{apiVersion}/admin/signer-name": {
+        "/ocs/v2.php/apps/libresign/api/{apiVersion}/admin/certificate": {
             "get": {
-                "operationId": "admin-signer-name",
-                "summary": "Convert signer name as image",
-                "description": "This endpoint requires admin access",
+                "operationId": "admin-load-certificate",
+                "summary": "Load certificate data",
+                "description": "Return all data of root certificate and a field called `generated` with a boolean value.\nThis endpoint requires admin access",
                 "tags": [
                     "admin"
                 ],
@@ -11394,67 +11595,6 @@
                             "default": "v1"
                         }
                     },
-                    {
-                        "name": "width",
-                        "in": "query",
-                        "description": "Image width,",
-                        "required": true,
-                        "schema": {
-                            "type": "integer",
-                            "format": "int64"
-                        }
-                    },
-                    {
-                        "name": "height",
-                        "in": "query",
-                        "description": "Image height",
-                        "required": true,
-                        "schema": {
-                            "type": "integer",
-                            "format": "int64"
-                        }
-                    },
-                    {
-                        "name": "text",
-                        "in": "query",
-                        "description": "Text to be added to image",
-                        "required": true,
-                        "schema": {
-                            "type": "string"
-                        }
-                    },
-                    {
-                        "name": "fontSize",
-                        "in": "query",
-                        "description": "Font size of text",
-                        "required": true,
-                        "schema": {
-                            "type": "number",
-                            "format": "double"
-                        }
-                    },
-                    {
-                        "name": "isDarkTheme",
-                        "in": "query",
-                        "description": "Color of text, white if is tark theme and black if not",
-                        "required": true,
-                        "schema": {
-                            "type": "integer",
-                            "enum": [
-                                0,
-                                1
-                            ]
-                        }
-                    },
-                    {
-                        "name": "align",
-                        "in": "query",
-                        "description": "Align of text: left, center or right",
-                        "required": true,
-                        "schema": {
-                            "type": "string"
-                        }
-                    },
                     {
                         "name": "OCS-APIRequest",
                         "in": "header",
@@ -11469,27 +11609,6 @@
                 "responses": {
                     "200": {
                         "description": "OK",
-                        "headers": {
-                            "Content-Disposition": {
-                                "schema": {
-                                    "type": "string",
-                                    "enum": [
-                                        "inline; filename=\"signer-name.png\""
-                                    ]
-                                }
-                            }
-                        },
-                        "content": {
-                            "image/png": {
-                                "schema": {
-                                    "type": "string",
-                                    "format": "binary"
-                                }
-                            }
-                        }
-                    },
-                    "400": {
-                        "description": "Bad request",
                         "content": {
                             "application/json": {
                                 "schema": {
@@ -11509,7 +11628,7 @@
                                                     "$ref": "#/components/schemas/OCSMeta"
                                                 },
                                                 "data": {
-                                                    "$ref": "#/components/schemas/ErrorResponse"
+                                                    "$ref": "#/components/schemas/CetificateDataGenerated"
                                                 }
                                             }
                                         }
@@ -11521,11 +11640,11 @@
                 }
             }
         },
-        "/ocs/v2.php/apps/libresign/api/{apiVersion}/admin/certificate-policy": {
-            "post": {
-                "operationId": "admin-save-certificate-policy",
-                "summary": "Update certificate policy of this instance",
-                "description": "This endpoint requires admin access",
+        "/ocs/v2.php/apps/libresign/api/{apiVersion}/admin/configure-check": {
+            "get": {
+                "operationId": "admin-configure-check",
+                "summary": "Check the configuration of LibreSign",
+                "description": "Return the status of necessary configuration and tips to fix the problems.\nThis endpoint requires admin access",
                 "tags": [
                     "admin"
                 ],
@@ -11583,37 +11702,7 @@
                                                     "$ref": "#/components/schemas/OCSMeta"
                                                 },
                                                 "data": {
-                                                    "$ref": "#/components/schemas/CertificatePolicyResponse"
-                                                }
-                                            }
-                                        }
-                                    }
-                                }
-                            }
-                        }
-                    },
-                    "422": {
-                        "description": "Not found",
-                        "content": {
-                            "application/json": {
-                                "schema": {
-                                    "type": "object",
-                                    "required": [
-                                        "ocs"
-                                    ],
-                                    "properties": {
-                                        "ocs": {
-                                            "type": "object",
-                                            "required": [
-                                                "meta",
-                                                "data"
-                                            ],
-                                            "properties": {
-                                                "meta": {
-                                                    "$ref": "#/components/schemas/OCSMeta"
-                                                },
-                                                "data": {
-                                                    "$ref": "#/components/schemas/FailureStatusResponse"
+                                                    "$ref": "#/components/schemas/ConfigureChecksResponse"
                                                 }
                                             }
                                         }
@@ -11623,11 +11712,13 @@
                         }
                     }
                 }
-            },
-            "delete": {
-                "operationId": "admin-delete-certificate-policy",
-                "summary": "Delete certificate policy of this instance",
-                "description": "This endpoint requires admin access",
+            }
+        },
+        "/ocs/v2.php/apps/libresign/api/{apiVersion}/admin/disable-hate-limit": {
+            "get": {
+                "operationId": "admin-disable-hate-limit",
+                "summary": "Disable hate limit to current session",
+                "description": "This will disable hate limit to current session.\nThis endpoint requires admin access",
                 "tags": [
                     "admin"
                 ],
@@ -11684,9 +11775,7 @@
                                                 "meta": {
                                                     "$ref": "#/components/schemas/OCSMeta"
                                                 },
-                                                "data": {
-                                                    "type": "object"
-                                                }
+                                                "data": {}
                                             }
                                         }
                                     }
@@ -11697,10 +11786,10 @@
                 }
             }
         },
-        "/ocs/v2.php/apps/libresign/api/{apiVersion}/admin/certificate-policy/oid": {
+        "/ocs/v2.php/apps/libresign/api/{apiVersion}/admin/signature-background": {
             "post": {
-                "operationId": "admin-updateoid",
-                "summary": "Update OID",
+                "operationId": "admin-signature-background-save",
+                "summary": "Add custom background image",
                 "description": "This endpoint requires admin access",
                 "tags": [
                     "admin"
@@ -11713,25 +11802,6 @@
                         "basic_auth": []
                     }
                 ],
-                "requestBody": {
-                    "required": true,
-                    "content": {
-                        "application/json": {
-                            "schema": {
-                                "type": "object",
-                                "required": [
-                                    "oid"
-                                ],
-                                "properties": {
-                                    "oid": {
-                                        "type": "string",
-                                        "description": "OID is a unique numeric identifier for certificate policies in digital certificates."
-                                    }
-                                }
-                            }
-                        }
-                    }
-                },
                 "parameters": [
                     {
                         "name": "apiVersion",
@@ -11788,7 +11858,7 @@
                         }
                     },
                     "422": {
-                        "description": "Validation error",
+                        "description": "Error",
                         "content": {
                             "application/json": {
                                 "schema": {
@@ -11818,12 +11888,10 @@
                         }
                     }
                 }
-            }
-        },
-        "/ocs/v2.php/apps/libresign/api/{apiVersion}/admin/reminder": {
+            },
             "get": {
-                "operationId": "admin-reminder-fetch",
-                "summary": "Get reminder settings",
+                "operationId": "admin-signature-background-get",
+                "summary": "Get custom background image",
                 "description": "This endpoint requires admin access",
                 "tags": [
                     "admin"
@@ -11862,7 +11930,60 @@
                 ],
                 "responses": {
                     "200": {
-                        "description": "OK",
+                        "description": "Image returned",
+                        "content": {
+                            "*/*": {
+                                "schema": {
+                                    "type": "string",
+                                    "format": "binary"
+                                }
+                            }
+                        }
+                    }
+                }
+            },
+            "patch": {
+                "operationId": "admin-signature-background-reset",
+                "summary": "Reset the background image to be the default of LibreSign",
+                "description": "This endpoint requires admin access",
+                "tags": [
+                    "admin"
+                ],
+                "security": [
+                    {
+                        "bearer_auth": []
+                    },
+                    {
+                        "basic_auth": []
+                    }
+                ],
+                "parameters": [
+                    {
+                        "name": "apiVersion",
+                        "in": "path",
+                        "required": true,
+                        "schema": {
+                            "type": "string",
+                            "enum": [
+                                "v1"
+                            ],
+                            "default": "v1"
+                        }
+                    },
+                    {
+                        "name": "OCS-APIRequest",
+                        "in": "header",
+                        "description": "Required to be true for the API request to pass",
+                        "required": true,
+                        "schema": {
+                            "type": "boolean",
+                            "default": true
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "Image reseted to default",
                         "content": {
                             "application/json": {
                                 "schema": {
@@ -11882,7 +12003,7 @@
                                                     "$ref": "#/components/schemas/OCSMeta"
                                                 },
                                                 "data": {
-                                                    "$ref": "#/components/schemas/ReminderSettings"
+                                                    "$ref": "#/components/schemas/SuccessStatusResponse"
                                                 }
                                             }
                                         }
@@ -11893,9 +12014,9 @@
                     }
                 }
             },
-            "post": {
-                "operationId": "admin-reminder-save",
-                "summary": "Save reminder",
+            "delete": {
+                "operationId": "admin-signature-background-delete",
+                "summary": "Delete background image",
                 "description": "This endpoint requires admin access",
                 "tags": [
                     "admin"
@@ -11908,43 +12029,6 @@
                         "basic_auth": []
                     }
                 ],
-                "requestBody": {
-                    "required": true,
-                    "content": {
-                        "application/json": {
-                            "schema": {
-                                "type": "object",
-                                "required": [
-                                    "daysBefore",
-                                    "daysBetween",
-                                    "max",
-                                    "sendTimer"
-                                ],
-                                "properties": {
-                                    "daysBefore": {
-                                        "type": "integer",
-                                        "format": "int64",
-                                        "description": "First reminder after (days)"
-                                    },
-                                    "daysBetween": {
-                                        "type": "integer",
-                                        "format": "int64",
-                                        "description": "Days between reminders"
-                                    },
-                                    "max": {
-                                        "type": "integer",
-                                        "format": "int64",
-                                        "description": "Max reminders per signer"
-                                    },
-                                    "sendTimer": {
-                                        "type": "string",
-                                        "description": "Send time (HH:mm)"
-                                    }
-                                }
-                            }
-                        }
-                    }
-                },
                 "parameters": [
                     {
                         "name": "apiVersion",
@@ -11971,7 +12055,7 @@
                 ],
                 "responses": {
                     "200": {
-                        "description": "OK",
+                        "description": "Deleted with success",
                         "content": {
                             "application/json": {
                                 "schema": {
@@ -11991,7 +12075,7 @@
                                                     "$ref": "#/components/schemas/OCSMeta"
                                                 },
                                                 "data": {
-                                                    "$ref": "#/components/schemas/ReminderSettings"
+                                                    "$ref": "#/components/schemas/SuccessStatusResponse"
                                                 }
                                             }
                                         }
@@ -12003,11 +12087,11 @@
                 }
             }
         },
-        "/ocs/v2.php/apps/libresign/api/{apiVersion}/admin/tsa": {
+        "/ocs/v2.php/apps/libresign/api/{apiVersion}/admin/signature-text": {
             "post": {
-                "operationId": "admin-set-tsa-config",
-                "summary": "Set TSA configuration values with proper sensitive data handling",
-                "description": "Only saves configuration if tsa_url is provided. Automatically manages username/password fields based on authentication type.\nThis endpoint requires admin access",
+                "operationId": "admin-signature-text-save",
+                "summary": "Save signature text service",
+                "description": "This endpoint requires admin access",
                 "tags": [
                     "admin"
                 ],
@@ -12020,36 +12104,47 @@
                     }
                 ],
                 "requestBody": {
-                    "required": false,
+                    "required": true,
                     "content": {
                         "application/json": {
                             "schema": {
                                 "type": "object",
+                                "required": [
+                                    "template"
+                                ],
                                 "properties": {
-                                    "tsa_url": {
+                                    "template": {
                                         "type": "string",
-                                        "nullable": true,
-                                        "description": "TSA server URL (required for saving)"
+                                        "description": "Template to signature text"
                                     },
-                                    "tsa_policy_oid": {
-                                        "type": "string",
-                                        "nullable": true,
-                                        "description": "TSA policy OID"
+                                    "templateFontSize": {
+                                        "type": "number",
+                                        "format": "double",
+                                        "default": 10,
+                                        "description": "Font size used when print the parsed text of this template at PDF file"
                                     },
-                                    "tsa_auth_type": {
-                                        "type": "string",
-                                        "nullable": true,
-                                        "description": "Authentication type (none|basic), defaults to 'none'"
+                                    "signatureFontSize": {
+                                        "type": "number",
+                                        "format": "double",
+                                        "default": 20,
+                                        "description": "Font size used when the signature mode is SIGNAME_AND_DESCRIPTION"
                                     },
-                                    "tsa_username": {
-                                        "type": "string",
-                                        "nullable": true,
-                                        "description": "Username for basic authentication"
+                                    "signatureWidth": {
+                                        "type": "number",
+                                        "format": "double",
+                                        "default": 350,
+                                        "description": "Signature box width, minimum 1"
                                     },
-                                    "tsa_password": {
+                                    "signatureHeight": {
+                                        "type": "number",
+                                        "format": "double",
+                                        "default": 100,
+                                        "description": "Signature box height, minimum 1"
+                                    },
+                                    "renderMode": {
                                         "type": "string",
-                                        "nullable": true,
-                                        "description": "Password for basic authentication (stored as sensitive data)"
+                                        "default": "GRAPHIC_AND_DESCRIPTION",
+                                        "description": "Signature render mode"
                                     }
                                 }
                             }
@@ -12102,7 +12197,7 @@
                                                     "$ref": "#/components/schemas/OCSMeta"
                                                 },
                                                 "data": {
-                                                    "$ref": "#/components/schemas/SuccessStatusResponse"
+                                                    "$ref": "#/components/schemas/SignatureTextSettingsResponse"
                                                 }
                                             }
                                         }
@@ -12112,7 +12207,7 @@
                         }
                     },
                     "400": {
-                        "description": "Validation error",
+                        "description": "Bad request",
                         "content": {
                             "application/json": {
                                 "schema": {
@@ -12132,7 +12227,7 @@
                                                     "$ref": "#/components/schemas/OCSMeta"
                                                 },
                                                 "data": {
-                                                    "$ref": "#/components/schemas/ErrorStatusResponse"
+                                                    "$ref": "#/components/schemas/ErrorResponse"
                                                 }
                                             }
                                         }
@@ -12143,10 +12238,10 @@
                     }
                 }
             },
-            "delete": {
-                "operationId": "admin-delete-tsa-config",
-                "summary": "Delete TSA configuration",
-                "description": "Delete all TSA configuration fields from the application settings.\nThis endpoint requires admin access",
+            "get": {
+                "operationId": "admin-signature-text-get",
+                "summary": "Get parsed signature text service",
+                "description": "This endpoint requires admin access",
                 "tags": [
                     "admin"
                 ],
@@ -12172,10 +12267,28 @@
                         }
                     },
                     {
-                        "name": "OCS-APIRequest",
-                        "in": "header",
-                        "description": "Required to be true for the API request to pass",
-                        "required": true,
+                        "name": "template",
+                        "in": "query",
+                        "description": "Template to signature text",
+                        "schema": {
+                            "type": "string",
+                            "default": ""
+                        }
+                    },
+                    {
+                        "name": "context",
+                        "in": "query",
+                        "description": "Context for parsing the template",
+                        "schema": {
+                            "type": "string",
+                            "default": ""
+                        }
+                    },
+                    {
+                        "name": "OCS-APIRequest",
+                        "in": "header",
+                        "description": "Required to be true for the API request to pass",
+                        "required": true,
                         "schema": {
                             "type": "boolean",
                             "default": true
@@ -12204,7 +12317,37 @@
                                                     "$ref": "#/components/schemas/OCSMeta"
                                                 },
                                                 "data": {
-                                                    "$ref": "#/components/schemas/SuccessStatusResponse"
+                                                    "$ref": "#/components/schemas/SignatureTextSettingsResponse"
+                                                }
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    },
+                    "400": {
+                        "description": "Bad request",
+                        "content": {
+                            "application/json": {
+                                "schema": {
+                                    "type": "object",
+                                    "required": [
+                                        "ocs"
+                                    ],
+                                    "properties": {
+                                        "ocs": {
+                                            "type": "object",
+                                            "required": [
+                                                "meta",
+                                                "data"
+                                            ],
+                                            "properties": {
+                                                "meta": {
+                                                    "$ref": "#/components/schemas/OCSMeta"
+                                                },
+                                                "data": {
+                                                    "$ref": "#/components/schemas/ErrorResponse"
                                                 }
                                             }
                                         }
@@ -12216,11 +12359,11 @@
                 }
             }
         },
-        "/ocs/v2.php/apps/libresign/api/{apiVersion}/admin/footer-template": {
+        "/ocs/v2.php/apps/libresign/api/{apiVersion}/admin/signature-settings": {
             "get": {
-                "operationId": "admin-get-footer-template",
-                "summary": "Get footer template",
-                "description": "Returns the current footer template if set, otherwise returns the default template.\nThis endpoint requires admin access",
+                "operationId": "admin-get-signature-settings",
+                "summary": "Get signature settings",
+                "description": "This endpoint requires admin access",
                 "tags": [
                     "admin"
                 ],
@@ -12278,7 +12421,7 @@
                                                     "$ref": "#/components/schemas/OCSMeta"
                                                 },
                                                 "data": {
-                                                    "$ref": "#/components/schemas/FooterTemplateResponse"
+                                                    "$ref": "#/components/schemas/SignatureTemplateSettingsResponse"
                                                 }
                                             }
                                         }
@@ -12288,11 +12431,13 @@
                         }
                     }
                 }
-            },
-            "post": {
-                "operationId": "admin-save-footer-template",
-                "summary": "Save footer template and render preview",
-                "description": "Saves the footer template and returns the rendered PDF preview.\nThis endpoint requires admin access",
+            }
+        },
+        "/ocs/v2.php/apps/libresign/api/{apiVersion}/admin/signer-name": {
+            "get": {
+                "operationId": "admin-signer-name",
+                "summary": "Convert signer name as image",
+                "description": "This endpoint requires admin access",
                 "tags": [
                     "admin"
                 ],
@@ -12304,35 +12449,6 @@
                         "basic_auth": []
                     }
                 ],
-                "requestBody": {
-                    "required": false,
-                    "content": {
-                        "application/json": {
-                            "schema": {
-                                "type": "object",
-                                "properties": {
-                                    "template": {
-                                        "type": "string",
-                                        "default": "",
-                                        "description": "The Twig template to save (empty to reset to default)"
-                                    },
-                                    "width": {
-                                        "type": "integer",
-                                        "format": "int64",
-                                        "default": 595,
-                                        "description": "Width of preview in points (default: 595 - A4 width)"
-                                    },
-                                    "height": {
-                                        "type": "integer",
-                                        "format": "int64",
-                                        "default": 50,
-                                        "description": "Height of preview in points (default: 50)"
-                                    }
-                                }
-                            }
-                        }
-                    }
-                },
                 "parameters": [
                     {
                         "name": "apiVersion",
@@ -12346,6 +12462,67 @@
                             "default": "v1"
                         }
                     },
+                    {
+                        "name": "width",
+                        "in": "query",
+                        "description": "Image width,",
+                        "required": true,
+                        "schema": {
+                            "type": "integer",
+                            "format": "int64"
+                        }
+                    },
+                    {
+                        "name": "height",
+                        "in": "query",
+                        "description": "Image height",
+                        "required": true,
+                        "schema": {
+                            "type": "integer",
+                            "format": "int64"
+                        }
+                    },
+                    {
+                        "name": "text",
+                        "in": "query",
+                        "description": "Text to be added to image",
+                        "required": true,
+                        "schema": {
+                            "type": "string"
+                        }
+                    },
+                    {
+                        "name": "fontSize",
+                        "in": "query",
+                        "description": "Font size of text",
+                        "required": true,
+                        "schema": {
+                            "type": "number",
+                            "format": "double"
+                        }
+                    },
+                    {
+                        "name": "isDarkTheme",
+                        "in": "query",
+                        "description": "Color of text, white if is tark theme and black if not",
+                        "required": true,
+                        "schema": {
+                            "type": "integer",
+                            "enum": [
+                                0,
+                                1
+                            ]
+                        }
+                    },
+                    {
+                        "name": "align",
+                        "in": "query",
+                        "description": "Align of text: left, center or right",
+                        "required": true,
+                        "schema": {
+                            "type": "string"
+                        }
+                    },
                     {
                         "name": "OCS-APIRequest",
                         "in": "header",
@@ -12360,8 +12537,18 @@
                 "responses": {
                     "200": {
                         "description": "OK",
+                        "headers": {
+                            "Content-Disposition": {
+                                "schema": {
+                                    "type": "string",
+                                    "enum": [
+                                        "inline; filename=\"signer-name.png\""
+                                    ]
+                                }
+                            }
+                        },
                         "content": {
-                            "application/pdf": {
+                            "image/png": {
                                 "schema": {
                                     "type": "string",
                                     "format": "binary"
@@ -12402,11 +12589,11 @@
                 }
             }
         },
-        "/ocs/v2.php/apps/libresign/api/{apiVersion}/admin/signing-mode/config": {
+        "/ocs/v2.php/apps/libresign/api/{apiVersion}/admin/certificate-policy": {
             "post": {
-                "operationId": "admin-set-signing-mode-config",
-                "summary": "Set signing mode configuration",
-                "description": "Configure whether document signing should be synchronous or asynchronous\nThis endpoint requires admin access",
+                "operationId": "admin-save-certificate-policy",
+                "summary": "Update certificate policy of this instance",
+                "description": "This endpoint requires admin access",
                 "tags": [
                     "admin"
                 ],
@@ -12418,41 +12605,1421 @@
                         "basic_auth": []
                     }
                 ],
-                "requestBody": {
-                    "required": true,
-                    "content": {
-                        "application/json": {
-                            "schema": {
-                                "type": "object",
-                                "required": [
-                                    "mode"
-                                ],
-                                "properties": {
-                                    "mode": {
-                                        "type": "string",
-                                        "description": "Signing mode: \"sync\" or \"async\""
-                                    },
-                                    "workerType": {
-                                        "type": "string",
-                                        "nullable": true,
-                                        "description": "Worker type when async: \"local\" or \"external\" (optional)"
+                "parameters": [
+                    {
+                        "name": "apiVersion",
+                        "in": "path",
+                        "required": true,
+                        "schema": {
+                            "type": "string",
+                            "enum": [
+                                "v1"
+                            ],
+                            "default": "v1"
+                        }
+                    },
+                    {
+                        "name": "OCS-APIRequest",
+                        "in": "header",
+                        "description": "Required to be true for the API request to pass",
+                        "required": true,
+                        "schema": {
+                            "type": "boolean",
+                            "default": true
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "content": {
+                            "application/json": {
+                                "schema": {
+                                    "type": "object",
+                                    "required": [
+                                        "ocs"
+                                    ],
+                                    "properties": {
+                                        "ocs": {
+                                            "type": "object",
+                                            "required": [
+                                                "meta",
+                                                "data"
+                                            ],
+                                            "properties": {
+                                                "meta": {
+                                                    "$ref": "#/components/schemas/OCSMeta"
+                                                },
+                                                "data": {
+                                                    "$ref": "#/components/schemas/CertificatePolicyResponse"
+                                                }
+                                            }
+                                        }
                                     }
                                 }
                             }
                         }
-                    }
-                },
-                "parameters": [
+                    },
+                    "422": {
+                        "description": "Not found",
+                        "content": {
+                            "application/json": {
+                                "schema": {
+                                    "type": "object",
+                                    "required": [
+                                        "ocs"
+                                    ],
+                                    "properties": {
+                                        "ocs": {
+                                            "type": "object",
+                                            "required": [
+                                                "meta",
+                                                "data"
+                                            ],
+                                            "properties": {
+                                                "meta": {
+                                                    "$ref": "#/components/schemas/OCSMeta"
+                                                },
+                                                "data": {
+                                                    "$ref": "#/components/schemas/FailureStatusResponse"
+                                                }
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            },
+            "delete": {
+                "operationId": "admin-delete-certificate-policy",
+                "summary": "Delete certificate policy of this instance",
+                "description": "This endpoint requires admin access",
+                "tags": [
+                    "admin"
+                ],
+                "security": [
+                    {
+                        "bearer_auth": []
+                    },
+                    {
+                        "basic_auth": []
+                    }
+                ],
+                "parameters": [
+                    {
+                        "name": "apiVersion",
+                        "in": "path",
+                        "required": true,
+                        "schema": {
+                            "type": "string",
+                            "enum": [
+                                "v1"
+                            ],
+                            "default": "v1"
+                        }
+                    },
+                    {
+                        "name": "OCS-APIRequest",
+                        "in": "header",
+                        "description": "Required to be true for the API request to pass",
+                        "required": true,
+                        "schema": {
+                            "type": "boolean",
+                            "default": true
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "content": {
+                            "application/json": {
+                                "schema": {
+                                    "type": "object",
+                                    "required": [
+                                        "ocs"
+                                    ],
+                                    "properties": {
+                                        "ocs": {
+                                            "type": "object",
+                                            "required": [
+                                                "meta",
+                                                "data"
+                                            ],
+                                            "properties": {
+                                                "meta": {
+                                                    "$ref": "#/components/schemas/OCSMeta"
+                                                },
+                                                "data": {
+                                                    "type": "object"
+                                                }
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        },
+        "/ocs/v2.php/apps/libresign/api/{apiVersion}/admin/certificate-policy/oid": {
+            "post": {
+                "operationId": "admin-updateoid",
+                "summary": "Update OID",
+                "description": "This endpoint requires admin access",
+                "tags": [
+                    "admin"
+                ],
+                "security": [
+                    {
+                        "bearer_auth": []
+                    },
+                    {
+                        "basic_auth": []
+                    }
+                ],
+                "requestBody": {
+                    "required": true,
+                    "content": {
+                        "application/json": {
+                            "schema": {
+                                "type": "object",
+                                "required": [
+                                    "oid"
+                                ],
+                                "properties": {
+                                    "oid": {
+                                        "type": "string",
+                                        "description": "OID is a unique numeric identifier for certificate policies in digital certificates."
+                                    }
+                                }
+                            }
+                        }
+                    }
+                },
+                "parameters": [
+                    {
+                        "name": "apiVersion",
+                        "in": "path",
+                        "required": true,
+                        "schema": {
+                            "type": "string",
+                            "enum": [
+                                "v1"
+                            ],
+                            "default": "v1"
+                        }
+                    },
+                    {
+                        "name": "OCS-APIRequest",
+                        "in": "header",
+                        "description": "Required to be true for the API request to pass",
+                        "required": true,
+                        "schema": {
+                            "type": "boolean",
+                            "default": true
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "content": {
+                            "application/json": {
+                                "schema": {
+                                    "type": "object",
+                                    "required": [
+                                        "ocs"
+                                    ],
+                                    "properties": {
+                                        "ocs": {
+                                            "type": "object",
+                                            "required": [
+                                                "meta",
+                                                "data"
+                                            ],
+                                            "properties": {
+                                                "meta": {
+                                                    "$ref": "#/components/schemas/OCSMeta"
+                                                },
+                                                "data": {
+                                                    "$ref": "#/components/schemas/SuccessStatusResponse"
+                                                }
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    },
+                    "422": {
+                        "description": "Validation error",
+                        "content": {
+                            "application/json": {
+                                "schema": {
+                                    "type": "object",
+                                    "required": [
+                                        "ocs"
+                                    ],
+                                    "properties": {
+                                        "ocs": {
+                                            "type": "object",
+                                            "required": [
+                                                "meta",
+                                                "data"
+                                            ],
+                                            "properties": {
+                                                "meta": {
+                                                    "$ref": "#/components/schemas/OCSMeta"
+                                                },
+                                                "data": {
+                                                    "$ref": "#/components/schemas/FailureStatusResponse"
+                                                }
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        },
+        "/ocs/v2.php/apps/libresign/api/{apiVersion}/admin/reminder": {
+            "get": {
+                "operationId": "admin-reminder-fetch",
+                "summary": "Get reminder settings",
+                "description": "This endpoint requires admin access",
+                "tags": [
+                    "admin"
+                ],
+                "security": [
+                    {
+                        "bearer_auth": []
+                    },
+                    {
+                        "basic_auth": []
+                    }
+                ],
+                "parameters": [
+                    {
+                        "name": "apiVersion",
+                        "in": "path",
+                        "required": true,
+                        "schema": {
+                            "type": "string",
+                            "enum": [
+                                "v1"
+                            ],
+                            "default": "v1"
+                        }
+                    },
+                    {
+                        "name": "OCS-APIRequest",
+                        "in": "header",
+                        "description": "Required to be true for the API request to pass",
+                        "required": true,
+                        "schema": {
+                            "type": "boolean",
+                            "default": true
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "content": {
+                            "application/json": {
+                                "schema": {
+                                    "type": "object",
+                                    "required": [
+                                        "ocs"
+                                    ],
+                                    "properties": {
+                                        "ocs": {
+                                            "type": "object",
+                                            "required": [
+                                                "meta",
+                                                "data"
+                                            ],
+                                            "properties": {
+                                                "meta": {
+                                                    "$ref": "#/components/schemas/OCSMeta"
+                                                },
+                                                "data": {
+                                                    "$ref": "#/components/schemas/ReminderSettings"
+                                                }
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            },
+            "post": {
+                "operationId": "admin-reminder-save",
+                "summary": "Save reminder",
+                "description": "This endpoint requires admin access",
+                "tags": [
+                    "admin"
+                ],
+                "security": [
+                    {
+                        "bearer_auth": []
+                    },
+                    {
+                        "basic_auth": []
+                    }
+                ],
+                "requestBody": {
+                    "required": true,
+                    "content": {
+                        "application/json": {
+                            "schema": {
+                                "type": "object",
+                                "required": [
+                                    "daysBefore",
+                                    "daysBetween",
+                                    "max",
+                                    "sendTimer"
+                                ],
+                                "properties": {
+                                    "daysBefore": {
+                                        "type": "integer",
+                                        "format": "int64",
+                                        "description": "First reminder after (days)"
+                                    },
+                                    "daysBetween": {
+                                        "type": "integer",
+                                        "format": "int64",
+                                        "description": "Days between reminders"
+                                    },
+                                    "max": {
+                                        "type": "integer",
+                                        "format": "int64",
+                                        "description": "Max reminders per signer"
+                                    },
+                                    "sendTimer": {
+                                        "type": "string",
+                                        "description": "Send time (HH:mm)"
+                                    }
+                                }
+                            }
+                        }
+                    }
+                },
+                "parameters": [
+                    {
+                        "name": "apiVersion",
+                        "in": "path",
+                        "required": true,
+                        "schema": {
+                            "type": "string",
+                            "enum": [
+                                "v1"
+                            ],
+                            "default": "v1"
+                        }
+                    },
+                    {
+                        "name": "OCS-APIRequest",
+                        "in": "header",
+                        "description": "Required to be true for the API request to pass",
+                        "required": true,
+                        "schema": {
+                            "type": "boolean",
+                            "default": true
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "content": {
+                            "application/json": {
+                                "schema": {
+                                    "type": "object",
+                                    "required": [
+                                        "ocs"
+                                    ],
+                                    "properties": {
+                                        "ocs": {
+                                            "type": "object",
+                                            "required": [
+                                                "meta",
+                                                "data"
+                                            ],
+                                            "properties": {
+                                                "meta": {
+                                                    "$ref": "#/components/schemas/OCSMeta"
+                                                },
+                                                "data": {
+                                                    "$ref": "#/components/schemas/ReminderSettings"
+                                                }
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        },
+        "/ocs/v2.php/apps/libresign/api/{apiVersion}/admin/tsa": {
+            "post": {
+                "operationId": "admin-set-tsa-config",
+                "summary": "Set TSA configuration values with proper sensitive data handling",
+                "description": "Only saves configuration if tsa_url is provided. Automatically manages username/password fields based on authentication type.\nThis endpoint requires admin access",
+                "tags": [
+                    "admin"
+                ],
+                "security": [
+                    {
+                        "bearer_auth": []
+                    },
+                    {
+                        "basic_auth": []
+                    }
+                ],
+                "requestBody": {
+                    "required": false,
+                    "content": {
+                        "application/json": {
+                            "schema": {
+                                "type": "object",
+                                "properties": {
+                                    "tsa_url": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "description": "TSA server URL (required for saving)"
+                                    },
+                                    "tsa_policy_oid": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "description": "TSA policy OID"
+                                    },
+                                    "tsa_auth_type": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "description": "Authentication type (none|basic), defaults to 'none'"
+                                    },
+                                    "tsa_username": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "description": "Username for basic authentication"
+                                    },
+                                    "tsa_password": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "description": "Password for basic authentication (stored as sensitive data)"
+                                    }
+                                }
+                            }
+                        }
+                    }
+                },
+                "parameters": [
+                    {
+                        "name": "apiVersion",
+                        "in": "path",
+                        "required": true,
+                        "schema": {
+                            "type": "string",
+                            "enum": [
+                                "v1"
+                            ],
+                            "default": "v1"
+                        }
+                    },
+                    {
+                        "name": "OCS-APIRequest",
+                        "in": "header",
+                        "description": "Required to be true for the API request to pass",
+                        "required": true,
+                        "schema": {
+                            "type": "boolean",
+                            "default": true
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "content": {
+                            "application/json": {
+                                "schema": {
+                                    "type": "object",
+                                    "required": [
+                                        "ocs"
+                                    ],
+                                    "properties": {
+                                        "ocs": {
+                                            "type": "object",
+                                            "required": [
+                                                "meta",
+                                                "data"
+                                            ],
+                                            "properties": {
+                                                "meta": {
+                                                    "$ref": "#/components/schemas/OCSMeta"
+                                                },
+                                                "data": {
+                                                    "$ref": "#/components/schemas/SuccessStatusResponse"
+                                                }
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    },
+                    "400": {
+                        "description": "Validation error",
+                        "content": {
+                            "application/json": {
+                                "schema": {
+                                    "type": "object",
+                                    "required": [
+                                        "ocs"
+                                    ],
+                                    "properties": {
+                                        "ocs": {
+                                            "type": "object",
+                                            "required": [
+                                                "meta",
+                                                "data"
+                                            ],
+                                            "properties": {
+                                                "meta": {
+                                                    "$ref": "#/components/schemas/OCSMeta"
+                                                },
+                                                "data": {
+                                                    "$ref": "#/components/schemas/ErrorStatusResponse"
+                                                }
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            },
+            "delete": {
+                "operationId": "admin-delete-tsa-config",
+                "summary": "Delete TSA configuration",
+                "description": "Delete all TSA configuration fields from the application settings.\nThis endpoint requires admin access",
+                "tags": [
+                    "admin"
+                ],
+                "security": [
+                    {
+                        "bearer_auth": []
+                    },
+                    {
+                        "basic_auth": []
+                    }
+                ],
+                "parameters": [
+                    {
+                        "name": "apiVersion",
+                        "in": "path",
+                        "required": true,
+                        "schema": {
+                            "type": "string",
+                            "enum": [
+                                "v1"
+                            ],
+                            "default": "v1"
+                        }
+                    },
+                    {
+                        "name": "OCS-APIRequest",
+                        "in": "header",
+                        "description": "Required to be true for the API request to pass",
+                        "required": true,
+                        "schema": {
+                            "type": "boolean",
+                            "default": true
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "content": {
+                            "application/json": {
+                                "schema": {
+                                    "type": "object",
+                                    "required": [
+                                        "ocs"
+                                    ],
+                                    "properties": {
+                                        "ocs": {
+                                            "type": "object",
+                                            "required": [
+                                                "meta",
+                                                "data"
+                                            ],
+                                            "properties": {
+                                                "meta": {
+                                                    "$ref": "#/components/schemas/OCSMeta"
+                                                },
+                                                "data": {
+                                                    "$ref": "#/components/schemas/SuccessStatusResponse"
+                                                }
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        },
+        "/ocs/v2.php/apps/libresign/api/{apiVersion}/admin/footer-template": {
+            "get": {
+                "operationId": "admin-get-footer-template",
+                "summary": "Get footer template",
+                "description": "Returns the current footer template if set, otherwise returns the default template.\nThis endpoint requires admin access",
+                "tags": [
+                    "admin"
+                ],
+                "security": [
+                    {
+                        "bearer_auth": []
+                    },
+                    {
+                        "basic_auth": []
+                    }
+                ],
+                "parameters": [
+                    {
+                        "name": "apiVersion",
+                        "in": "path",
+                        "required": true,
+                        "schema": {
+                            "type": "string",
+                            "enum": [
+                                "v1"
+                            ],
+                            "default": "v1"
+                        }
+                    },
+                    {
+                        "name": "OCS-APIRequest",
+                        "in": "header",
+                        "description": "Required to be true for the API request to pass",
+                        "required": true,
+                        "schema": {
+                            "type": "boolean",
+                            "default": true
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "content": {
+                            "application/json": {
+                                "schema": {
+                                    "type": "object",
+                                    "required": [
+                                        "ocs"
+                                    ],
+                                    "properties": {
+                                        "ocs": {
+                                            "type": "object",
+                                            "required": [
+                                                "meta",
+                                                "data"
+                                            ],
+                                            "properties": {
+                                                "meta": {
+                                                    "$ref": "#/components/schemas/OCSMeta"
+                                                },
+                                                "data": {
+                                                    "$ref": "#/components/schemas/FooterTemplateResponse"
+                                                }
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            },
+            "post": {
+                "operationId": "admin-save-footer-template",
+                "summary": "Save footer template and render preview",
+                "description": "Saves the footer template and returns the rendered PDF preview.\nThis endpoint requires admin access",
+                "tags": [
+                    "admin"
+                ],
+                "security": [
+                    {
+                        "bearer_auth": []
+                    },
+                    {
+                        "basic_auth": []
+                    }
+                ],
+                "requestBody": {
+                    "required": false,
+                    "content": {
+                        "application/json": {
+                            "schema": {
+                                "type": "object",
+                                "properties": {
+                                    "template": {
+                                        "type": "string",
+                                        "default": "",
+                                        "description": "The Twig template to save (empty to reset to default)"
+                                    },
+                                    "width": {
+                                        "type": "integer",
+                                        "format": "int64",
+                                        "default": 595,
+                                        "description": "Width of preview in points (default: 595 - A4 width)"
+                                    },
+                                    "height": {
+                                        "type": "integer",
+                                        "format": "int64",
+                                        "default": 50,
+                                        "description": "Height of preview in points (default: 50)"
+                                    }
+                                }
+                            }
+                        }
+                    }
+                },
+                "parameters": [
+                    {
+                        "name": "apiVersion",
+                        "in": "path",
+                        "required": true,
+                        "schema": {
+                            "type": "string",
+                            "enum": [
+                                "v1"
+                            ],
+                            "default": "v1"
+                        }
+                    },
+                    {
+                        "name": "OCS-APIRequest",
+                        "in": "header",
+                        "description": "Required to be true for the API request to pass",
+                        "required": true,
+                        "schema": {
+                            "type": "boolean",
+                            "default": true
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "content": {
+                            "application/pdf": {
+                                "schema": {
+                                    "type": "string",
+                                    "format": "binary"
+                                }
+                            }
+                        }
+                    },
+                    "400": {
+                        "description": "Bad request",
+                        "content": {
+                            "application/json": {
+                                "schema": {
+                                    "type": "object",
+                                    "required": [
+                                        "ocs"
+                                    ],
+                                    "properties": {
+                                        "ocs": {
+                                            "type": "object",
+                                            "required": [
+                                                "meta",
+                                                "data"
+                                            ],
+                                            "properties": {
+                                                "meta": {
+                                                    "$ref": "#/components/schemas/OCSMeta"
+                                                },
+                                                "data": {
+                                                    "$ref": "#/components/schemas/ErrorResponse"
+                                                }
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        },
+        "/ocs/v2.php/apps/libresign/api/{apiVersion}/admin/signing-mode/config": {
+            "post": {
+                "operationId": "admin-set-signing-mode-config",
+                "summary": "Set signing mode configuration",
+                "description": "Configure whether document signing should be synchronous or asynchronous\nThis endpoint requires admin access",
+                "tags": [
+                    "admin"
+                ],
+                "security": [
+                    {
+                        "bearer_auth": []
+                    },
+                    {
+                        "basic_auth": []
+                    }
+                ],
+                "requestBody": {
+                    "required": true,
+                    "content": {
+                        "application/json": {
+                            "schema": {
+                                "type": "object",
+                                "required": [
+                                    "mode"
+                                ],
+                                "properties": {
+                                    "mode": {
+                                        "type": "string",
+                                        "description": "Signing mode: \"sync\" or \"async\""
+                                    },
+                                    "workerType": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "description": "Worker type when async: \"local\" or \"external\" (optional)"
+                                    }
+                                }
+                            }
+                        }
+                    }
+                },
+                "parameters": [
+                    {
+                        "name": "apiVersion",
+                        "in": "path",
+                        "required": true,
+                        "schema": {
+                            "type": "string",
+                            "enum": [
+                                "v1"
+                            ],
+                            "default": "v1"
+                        }
+                    },
+                    {
+                        "name": "OCS-APIRequest",
+                        "in": "header",
+                        "description": "Required to be true for the API request to pass",
+                        "required": true,
+                        "schema": {
+                            "type": "boolean",
+                            "default": true
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "Settings saved",
+                        "content": {
+                            "application/json": {
+                                "schema": {
+                                    "type": "object",
+                                    "required": [
+                                        "ocs"
+                                    ],
+                                    "properties": {
+                                        "ocs": {
+                                            "type": "object",
+                                            "required": [
+                                                "meta",
+                                                "data"
+                                            ],
+                                            "properties": {
+                                                "meta": {
+                                                    "$ref": "#/components/schemas/OCSMeta"
+                                                },
+                                                "data": {
+                                                    "$ref": "#/components/schemas/MessageResponse"
+                                                }
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    },
+                    "400": {
+                        "description": "Invalid parameters",
+                        "content": {
+                            "application/json": {
+                                "schema": {
+                                    "type": "object",
+                                    "required": [
+                                        "ocs"
+                                    ],
+                                    "properties": {
+                                        "ocs": {
+                                            "type": "object",
+                                            "required": [
+                                                "meta",
+                                                "data"
+                                            ],
+                                            "properties": {
+                                                "meta": {
+                                                    "$ref": "#/components/schemas/OCSMeta"
+                                                },
+                                                "data": {
+                                                    "$ref": "#/components/schemas/ErrorResponse"
+                                                }
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    },
+                    "500": {
+                        "description": "Internal server error",
+                        "content": {
+                            "application/json": {
+                                "schema": {
+                                    "type": "object",
+                                    "required": [
+                                        "ocs"
+                                    ],
+                                    "properties": {
+                                        "ocs": {
+                                            "type": "object",
+                                            "required": [
+                                                "meta",
+                                                "data"
+                                            ],
+                                            "properties": {
+                                                "meta": {
+                                                    "$ref": "#/components/schemas/OCSMeta"
+                                                },
+                                                "data": {
+                                                    "$ref": "#/components/schemas/ErrorResponse"
+                                                }
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        },
+        "/ocs/v2.php/apps/libresign/api/{apiVersion}/admin/docmdp/config": {
+            "post": {
+                "operationId": "admin-set-doc-mdp-config",
+                "summary": "Configure DocMDP signature restrictions",
+                "description": "This endpoint requires admin access",
+                "tags": [
+                    "admin"
+                ],
+                "security": [
+                    {
+                        "bearer_auth": []
+                    },
+                    {
+                        "basic_auth": []
+                    }
+                ],
+                "requestBody": {
+                    "required": true,
+                    "content": {
+                        "application/json": {
+                            "schema": {
+                                "type": "object",
+                                "required": [
+                                    "enabled"
+                                ],
+                                "properties": {
+                                    "enabled": {
+                                        "type": "boolean",
+                                        "description": "Whether to enable DocMDP restrictions"
+                                    },
+                                    "defaultLevel": {
+                                        "type": "integer",
+                                        "format": "int64",
+                                        "default": 2,
+                                        "description": "DocMDP level: 1 (no changes), 2 (fill forms), 3 (add annotations)"
+                                    }
+                                }
+                            }
+                        }
+                    }
+                },
+                "parameters": [
+                    {
+                        "name": "apiVersion",
+                        "in": "path",
+                        "required": true,
+                        "schema": {
+                            "type": "string",
+                            "enum": [
+                                "v1"
+                            ],
+                            "default": "v1"
+                        }
+                    },
+                    {
+                        "name": "OCS-APIRequest",
+                        "in": "header",
+                        "description": "Required to be true for the API request to pass",
+                        "required": true,
+                        "schema": {
+                            "type": "boolean",
+                            "default": true
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "Configuration saved successfully",
+                        "content": {
+                            "application/json": {
+                                "schema": {
+                                    "type": "object",
+                                    "required": [
+                                        "ocs"
+                                    ],
+                                    "properties": {
+                                        "ocs": {
+                                            "type": "object",
+                                            "required": [
+                                                "meta",
+                                                "data"
+                                            ],
+                                            "properties": {
+                                                "meta": {
+                                                    "$ref": "#/components/schemas/OCSMeta"
+                                                },
+                                                "data": {
+                                                    "$ref": "#/components/schemas/MessageResponse"
+                                                }
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    },
+                    "400": {
+                        "description": "Invalid DocMDP level provided",
+                        "content": {
+                            "application/json": {
+                                "schema": {
+                                    "type": "object",
+                                    "required": [
+                                        "ocs"
+                                    ],
+                                    "properties": {
+                                        "ocs": {
+                                            "type": "object",
+                                            "required": [
+                                                "meta",
+                                                "data"
+                                            ],
+                                            "properties": {
+                                                "meta": {
+                                                    "$ref": "#/components/schemas/OCSMeta"
+                                                },
+                                                "data": {
+                                                    "$ref": "#/components/schemas/ErrorResponse"
+                                                }
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    },
+                    "500": {
+                        "description": "Internal server error",
+                        "content": {
+                            "application/json": {
+                                "schema": {
+                                    "type": "object",
+                                    "required": [
+                                        "ocs"
+                                    ],
+                                    "properties": {
+                                        "ocs": {
+                                            "type": "object",
+                                            "required": [
+                                                "meta",
+                                                "data"
+                                            ],
+                                            "properties": {
+                                                "meta": {
+                                                    "$ref": "#/components/schemas/OCSMeta"
+                                                },
+                                                "data": {
+                                                    "$ref": "#/components/schemas/ErrorResponse"
+                                                }
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        },
+        "/ocs/v2.php/apps/libresign/api/{apiVersion}/admin/active-signings": {
+            "get": {
+                "operationId": "admin-get-active-signings",
+                "summary": "Get list of files currently being signed (status = SIGNING_IN_PROGRESS)",
+                "description": "This endpoint requires admin access",
+                "tags": [
+                    "admin"
+                ],
+                "security": [
+                    {
+                        "bearer_auth": []
+                    },
+                    {
+                        "basic_auth": []
+                    }
+                ],
+                "parameters": [
+                    {
+                        "name": "apiVersion",
+                        "in": "path",
+                        "required": true,
+                        "schema": {
+                            "type": "string",
+                            "enum": [
+                                "v1"
+                            ],
+                            "default": "v1"
+                        }
+                    },
+                    {
+                        "name": "OCS-APIRequest",
+                        "in": "header",
+                        "description": "Required to be true for the API request to pass",
+                        "required": true,
+                        "schema": {
+                            "type": "boolean",
+                            "default": true
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "List of active signings",
+                        "content": {
+                            "application/json": {
+                                "schema": {
+                                    "type": "object",
+                                    "required": [
+                                        "ocs"
+                                    ],
+                                    "properties": {
+                                        "ocs": {
+                                            "type": "object",
+                                            "required": [
+                                                "meta",
+                                                "data"
+                                            ],
+                                            "properties": {
+                                                "meta": {
+                                                    "$ref": "#/components/schemas/OCSMeta"
+                                                },
+                                                "data": {
+                                                    "$ref": "#/components/schemas/ActiveSigningsResponse"
+                                                }
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    },
+                    "500": {
+                        "description": "",
+                        "content": {
+                            "application/json": {
+                                "schema": {
+                                    "type": "object",
+                                    "required": [
+                                        "ocs"
+                                    ],
+                                    "properties": {
+                                        "ocs": {
+                                            "type": "object",
+                                            "required": [
+                                                "meta",
+                                                "data"
+                                            ],
+                                            "properties": {
+                                                "meta": {
+                                                    "$ref": "#/components/schemas/OCSMeta"
+                                                },
+                                                "data": {
+                                                    "$ref": "#/components/schemas/ErrorResponse"
+                                                }
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        },
+        "/ocs/v2.php/apps/libresign/api/{apiVersion}/crl/list": {
+            "get": {
+                "operationId": "crl_api-list",
+                "summary": "List CRL entries with pagination and filters",
+                "description": "This endpoint requires admin access",
+                "tags": [
+                    "crl_api"
+                ],
+                "security": [
+                    {
+                        "bearer_auth": []
+                    },
+                    {
+                        "basic_auth": []
+                    }
+                ],
+                "parameters": [
+                    {
+                        "name": "apiVersion",
+                        "in": "path",
+                        "required": true,
+                        "schema": {
+                            "type": "string",
+                            "enum": [
+                                "v1"
+                            ],
+                            "default": "v1"
+                        }
+                    },
+                    {
+                        "name": "page",
+                        "in": "query",
+                        "description": "Page number (1-based)",
+                        "schema": {
+                            "type": "integer",
+                            "format": "int64",
+                            "nullable": true
+                        }
+                    },
+                    {
+                        "name": "length",
+                        "in": "query",
+                        "description": "Number of items per page",
+                        "schema": {
+                            "type": "integer",
+                            "format": "int64",
+                            "nullable": true
+                        }
+                    },
+                    {
+                        "name": "status",
+                        "in": "query",
+                        "description": "Filter by status (issued, revoked, expired)",
+                        "schema": {
+                            "type": "string",
+                            "nullable": true
+                        }
+                    },
+                    {
+                        "name": "engine",
+                        "in": "query",
+                        "description": "Filter by engine type",
+                        "schema": {
+                            "type": "string",
+                            "nullable": true
+                        }
+                    },
+                    {
+                        "name": "instanceId",
+                        "in": "query",
+                        "description": "Filter by instance ID",
+                        "schema": {
+                            "type": "string",
+                            "nullable": true
+                        }
+                    },
+                    {
+                        "name": "generation",
+                        "in": "query",
+                        "description": "Filter by generation",
+                        "schema": {
+                            "type": "integer",
+                            "format": "int64",
+                            "nullable": true
+                        }
+                    },
+                    {
+                        "name": "owner",
+                        "in": "query",
+                        "description": "Filter by owner",
+                        "schema": {
+                            "type": "string",
+                            "nullable": true
+                        }
+                    },
+                    {
+                        "name": "serialNumber",
+                        "in": "query",
+                        "description": "Filter by serial number (partial match)",
+                        "schema": {
+                            "type": "string",
+                            "nullable": true
+                        }
+                    },
+                    {
+                        "name": "revokedBy",
+                        "in": "query",
+                        "description": "Filter by who revoked the certificate",
+                        "schema": {
+                            "type": "string",
+                            "nullable": true
+                        }
+                    },
                     {
-                        "name": "apiVersion",
-                        "in": "path",
-                        "required": true,
+                        "name": "sortBy",
+                        "in": "query",
+                        "description": "Sort field (e.g., 'revoked_at', 'issued_at', 'serial_number')",
                         "schema": {
                             "type": "string",
-                            "enum": [
-                                "v1"
-                            ],
-                            "default": "v1"
+                            "nullable": true
+                        }
+                    },
+                    {
+                        "name": "sortOrder",
+                        "in": "query",
+                        "description": "Sort order (ASC or DESC)",
+                        "schema": {
+                            "type": "string",
+                            "nullable": true
                         }
                     },
                     {
@@ -12468,67 +14035,7 @@
                 ],
                 "responses": {
                     "200": {
-                        "description": "Settings saved",
-                        "content": {
-                            "application/json": {
-                                "schema": {
-                                    "type": "object",
-                                    "required": [
-                                        "ocs"
-                                    ],
-                                    "properties": {
-                                        "ocs": {
-                                            "type": "object",
-                                            "required": [
-                                                "meta",
-                                                "data"
-                                            ],
-                                            "properties": {
-                                                "meta": {
-                                                    "$ref": "#/components/schemas/OCSMeta"
-                                                },
-                                                "data": {
-                                                    "$ref": "#/components/schemas/MessageResponse"
-                                                }
-                                            }
-                                        }
-                                    }
-                                }
-                            }
-                        }
-                    },
-                    "400": {
-                        "description": "Invalid parameters",
-                        "content": {
-                            "application/json": {
-                                "schema": {
-                                    "type": "object",
-                                    "required": [
-                                        "ocs"
-                                    ],
-                                    "properties": {
-                                        "ocs": {
-                                            "type": "object",
-                                            "required": [
-                                                "meta",
-                                                "data"
-                                            ],
-                                            "properties": {
-                                                "meta": {
-                                                    "$ref": "#/components/schemas/OCSMeta"
-                                                },
-                                                "data": {
-                                                    "$ref": "#/components/schemas/ErrorResponse"
-                                                }
-                                            }
-                                        }
-                                    }
-                                }
-                            }
-                        }
-                    },
-                    "500": {
-                        "description": "Internal server error",
+                        "description": "CRL entries retrieved successfully",
                         "content": {
                             "application/json": {
                                 "schema": {
@@ -12548,7 +14055,7 @@
                                                     "$ref": "#/components/schemas/OCSMeta"
                                                 },
                                                 "data": {
-                                                    "$ref": "#/components/schemas/ErrorResponse"
+                                                    "$ref": "#/components/schemas/CrlListResponse"
                                                 }
                                             }
                                         }
@@ -12560,13 +14067,13 @@
                 }
             }
         },
-        "/ocs/v2.php/apps/libresign/api/{apiVersion}/admin/signature-flow/config": {
+        "/ocs/v2.php/apps/libresign/api/{apiVersion}/crl/revoke": {
             "post": {
-                "operationId": "admin-set-signature-flow-config",
-                "summary": "Set signature flow configuration",
+                "operationId": "crl_api-revoke",
+                "summary": "Revoke a certificate by serial number",
                 "description": "This endpoint requires admin access",
                 "tags": [
-                    "admin"
+                    "crl_api"
                 ],
                 "security": [
                     {
@@ -12583,17 +14090,23 @@
                             "schema": {
                                 "type": "object",
                                 "required": [
-                                    "enabled"
+                                    "serialNumber"
                                 ],
                                 "properties": {
-                                    "enabled": {
-                                        "type": "boolean",
-                                        "description": "Whether to force a signature flow for all documents"
+                                    "serialNumber": {
+                                        "type": "string",
+                                        "description": "Certificate serial number to revoke"
                                     },
-                                    "mode": {
+                                    "reasonCode": {
+                                        "type": "integer",
+                                        "format": "int64",
+                                        "nullable": true,
+                                        "description": "Revocation reason code (0-10, see RFC 5280)"
+                                    },
+                                    "reasonText": {
                                         "type": "string",
                                         "nullable": true,
-                                        "description": "Signature flow mode: 'parallel' or 'ordered_numeric' (only used when enabled is true)"
+                                        "description": "Optional text describing the reason"
                                     }
                                 }
                             }
@@ -12626,7 +14139,7 @@
                 ],
                 "responses": {
                     "200": {
-                        "description": "Configuration saved successfully",
+                        "description": "Certificate revoked successfully",
                         "content": {
                             "application/json": {
                                 "schema": {
@@ -12646,7 +14159,7 @@
                                                     "$ref": "#/components/schemas/OCSMeta"
                                                 },
                                                 "data": {
-                                                    "$ref": "#/components/schemas/MessageResponse"
+                                                    "$ref": "#/components/schemas/CrlRevokeResponse"
                                                 }
                                             }
                                         }
@@ -12656,7 +14169,7 @@
                         }
                     },
                     "400": {
-                        "description": "Invalid signature flow mode provided",
+                        "description": "Invalid parameters",
                         "content": {
                             "application/json": {
                                 "schema": {
@@ -12676,7 +14189,7 @@
                                                     "$ref": "#/components/schemas/OCSMeta"
                                                 },
                                                 "data": {
-                                                    "$ref": "#/components/schemas/ErrorResponse"
+                                                    "$ref": "#/components/schemas/CrlRevokeResponse"
                                                 }
                                             }
                                         }
@@ -12685,8 +14198,8 @@
                             }
                         }
                     },
-                    "500": {
-                        "description": "Internal server error",
+                    "404": {
+                        "description": "Certificate not found",
                         "content": {
                             "application/json": {
                                 "schema": {
@@ -12706,7 +14219,7 @@
                                                     "$ref": "#/components/schemas/OCSMeta"
                                                 },
                                                 "data": {
-                                                    "$ref": "#/components/schemas/ErrorResponse"
+                                                    "$ref": "#/components/schemas/CrlRevokeResponse"
                                                 }
                                             }
                                         }
@@ -12718,13 +14231,13 @@
                 }
             }
         },
-        "/ocs/v2.php/apps/libresign/api/{apiVersion}/admin/docmdp/config": {
-            "post": {
-                "operationId": "admin-set-doc-mdp-config",
-                "summary": "Configure DocMDP signature restrictions",
+        "/ocs/v2.php/apps/libresign/api/{apiVersion}/policies/system/{policyKey}": {
+            "get": {
+                "operationId": "policy-get-system",
+                "summary": "Read explicit system policy configuration",
                 "description": "This endpoint requires admin access",
                 "tags": [
-                    "admin"
+                    "policy"
                 ],
                 "security": [
                     {
@@ -12734,31 +14247,6 @@
                         "basic_auth": []
                     }
                 ],
-                "requestBody": {
-                    "required": true,
-                    "content": {
-                        "application/json": {
-                            "schema": {
-                                "type": "object",
-                                "required": [
-                                    "enabled"
-                                ],
-                                "properties": {
-                                    "enabled": {
-                                        "type": "boolean",
-                                        "description": "Whether to enable DocMDP restrictions"
-                                    },
-                                    "defaultLevel": {
-                                        "type": "integer",
-                                        "format": "int64",
-                                        "default": 2,
-                                        "description": "DocMDP level: 1 (no changes), 2 (fill forms), 3 (add annotations)"
-                                    }
-                                }
-                            }
-                        }
-                    }
-                },
                 "parameters": [
                     {
                         "name": "apiVersion",
@@ -12772,6 +14260,16 @@
                             "default": "v1"
                         }
                     },
+                    {
+                        "name": "policyKey",
+                        "in": "path",
+                        "description": "Policy identifier to read from the system layer.",
+                        "required": true,
+                        "schema": {
+                            "type": "string",
+                            "pattern": "^[a-z0-9_]+$"
+                        }
+                    },
                     {
                         "name": "OCS-APIRequest",
                         "in": "header",
@@ -12785,37 +14283,7 @@
                 ],
                 "responses": {
                     "200": {
-                        "description": "Configuration saved successfully",
-                        "content": {
-                            "application/json": {
-                                "schema": {
-                                    "type": "object",
-                                    "required": [
-                                        "ocs"
-                                    ],
-                                    "properties": {
-                                        "ocs": {
-                                            "type": "object",
-                                            "required": [
-                                                "meta",
-                                                "data"
-                                            ],
-                                            "properties": {
-                                                "meta": {
-                                                    "$ref": "#/components/schemas/OCSMeta"
-                                                },
-                                                "data": {
-                                                    "$ref": "#/components/schemas/MessageResponse"
-                                                }
-                                            }
-                                        }
-                                    }
-                                }
-                            }
-                        }
-                    },
-                    "400": {
-                        "description": "Invalid DocMDP level provided",
+                        "description": "OK",
                         "content": {
                             "application/json": {
                                 "schema": {
@@ -12835,7 +14303,7 @@
                                                     "$ref": "#/components/schemas/OCSMeta"
                                                 },
                                                 "data": {
-                                                    "$ref": "#/components/schemas/ErrorResponse"
+                                                    "$ref": "#/components/schemas/SystemPolicyResponse"
                                                 }
                                             }
                                         }
@@ -12843,56 +14311,61 @@
                                 }
                             }
                         }
+                    }
+                }
+            },
+            "post": {
+                "operationId": "policy-set-system",
+                "summary": "Save a system-level policy value",
+                "description": "This endpoint requires admin access",
+                "tags": [
+                    "policy"
+                ],
+                "security": [
+                    {
+                        "bearer_auth": []
                     },
-                    "500": {
-                        "description": "Internal server error",
-                        "content": {
-                            "application/json": {
-                                "schema": {
-                                    "type": "object",
-                                    "required": [
-                                        "ocs"
-                                    ],
-                                    "properties": {
-                                        "ocs": {
-                                            "type": "object",
-                                            "required": [
-                                                "meta",
-                                                "data"
-                                            ],
-                                            "properties": {
-                                                "meta": {
-                                                    "$ref": "#/components/schemas/OCSMeta"
-                                                },
-                                                "data": {
-                                                    "$ref": "#/components/schemas/ErrorResponse"
-                                                }
+                    {
+                        "basic_auth": []
+                    }
+                ],
+                "requestBody": {
+                    "required": false,
+                    "content": {
+                        "application/json": {
+                            "schema": {
+                                "type": "object",
+                                "properties": {
+                                    "value": {
+                                        "nullable": true,
+                                        "description": "Policy value to persist. Null resets the policy to its default system value.",
+                                        "anyOf": [
+                                            {
+                                                "type": "boolean"
+                                            },
+                                            {
+                                                "type": "integer",
+                                                "format": "int64"
+                                            },
+                                            {
+                                                "type": "number",
+                                                "format": "double"
+                                            },
+                                            {
+                                                "type": "string"
                                             }
-                                        }
+                                        ]
+                                    },
+                                    "allowChildOverride": {
+                                        "type": "boolean",
+                                        "default": false,
+                                        "description": "Whether lower layers may override this system default."
                                     }
                                 }
                             }
                         }
                     }
-                }
-            }
-        },
-        "/ocs/v2.php/apps/libresign/api/{apiVersion}/admin/active-signings": {
-            "get": {
-                "operationId": "admin-get-active-signings",
-                "summary": "Get list of files currently being signed (status = SIGNING_IN_PROGRESS)",
-                "description": "This endpoint requires admin access",
-                "tags": [
-                    "admin"
-                ],
-                "security": [
-                    {
-                        "bearer_auth": []
-                    },
-                    {
-                        "basic_auth": []
-                    }
-                ],
+                },
                 "parameters": [
                     {
                         "name": "apiVersion",
@@ -12906,6 +14379,16 @@
                             "default": "v1"
                         }
                     },
+                    {
+                        "name": "policyKey",
+                        "in": "path",
+                        "description": "Policy identifier to persist at the system layer.",
+                        "required": true,
+                        "schema": {
+                            "type": "string",
+                            "pattern": "^[a-z0-9_]+$"
+                        }
+                    },
                     {
                         "name": "OCS-APIRequest",
                         "in": "header",
@@ -12919,7 +14402,7 @@
                 ],
                 "responses": {
                     "200": {
-                        "description": "List of active signings",
+                        "description": "OK",
                         "content": {
                             "application/json": {
                                 "schema": {
@@ -12939,7 +14422,7 @@
                                                     "$ref": "#/components/schemas/OCSMeta"
                                                 },
                                                 "data": {
-                                                    "$ref": "#/components/schemas/ActiveSigningsResponse"
+                                                    "$ref": "#/components/schemas/SystemPolicyWriteResponse"
                                                 }
                                             }
                                         }
@@ -12948,8 +14431,8 @@
                             }
                         }
                     },
-                    "500": {
-                        "description": "",
+                    "400": {
+                        "description": "Invalid policy value",
                         "content": {
                             "application/json": {
                                 "schema": {
@@ -12981,13 +14464,13 @@
                 }
             }
         },
-        "/ocs/v2.php/apps/libresign/api/{apiVersion}/crl/list": {
+        "/ocs/v2.php/apps/libresign/api/{apiVersion}/policies/user/{userId}/{policyKey}": {
             "get": {
-                "operationId": "crl_api-list",
-                "summary": "List CRL entries with pagination and filters",
+                "operationId": "policy-get-user-policy-for-user",
+                "summary": "Read a user-level policy preference for a target user (admin scope)",
                 "description": "This endpoint requires admin access",
                 "tags": [
-                    "crl_api"
+                    "policy"
                 ],
                 "security": [
                     {
@@ -13011,105 +14494,23 @@
                         }
                     },
                     {
-                        "name": "page",
-                        "in": "query",
-                        "description": "Page number (1-based)",
-                        "schema": {
-                            "type": "integer",
-                            "format": "int64",
-                            "nullable": true
-                        }
-                    },
-                    {
-                        "name": "length",
-                        "in": "query",
-                        "description": "Number of items per page",
-                        "schema": {
-                            "type": "integer",
-                            "format": "int64",
-                            "nullable": true
-                        }
-                    },
-                    {
-                        "name": "status",
-                        "in": "query",
-                        "description": "Filter by status (issued, revoked, expired)",
-                        "schema": {
-                            "type": "string",
-                            "nullable": true
-                        }
-                    },
-                    {
-                        "name": "engine",
-                        "in": "query",
-                        "description": "Filter by engine type",
-                        "schema": {
-                            "type": "string",
-                            "nullable": true
-                        }
-                    },
-                    {
-                        "name": "instanceId",
-                        "in": "query",
-                        "description": "Filter by instance ID",
-                        "schema": {
-                            "type": "string",
-                            "nullable": true
-                        }
-                    },
-                    {
-                        "name": "generation",
-                        "in": "query",
-                        "description": "Filter by generation",
-                        "schema": {
-                            "type": "integer",
-                            "format": "int64",
-                            "nullable": true
-                        }
-                    },
-                    {
-                        "name": "owner",
-                        "in": "query",
-                        "description": "Filter by owner",
-                        "schema": {
-                            "type": "string",
-                            "nullable": true
-                        }
-                    },
-                    {
-                        "name": "serialNumber",
-                        "in": "query",
-                        "description": "Filter by serial number (partial match)",
-                        "schema": {
-                            "type": "string",
-                            "nullable": true
-                        }
-                    },
-                    {
-                        "name": "revokedBy",
-                        "in": "query",
-                        "description": "Filter by who revoked the certificate",
-                        "schema": {
-                            "type": "string",
-                            "nullable": true
-                        }
-                    },
-                    {
-                        "name": "sortBy",
-                        "in": "query",
-                        "description": "Sort field (e.g., 'revoked_at', 'issued_at', 'serial_number')",
+                        "name": "userId",
+                        "in": "path",
+                        "description": "Target user identifier that receives the policy preference.",
+                        "required": true,
                         "schema": {
                             "type": "string",
-                            "nullable": true
+                            "pattern": "^[^/]+$"
                         }
                     },
                     {
-                        "name": "sortOrder",
-                        "in": "query",
-                        "description": "Sort order (ASC or DESC)",
+                        "name": "policyKey",
+                        "in": "path",
+                        "description": "Policy identifier to read for the selected user.",
+                        "required": true,
                         "schema": {
                             "type": "string",
-                            "nullable": true
+                            "pattern": "^[a-z0-9_]+$"
                         }
                     },
                     {
@@ -13125,7 +14526,7 @@
                 ],
                 "responses": {
                     "200": {
-                        "description": "CRL entries retrieved successfully",
+                        "description": "OK",
                         "content": {
                             "application/json": {
                                 "schema": {
@@ -13145,7 +14546,7 @@
                                                     "$ref": "#/components/schemas/OCSMeta"
                                                 },
                                                 "data": {
-                                                    "$ref": "#/components/schemas/CrlListResponse"
+                                                    "$ref": "#/components/schemas/UserPolicyResponse"
                                                 }
                                             }
                                         }
@@ -13155,15 +14556,13 @@
                         }
                     }
                 }
-            }
-        },
-        "/ocs/v2.php/apps/libresign/api/{apiVersion}/crl/revoke": {
-            "post": {
-                "operationId": "crl_api-revoke",
-                "summary": "Revoke a certificate by serial number",
+            },
+            "put": {
+                "operationId": "policy-set-user-policy-for-user",
+                "summary": "Save a user policy preference for a target user (admin scope)",
                 "description": "This endpoint requires admin access",
                 "tags": [
-                    "crl_api"
+                    "policy"
                 ],
                 "security": [
                     {
@@ -13174,29 +14573,31 @@
                     }
                 ],
                 "requestBody": {
-                    "required": true,
+                    "required": false,
                     "content": {
                         "application/json": {
                             "schema": {
                                 "type": "object",
-                                "required": [
-                                    "serialNumber"
-                                ],
                                 "properties": {
-                                    "serialNumber": {
-                                        "type": "string",
-                                        "description": "Certificate serial number to revoke"
-                                    },
-                                    "reasonCode": {
-                                        "type": "integer",
-                                        "format": "int64",
-                                        "nullable": true,
-                                        "description": "Revocation reason code (0-10, see RFC 5280)"
-                                    },
-                                    "reasonText": {
-                                        "type": "string",
+                                    "value": {
                                         "nullable": true,
-                                        "description": "Optional text describing the reason"
+                                        "description": "Policy value to persist as target user preference.",
+                                        "anyOf": [
+                                            {
+                                                "type": "boolean"
+                                            },
+                                            {
+                                                "type": "integer",
+                                                "format": "int64"
+                                            },
+                                            {
+                                                "type": "number",
+                                                "format": "double"
+                                            },
+                                            {
+                                                "type": "string"
+                                            }
+                                        ]
                                     }
                                 }
                             }
@@ -13216,6 +14617,26 @@
                             "default": "v1"
                         }
                     },
+                    {
+                        "name": "userId",
+                        "in": "path",
+                        "description": "Target user identifier that receives the policy preference.",
+                        "required": true,
+                        "schema": {
+                            "type": "string",
+                            "pattern": "^[^/]+$"
+                        }
+                    },
+                    {
+                        "name": "policyKey",
+                        "in": "path",
+                        "description": "Policy identifier to persist for the target user.",
+                        "required": true,
+                        "schema": {
+                            "type": "string",
+                            "pattern": "^[a-z0-9_]+$"
+                        }
+                    },
                     {
                         "name": "OCS-APIRequest",
                         "in": "header",
@@ -13229,7 +14650,7 @@
                 ],
                 "responses": {
                     "200": {
-                        "description": "Certificate revoked successfully",
+                        "description": "OK",
                         "content": {
                             "application/json": {
                                 "schema": {
@@ -13249,7 +14670,7 @@
                                                     "$ref": "#/components/schemas/OCSMeta"
                                                 },
                                                 "data": {
-                                                    "$ref": "#/components/schemas/CrlRevokeResponse"
+                                                    "$ref": "#/components/schemas/UserPolicyWriteResponse"
                                                 }
                                             }
                                         }
@@ -13259,7 +14680,7 @@
                         }
                     },
                     "400": {
-                        "description": "Invalid parameters",
+                        "description": "Invalid policy value",
                         "content": {
                             "application/json": {
                                 "schema": {
@@ -13279,7 +14700,7 @@
                                                     "$ref": "#/components/schemas/OCSMeta"
                                                 },
                                                 "data": {
-                                                    "$ref": "#/components/schemas/CrlRevokeResponse"
+                                                    "$ref": "#/components/schemas/ErrorResponse"
                                                 }
                                             }
                                         }
@@ -13287,9 +14708,71 @@
                                 }
                             }
                         }
+                    }
+                }
+            },
+            "delete": {
+                "operationId": "policy-clear-user-policy-for-user",
+                "summary": "Clear a user policy preference for a target user (admin scope)",
+                "description": "This endpoint requires admin access",
+                "tags": [
+                    "policy"
+                ],
+                "security": [
+                    {
+                        "bearer_auth": []
                     },
-                    "404": {
-                        "description": "Certificate not found",
+                    {
+                        "basic_auth": []
+                    }
+                ],
+                "parameters": [
+                    {
+                        "name": "apiVersion",
+                        "in": "path",
+                        "required": true,
+                        "schema": {
+                            "type": "string",
+                            "enum": [
+                                "v1"
+                            ],
+                            "default": "v1"
+                        }
+                    },
+                    {
+                        "name": "userId",
+                        "in": "path",
+                        "description": "Target user identifier that receives the policy preference removal.",
+                        "required": true,
+                        "schema": {
+                            "type": "string",
+                            "pattern": "^[^/]+$"
+                        }
+                    },
+                    {
+                        "name": "policyKey",
+                        "in": "path",
+                        "description": "Policy identifier to clear for the target user.",
+                        "required": true,
+                        "schema": {
+                            "type": "string",
+                            "pattern": "^[a-z0-9_]+$"
+                        }
+                    },
+                    {
+                        "name": "OCS-APIRequest",
+                        "in": "header",
+                        "description": "Required to be true for the API request to pass",
+                        "required": true,
+                        "schema": {
+                            "type": "boolean",
+                            "default": true
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
                         "content": {
                             "application/json": {
                                 "schema": {
@@ -13309,7 +14792,7 @@
                                                     "$ref": "#/components/schemas/OCSMeta"
                                                 },
                                                 "data": {
-                                                    "$ref": "#/components/schemas/CrlRevokeResponse"
+                                                    "$ref": "#/components/schemas/UserPolicyWriteResponse"
                                                 }
                                             }
                                         }
diff --git a/openapi.json b/openapi.json
index e3fac16bee..c61a39b860 100644
--- a/openapi.json
+++ b/openapi.json
@@ -620,6 +620,101 @@
                     }
                 ]
             },
+            "EffectivePoliciesResponse": {
+                "type": "object",
+                "required": [
+                    "policies"
+                ],
+                "properties": {
+                    "policies": {
+                        "type": "object",
+                        "additionalProperties": {
+                            "$ref": "#/components/schemas/EffectivePolicyState"
+                        }
+                    }
+                }
+            },
+            "EffectivePolicyResponse": {
+                "type": "object",
+                "required": [
+                    "policy"
+                ],
+                "properties": {
+                    "policy": {
+                        "$ref": "#/components/schemas/EffectivePolicyState"
+                    }
+                }
+            },
+            "EffectivePolicyState": {
+                "type": "object",
+                "required": [
+                    "policyKey",
+                    "effectiveValue",
+                    "sourceScope",
+                    "visible",
+                    "editableByCurrentActor",
+                    "allowedValues",
+                    "canSaveAsUserDefault",
+                    "canUseAsRequestOverride",
+                    "preferenceWasCleared",
+                    "blockedBy"
+                ],
+                "properties": {
+                    "policyKey": {
+                        "type": "string"
+                    },
+                    "effectiveValue": {
+                        "$ref": "#/components/schemas/EffectivePolicyValue"
+                    },
+                    "sourceScope": {
+                        "type": "string"
+                    },
+                    "visible": {
+                        "type": "boolean"
+                    },
+                    "editableByCurrentActor": {
+                        "type": "boolean"
+                    },
+                    "allowedValues": {
+                        "type": "array",
+                        "items": {
+                            "$ref": "#/components/schemas/EffectivePolicyValue"
+                        }
+                    },
+                    "canSaveAsUserDefault": {
+                        "type": "boolean"
+                    },
+                    "canUseAsRequestOverride": {
+                        "type": "boolean"
+                    },
+                    "preferenceWasCleared": {
+                        "type": "boolean"
+                    },
+                    "blockedBy": {
+                        "type": "string",
+                        "nullable": true
+                    }
+                }
+            },
+            "EffectivePolicyValue": {
+                "nullable": true,
+                "anyOf": [
+                    {
+                        "type": "boolean"
+                    },
+                    {
+                        "type": "integer",
+                        "format": "int64"
+                    },
+                    {
+                        "type": "number",
+                        "format": "double"
+                    },
+                    {
+                        "type": "string"
+                    }
+                ]
+            },
             "ErrorItem": {
                 "type": "object",
                 "required": [
@@ -1023,6 +1118,69 @@
                     }
                 }
             },
+            "GroupPolicyResponse": {
+                "type": "object",
+                "required": [
+                    "policy"
+                ],
+                "properties": {
+                    "policy": {
+                        "$ref": "#/components/schemas/GroupPolicyState"
+                    }
+                }
+            },
+            "GroupPolicyState": {
+                "type": "object",
+                "required": [
+                    "policyKey",
+                    "scope",
+                    "targetId",
+                    "value",
+                    "allowChildOverride",
+                    "visibleToChild",
+                    "allowedValues"
+                ],
+                "properties": {
+                    "policyKey": {
+                        "type": "string"
+                    },
+                    "scope": {
+                        "type": "string",
+                        "enum": [
+                            "group"
+                        ]
+                    },
+                    "targetId": {
+                        "type": "string"
+                    },
+                    "value": {
+                        "$ref": "#/components/schemas/EffectivePolicyValue",
+                        "nullable": true
+                    },
+                    "allowChildOverride": {
+                        "type": "boolean"
+                    },
+                    "visibleToChild": {
+                        "type": "boolean"
+                    },
+                    "allowedValues": {
+                        "type": "array",
+                        "items": {
+                            "$ref": "#/components/schemas/EffectivePolicyValue"
+                        }
+                    }
+                }
+            },
+            "GroupPolicyWriteResponse": {
+                "allOf": [
+                    {
+                        "$ref": "#/components/schemas/MessageResponse"
+                    },
+                    {
+                        "$ref": "#/components/schemas/GroupPolicyResponse"
+                    }
+                ]
+            },
             "IdDocs": {
                 "type": "object",
                 "required": [
@@ -1386,6 +1544,37 @@
                     }
                 }
             },
+            "PolicySnapshotEntry": {
+                "type": "object",
+                "required": [
+                    "effectiveValue",
+                    "sourceScope"
+                ],
+                "properties": {
+                    "effectiveValue": {
+                        "type": "string"
+                    },
+                    "sourceScope": {
+                        "type": "string"
+                    }
+                }
+            },
+            "PolicySnapshotNumericEntry": {
+                "type": "object",
+                "required": [
+                    "effectiveValue",
+                    "sourceScope"
+                ],
+                "properties": {
+                    "effectiveValue": {
+                        "type": "integer",
+                        "format": "int64"
+                    },
+                    "sourceScope": {
+                        "type": "string"
+                    }
+                }
+            },
             "ProgressError": {
                 "type": "object",
                 "required": [
@@ -1904,6 +2093,16 @@
                     }
                 }
             },
+            "SystemPolicyWriteResponse": {
+                "allOf": [
+                    {
+                        "$ref": "#/components/schemas/MessageResponse"
+                    },
+                    {
+                        "$ref": "#/components/schemas/EffectivePolicyResponse"
+                    }
+                ]
+            },
             "UserElement": {
                 "type": "object",
                 "required": [
@@ -2023,6 +2222,9 @@
                     "original_file_deleted": {
                         "type": "boolean"
                     },
+                    "policy_snapshot": {
+                        "$ref": "#/components/schemas/ValidatePolicySnapshot"
+                    },
                     "pdfVersion": {
                         "type": "string"
                     },
@@ -2031,6 +2233,17 @@
                     }
                 }
             },
+            "ValidatePolicySnapshot": {
+                "type": "object",
+                "properties": {
+                    "docmdp": {
+                        "$ref": "#/components/schemas/PolicySnapshotNumericEntry"
+                    },
+                    "signature_flow": {
+                        "$ref": "#/components/schemas/PolicySnapshotEntry"
+                    }
+                }
+            },
             "ValidatedChildFile": {
                 "type": "object",
                 "required": [
@@ -7407,6 +7620,737 @@
                 }
             }
         },
+        "/ocs/v2.php/apps/libresign/api/{apiVersion}/policies/effective": {
+            "get": {
+                "operationId": "policy-effective",
+                "summary": "Effective policies bootstrap",
+                "tags": [
+                    "policy"
+                ],
+                "security": [
+                    {
+                        "bearer_auth": []
+                    },
+                    {
+                        "basic_auth": []
+                    }
+                ],
+                "parameters": [
+                    {
+                        "name": "apiVersion",
+                        "in": "path",
+                        "required": true,
+                        "schema": {
+                            "type": "string",
+                            "enum": [
+                                "v1"
+                            ],
+                            "default": "v1"
+                        }
+                    },
+                    {
+                        "name": "OCS-APIRequest",
+                        "in": "header",
+                        "description": "Required to be true for the API request to pass",
+                        "required": true,
+                        "schema": {
+                            "type": "boolean",
+                            "default": true
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "content": {
+                            "application/json": {
+                                "schema": {
+                                    "type": "object",
+                                    "required": [
+                                        "ocs"
+                                    ],
+                                    "properties": {
+                                        "ocs": {
+                                            "type": "object",
+                                            "required": [
+                                                "meta",
+                                                "data"
+                                            ],
+                                            "properties": {
+                                                "meta": {
+                                                    "$ref": "#/components/schemas/OCSMeta"
+                                                },
+                                                "data": {
+                                                    "$ref": "#/components/schemas/EffectivePoliciesResponse"
+                                                }
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        },
+        "/ocs/v2.php/apps/libresign/api/{apiVersion}/policies/group/{groupId}/{policyKey}": {
+            "get": {
+                "operationId": "policy-get-group",
+                "summary": "Read a group-level policy value",
+                "tags": [
+                    "policy"
+                ],
+                "security": [
+                    {
+                        "bearer_auth": []
+                    },
+                    {
+                        "basic_auth": []
+                    }
+                ],
+                "parameters": [
+                    {
+                        "name": "apiVersion",
+                        "in": "path",
+                        "required": true,
+                        "schema": {
+                            "type": "string",
+                            "enum": [
+                                "v1"
+                            ],
+                            "default": "v1"
+                        }
+                    },
+                    {
+                        "name": "groupId",
+                        "in": "path",
+                        "description": "Group identifier that receives the policy binding.",
+                        "required": true,
+                        "schema": {
+                            "type": "string",
+                            "pattern": "^[^/]+$"
+                        }
+                    },
+                    {
+                        "name": "policyKey",
+                        "in": "path",
+                        "description": "Policy identifier to read for the selected group.",
+                        "required": true,
+                        "schema": {
+                            "type": "string",
+                            "pattern": "^[a-z0-9_]+$"
+                        }
+                    },
+                    {
+                        "name": "OCS-APIRequest",
+                        "in": "header",
+                        "description": "Required to be true for the API request to pass",
+                        "required": true,
+                        "schema": {
+                            "type": "boolean",
+                            "default": true
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "content": {
+                            "application/json": {
+                                "schema": {
+                                    "type": "object",
+                                    "required": [
+                                        "ocs"
+                                    ],
+                                    "properties": {
+                                        "ocs": {
+                                            "type": "object",
+                                            "required": [
+                                                "meta",
+                                                "data"
+                                            ],
+                                            "properties": {
+                                                "meta": {
+                                                    "$ref": "#/components/schemas/OCSMeta"
+                                                },
+                                                "data": {
+                                                    "$ref": "#/components/schemas/GroupPolicyResponse"
+                                                }
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    },
+                    "403": {
+                        "description": "Forbidden",
+                        "content": {
+                            "application/json": {
+                                "schema": {
+                                    "type": "object",
+                                    "required": [
+                                        "ocs"
+                                    ],
+                                    "properties": {
+                                        "ocs": {
+                                            "type": "object",
+                                            "required": [
+                                                "meta",
+                                                "data"
+                                            ],
+                                            "properties": {
+                                                "meta": {
+                                                    "$ref": "#/components/schemas/OCSMeta"
+                                                },
+                                                "data": {
+                                                    "$ref": "#/components/schemas/ErrorResponse"
+                                                }
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            },
+            "put": {
+                "operationId": "policy-set-group",
+                "summary": "Save a group-level policy value",
+                "tags": [
+                    "policy"
+                ],
+                "security": [
+                    {
+                        "bearer_auth": []
+                    },
+                    {
+                        "basic_auth": []
+                    }
+                ],
+                "requestBody": {
+                    "required": false,
+                    "content": {
+                        "application/json": {
+                            "schema": {
+                                "type": "object",
+                                "properties": {
+                                    "value": {
+                                        "nullable": true,
+                                        "description": "Policy value to persist for the group.",
+                                        "anyOf": [
+                                            {
+                                                "type": "boolean"
+                                            },
+                                            {
+                                                "type": "integer",
+                                                "format": "int64"
+                                            },
+                                            {
+                                                "type": "number",
+                                                "format": "double"
+                                            },
+                                            {
+                                                "type": "string"
+                                            }
+                                        ]
+                                    },
+                                    "allowChildOverride": {
+                                        "type": "boolean",
+                                        "default": false,
+                                        "description": "Whether users and requests below this group may override the group default."
+                                    }
+                                }
+                            }
+                        }
+                    }
+                },
+                "parameters": [
+                    {
+                        "name": "apiVersion",
+                        "in": "path",
+                        "required": true,
+                        "schema": {
+                            "type": "string",
+                            "enum": [
+                                "v1"
+                            ],
+                            "default": "v1"
+                        }
+                    },
+                    {
+                        "name": "groupId",
+                        "in": "path",
+                        "description": "Group identifier that receives the policy binding.",
+                        "required": true,
+                        "schema": {
+                            "type": "string",
+                            "pattern": "^[^/]+$"
+                        }
+                    },
+                    {
+                        "name": "policyKey",
+                        "in": "path",
+                        "description": "Policy identifier to persist at the group layer.",
+                        "required": true,
+                        "schema": {
+                            "type": "string",
+                            "pattern": "^[a-z0-9_]+$"
+                        }
+                    },
+                    {
+                        "name": "OCS-APIRequest",
+                        "in": "header",
+                        "description": "Required to be true for the API request to pass",
+                        "required": true,
+                        "schema": {
+                            "type": "boolean",
+                            "default": true
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "content": {
+                            "application/json": {
+                                "schema": {
+                                    "type": "object",
+                                    "required": [
+                                        "ocs"
+                                    ],
+                                    "properties": {
+                                        "ocs": {
+                                            "type": "object",
+                                            "required": [
+                                                "meta",
+                                                "data"
+                                            ],
+                                            "properties": {
+                                                "meta": {
+                                                    "$ref": "#/components/schemas/OCSMeta"
+                                                },
+                                                "data": {
+                                                    "$ref": "#/components/schemas/GroupPolicyWriteResponse"
+                                                }
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    },
+                    "400": {
+                        "description": "Invalid policy value",
+                        "content": {
+                            "application/json": {
+                                "schema": {
+                                    "type": "object",
+                                    "required": [
+                                        "ocs"
+                                    ],
+                                    "properties": {
+                                        "ocs": {
+                                            "type": "object",
+                                            "required": [
+                                                "meta",
+                                                "data"
+                                            ],
+                                            "properties": {
+                                                "meta": {
+                                                    "$ref": "#/components/schemas/OCSMeta"
+                                                },
+                                                "data": {
+                                                    "$ref": "#/components/schemas/ErrorResponse"
+                                                }
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    },
+                    "403": {
+                        "description": "Forbidden",
+                        "content": {
+                            "application/json": {
+                                "schema": {
+                                    "type": "object",
+                                    "required": [
+                                        "ocs"
+                                    ],
+                                    "properties": {
+                                        "ocs": {
+                                            "type": "object",
+                                            "required": [
+                                                "meta",
+                                                "data"
+                                            ],
+                                            "properties": {
+                                                "meta": {
+                                                    "$ref": "#/components/schemas/OCSMeta"
+                                                },
+                                                "data": {
+                                                    "$ref": "#/components/schemas/ErrorResponse"
+                                                }
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            },
+            "delete": {
+                "operationId": "policy-clear-group",
+                "summary": "Clear a group-level policy value",
+                "tags": [
+                    "policy"
+                ],
+                "security": [
+                    {
+                        "bearer_auth": []
+                    },
+                    {
+                        "basic_auth": []
+                    }
+                ],
+                "parameters": [
+                    {
+                        "name": "apiVersion",
+                        "in": "path",
+                        "required": true,
+                        "schema": {
+                            "type": "string",
+                            "enum": [
+                                "v1"
+                            ],
+                            "default": "v1"
+                        }
+                    },
+                    {
+                        "name": "groupId",
+                        "in": "path",
+                        "description": "Group identifier that receives the policy binding.",
+                        "required": true,
+                        "schema": {
+                            "type": "string",
+                            "pattern": "^[^/]+$"
+                        }
+                    },
+                    {
+                        "name": "policyKey",
+                        "in": "path",
+                        "description": "Policy identifier to clear for the selected group.",
+                        "required": true,
+                        "schema": {
+                            "type": "string",
+                            "pattern": "^[a-z0-9_]+$"
+                        }
+                    },
+                    {
+                        "name": "OCS-APIRequest",
+                        "in": "header",
+                        "description": "Required to be true for the API request to pass",
+                        "required": true,
+                        "schema": {
+                            "type": "boolean",
+                            "default": true
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "content": {
+                            "application/json": {
+                                "schema": {
+                                    "type": "object",
+                                    "required": [
+                                        "ocs"
+                                    ],
+                                    "properties": {
+                                        "ocs": {
+                                            "type": "object",
+                                            "required": [
+                                                "meta",
+                                                "data"
+                                            ],
+                                            "properties": {
+                                                "meta": {
+                                                    "$ref": "#/components/schemas/OCSMeta"
+                                                },
+                                                "data": {
+                                                    "$ref": "#/components/schemas/GroupPolicyWriteResponse"
+                                                }
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    },
+                    "403": {
+                        "description": "Forbidden",
+                        "content": {
+                            "application/json": {
+                                "schema": {
+                                    "type": "object",
+                                    "required": [
+                                        "ocs"
+                                    ],
+                                    "properties": {
+                                        "ocs": {
+                                            "type": "object",
+                                            "required": [
+                                                "meta",
+                                                "data"
+                                            ],
+                                            "properties": {
+                                                "meta": {
+                                                    "$ref": "#/components/schemas/OCSMeta"
+                                                },
+                                                "data": {
+                                                    "$ref": "#/components/schemas/ErrorResponse"
+                                                }
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        },
+        "/ocs/v2.php/apps/libresign/api/{apiVersion}/policies/user/{policyKey}": {
+            "put": {
+                "operationId": "policy-set-user-preference",
+                "summary": "Save a user policy preference",
+                "tags": [
+                    "policy"
+                ],
+                "security": [
+                    {
+                        "bearer_auth": []
+                    },
+                    {
+                        "basic_auth": []
+                    }
+                ],
+                "requestBody": {
+                    "required": false,
+                    "content": {
+                        "application/json": {
+                            "schema": {
+                                "type": "object",
+                                "properties": {
+                                    "value": {
+                                        "nullable": true,
+                                        "description": "Policy value to persist as the current user's default.",
+                                        "anyOf": [
+                                            {
+                                                "type": "boolean"
+                                            },
+                                            {
+                                                "type": "integer",
+                                                "format": "int64"
+                                            },
+                                            {
+                                                "type": "number",
+                                                "format": "double"
+                                            },
+                                            {
+                                                "type": "string"
+                                            }
+                                        ]
+                                    }
+                                }
+                            }
+                        }
+                    }
+                },
+                "parameters": [
+                    {
+                        "name": "apiVersion",
+                        "in": "path",
+                        "required": true,
+                        "schema": {
+                            "type": "string",
+                            "enum": [
+                                "v1"
+                            ],
+                            "default": "v1"
+                        }
+                    },
+                    {
+                        "name": "policyKey",
+                        "in": "path",
+                        "description": "Policy identifier to persist for the current user.",
+                        "required": true,
+                        "schema": {
+                            "type": "string",
+                            "pattern": "^[a-z0-9_]+$"
+                        }
+                    },
+                    {
+                        "name": "OCS-APIRequest",
+                        "in": "header",
+                        "description": "Required to be true for the API request to pass",
+                        "required": true,
+                        "schema": {
+                            "type": "boolean",
+                            "default": true
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "content": {
+                            "application/json": {
+                                "schema": {
+                                    "type": "object",
+                                    "required": [
+                                        "ocs"
+                                    ],
+                                    "properties": {
+                                        "ocs": {
+                                            "type": "object",
+                                            "required": [
+                                                "meta",
+                                                "data"
+                                            ],
+                                            "properties": {
+                                                "meta": {
+                                                    "$ref": "#/components/schemas/OCSMeta"
+                                                },
+                                                "data": {
+                                                    "$ref": "#/components/schemas/SystemPolicyWriteResponse"
+                                                }
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    },
+                    "400": {
+                        "description": "Invalid policy value",
+                        "content": {
+                            "application/json": {
+                                "schema": {
+                                    "type": "object",
+                                    "required": [
+                                        "ocs"
+                                    ],
+                                    "properties": {
+                                        "ocs": {
+                                            "type": "object",
+                                            "required": [
+                                                "meta",
+                                                "data"
+                                            ],
+                                            "properties": {
+                                                "meta": {
+                                                    "$ref": "#/components/schemas/OCSMeta"
+                                                },
+                                                "data": {
+                                                    "$ref": "#/components/schemas/ErrorResponse"
+                                                }
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            },
+            "delete": {
+                "operationId": "policy-clear-user-preference",
+                "summary": "Clear a user policy preference",
+                "tags": [
+                    "policy"
+                ],
+                "security": [
+                    {
+                        "bearer_auth": []
+                    },
+                    {
+                        "basic_auth": []
+                    }
+                ],
+                "parameters": [
+                    {
+                        "name": "apiVersion",
+                        "in": "path",
+                        "required": true,
+                        "schema": {
+                            "type": "string",
+                            "enum": [
+                                "v1"
+                            ],
+                            "default": "v1"
+                        }
+                    },
+                    {
+                        "name": "policyKey",
+                        "in": "path",
+                        "description": "Policy identifier to clear for the current user.",
+                        "required": true,
+                        "schema": {
+                            "type": "string",
+                            "pattern": "^[a-z0-9_]+$"
+                        }
+                    },
+                    {
+                        "name": "OCS-APIRequest",
+                        "in": "header",
+                        "description": "Required to be true for the API request to pass",
+                        "required": true,
+                        "schema": {
+                            "type": "boolean",
+                            "default": true
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "content": {
+                            "application/json": {
+                                "schema": {
+                                    "type": "object",
+                                    "required": [
+                                        "ocs"
+                                    ],
+                                    "properties": {
+                                        "ocs": {
+                                            "type": "object",
+                                            "required": [
+                                                "meta",
+                                                "data"
+                                            ],
+                                            "properties": {
+                                                "meta": {
+                                                    "$ref": "#/components/schemas/OCSMeta"
+                                                },
+                                                "data": {
+                                                    "$ref": "#/components/schemas/SystemPolicyWriteResponse"
+                                                }
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        },
         "/ocs/v2.php/apps/libresign/api/{apiVersion}/request-signature": {
             "post": {
                 "operationId": "request_signature-request",
@@ -7476,7 +8420,7 @@
                                     "signatureFlow": {
                                         "type": "string",
                                         "nullable": true,
-                                        "description": "Signature flow mode: 'parallel' or 'ordered_numeric'. If not provided, uses global configuration"
+                                        "description": "Signature flow mode: 'parallel' or 'ordered_numeric'. If not provided, uses the effective policy resolution."
                                     }
                                 }
                             }
@@ -7644,7 +8588,7 @@
                                     "signatureFlow": {
                                         "type": "string",
                                         "nullable": true,
-                                        "description": "Signature flow mode: 'parallel' or 'ordered_numeric'. If not provided, uses global configuration"
+                                        "description": "Signature flow mode: 'parallel' or 'ordered_numeric'. If not provided, uses the effective policy resolution."
                                     },
                                     "name": {
                                         "type": "string",
diff --git a/playwright/e2e/policy-workbench-personas-permissions.spec.ts b/playwright/e2e/policy-workbench-personas-permissions.spec.ts
new file mode 100644
index 0000000000..3975074d84
--- /dev/null
+++ b/playwright/e2e/policy-workbench-personas-permissions.spec.ts
@@ -0,0 +1,251 @@
+/**
+ * SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+import { expect, request, test, type APIRequestContext } from '@playwright/test'
+import {
+	ensureGroupExists,
+	ensureSubadminOfGroup,
+	ensureUserExists,
+	ensureUserInGroup,
+} from '../support/nc-provisioning'
+
+test.describe.configure({ retries: 0, timeout: 90000 })
+
+const ADMIN_USER = process.env.NEXTCLOUD_ADMIN_USER ?? 'admin'
+const ADMIN_PASSWORD = process.env.NEXTCLOUD_ADMIN_PASSWORD ?? 'admin'
+const DEFAULT_TEST_PASSWORD = '123456'
+
+const GROUP_ID = 'policy-e2e-group'
+const GROUP_ADMIN_USER = 'policy-e2e-group-admin'
+const END_USER = 'policy-e2e-end-user'
+const INSTANCE_RESET_USER = 'policy-e2e-instance-reset-user'
+const POLICY_KEY = 'signature_flow'
+
+type OcsPolicyResponse = {
+	ocs?: {
+		meta?: {
+			statuscode?: number
+			message?: string
+		}
+		data?: Record<string, unknown>
+	}
+}
+
+async function policyRequest(
+	requestContext: APIRequestContext,
+	method: 'GET' | 'POST' | 'PUT' | 'DELETE',
+	path: string,
+	body?: Record<string, unknown>,
+) {
+	const requestUrl = `./ocs/v2.php${path}`
+	const requestOptions = {
+		data: body,
+		failOnStatusCode: false,
+	}
+
+	const response = method === 'GET'
+		? await requestContext.get(requestUrl, requestOptions)
+		: method === 'POST'
+			? await requestContext.post(requestUrl, requestOptions)
+			: method === 'PUT'
+				? await requestContext.put(requestUrl, requestOptions)
+				: await requestContext.delete(requestUrl, requestOptions)
+
+	const text = await response.text()
+	const parsed = text ? JSON.parse(text) as OcsPolicyResponse : { ocs: { data: {} } }
+
+	return {
+		httpStatus: response.status(),
+		statusCode: parsed.ocs?.meta?.statuscode ?? response.status(),
+		message: parsed.ocs?.meta?.message ?? '',
+		data: parsed.ocs?.data ?? {},
+	}
+}
+
+async function getEffectivePolicy(
+	requestContext: APIRequestContext,
+) {
+	const result = await policyRequest(requestContext, 'GET', `/apps/libresign/api/v1/policies/effective`)
+	const policies = (result.data.policies ?? {}) as Record<string, {
+		effectiveValue?: unknown
+		editableByCurrentActor?: boolean
+		canSaveAsUserDefault?: boolean
+		sourceScope?: string
+		allowedValues?: unknown[]
+	}>
+
+	return policies[POLICY_KEY] ?? null
+}
+
+async function clearOwnUserPreference(
+	requestContext: APIRequestContext,
+) {
+	const result = await policyRequest(requestContext, 'DELETE', `/apps/libresign/api/v1/policies/user/${POLICY_KEY}`)
+	expect([200, 500]).toContain(result.httpStatus)
+}
+
+async function createAuthenticatedRequestContext(authUser: string, authPassword: string): Promise<APIRequestContext> {
+	const auth = 'Basic ' + Buffer.from(`${authUser}:${authPassword}`).toString('base64')
+
+	return request.newContext({
+		baseURL: process.env.PLAYWRIGHT_BASE_URL ?? 'https://localhost',
+		ignoreHTTPSErrors: true,
+		extraHTTPHeaders: {
+			'OCS-ApiRequest': 'true',
+			Accept: 'application/json',
+			Authorization: auth,
+			'Content-Type': 'application/json',
+		},
+	})
+}
+
+test('personas can manage policies according to permissions and override toggles', async ({ page }) => {
+	await ensureUserExists(page.request, GROUP_ADMIN_USER, DEFAULT_TEST_PASSWORD)
+	await ensureUserExists(page.request, END_USER, DEFAULT_TEST_PASSWORD)
+	await ensureGroupExists(page.request, GROUP_ID)
+	await ensureUserInGroup(page.request, GROUP_ADMIN_USER, GROUP_ID)
+	await ensureUserInGroup(page.request, END_USER, GROUP_ID)
+	await ensureSubadminOfGroup(page.request, GROUP_ADMIN_USER, GROUP_ID)
+
+	const adminRequest = await createAuthenticatedRequestContext(ADMIN_USER, ADMIN_PASSWORD)
+	const groupAdminRequest = await createAuthenticatedRequestContext(GROUP_ADMIN_USER, DEFAULT_TEST_PASSWORD)
+	const endUserRequest = await createAuthenticatedRequestContext(END_USER, DEFAULT_TEST_PASSWORD)
+
+	try {
+
+	// Normalize user-level state before assertions.
+	await clearOwnUserPreference(groupAdminRequest)
+	await clearOwnUserPreference(endUserRequest)
+
+	// Global admin defines baseline and group policy with override enabled.
+	let result = await policyRequest(
+		adminRequest,
+		'POST',
+		`/apps/libresign/api/v1/policies/system/${POLICY_KEY}`,
+		{ value: 'parallel', allowChildOverride: true },
+	)
+	expect(result.httpStatus).toBe(200)
+
+	result = await policyRequest(
+		adminRequest,
+		'PUT',
+		`/apps/libresign/api/v1/policies/group/${GROUP_ID}/${POLICY_KEY}`,
+		{ value: 'ordered_numeric', allowChildOverride: true },
+	)
+	expect(result.httpStatus).toBe(200)
+
+	// Group admin can edit own group rule.
+	result = await policyRequest(
+		groupAdminRequest,
+		'PUT',
+		`/apps/libresign/api/v1/policies/group/${GROUP_ID}/${POLICY_KEY}`,
+		{ value: 'ordered_numeric', allowChildOverride: false },
+	)
+	expect(result.httpStatus).toBe(200)
+
+	const groupPolicyReadback = await policyRequest(
+		groupAdminRequest,
+		'GET',
+		`/apps/libresign/api/v1/policies/group/${GROUP_ID}/${POLICY_KEY}`,
+	)
+	expect(groupPolicyReadback.httpStatus).toBe(200)
+	expect(groupPolicyReadback.data?.policy).toMatchObject({
+		targetId: GROUP_ID,
+		policyKey: POLICY_KEY,
+		value: 'ordered_numeric',
+		allowChildOverride: false,
+	})
+
+	// End user cannot manage group policy and cannot save user preference while group blocks lower layers.
+	result = await policyRequest(
+		endUserRequest,
+		'PUT',
+		`/apps/libresign/api/v1/policies/group/${GROUP_ID}/${POLICY_KEY}`,
+		{ value: 'parallel', allowChildOverride: true },
+	)
+	expect(result.httpStatus).toBe(403)
+
+	result = await policyRequest(
+		endUserRequest,
+		'PUT',
+		`/apps/libresign/api/v1/policies/user/${POLICY_KEY}`,
+		{ value: 'parallel' },
+	)
+	expect(result.httpStatus).toBe(400)
+
+	let endUserEffective = await getEffectivePolicy(endUserRequest)
+	expect(endUserEffective?.effectiveValue).toBe('ordered_numeric')
+	expect(endUserEffective?.canSaveAsUserDefault).toBe(false)
+
+	// Group admin enables lower-layer overrides again.
+	result = await policyRequest(
+		groupAdminRequest,
+		'PUT',
+		`/apps/libresign/api/v1/policies/group/${GROUP_ID}/${POLICY_KEY}`,
+		{ value: 'ordered_numeric', allowChildOverride: true },
+	)
+	expect(result.httpStatus).toBe(200)
+
+	// End user can now save personal preference and it becomes effective.
+	result = await policyRequest(
+		endUserRequest,
+		'PUT',
+		`/apps/libresign/api/v1/policies/user/${POLICY_KEY}`,
+		{ value: 'parallel' },
+	)
+	expect(result.httpStatus).toBe(200)
+
+	endUserEffective = await getEffectivePolicy(endUserRequest)
+	expect(endUserEffective?.effectiveValue).toBe('parallel')
+	expect(endUserEffective?.sourceScope).toBe('user')
+	expect(endUserEffective?.canSaveAsUserDefault).toBe(true)
+	} finally {
+		await Promise.all([
+			adminRequest.dispose(),
+			groupAdminRequest.dispose(),
+			endUserRequest.dispose(),
+		])
+	}
+})
+
+test('admin can remove explicit instance policy and restore system baseline', async ({ page }) => {
+	await ensureUserExists(page.request, INSTANCE_RESET_USER, DEFAULT_TEST_PASSWORD)
+
+	const adminRequest = await createAuthenticatedRequestContext(ADMIN_USER, ADMIN_PASSWORD)
+	const instanceResetUserRequest = await createAuthenticatedRequestContext(INSTANCE_RESET_USER, DEFAULT_TEST_PASSWORD)
+
+	try {
+		await clearOwnUserPreference(instanceResetUserRequest)
+
+		let result = await policyRequest(
+			adminRequest,
+			'POST',
+			`/apps/libresign/api/v1/policies/system/${POLICY_KEY}`,
+			{ value: 'parallel', allowChildOverride: true },
+		)
+		expect(result.httpStatus).toBe(200)
+
+		let effectivePolicy = await getEffectivePolicy(instanceResetUserRequest)
+		expect(effectivePolicy?.effectiveValue).toBe('parallel')
+		expect(effectivePolicy?.sourceScope).toBe('global')
+
+		result = await policyRequest(
+			adminRequest,
+			'POST',
+			`/apps/libresign/api/v1/policies/system/${POLICY_KEY}`,
+			{ value: null, allowChildOverride: false },
+		)
+		expect(result.httpStatus).toBe(200)
+
+		effectivePolicy = await getEffectivePolicy(instanceResetUserRequest)
+		expect(effectivePolicy?.effectiveValue).toBe('none')
+		expect(effectivePolicy?.sourceScope).toBe('system')
+	} finally {
+		await Promise.all([
+			adminRequest.dispose(),
+			instanceResetUserRequest.dispose(),
+		])
+	}
+})
diff --git a/playwright/e2e/policy-workbench-system-default-persistence.spec.ts b/playwright/e2e/policy-workbench-system-default-persistence.spec.ts
new file mode 100644
index 0000000000..2cb0832c9b
--- /dev/null
+++ b/playwright/e2e/policy-workbench-system-default-persistence.spec.ts
@@ -0,0 +1,441 @@
+/**
+ * SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+import { expect, test } from '@playwright/test'
+import type { Locator, Page } from '@playwright/test'
+import { login } from '../support/nc-login'
+import { ensureUserExists } from '../support/nc-provisioning'
+
+test.describe.configure({ mode: 'serial', retries: 0, timeout: 45000 })
+
+const openPolicyButtonName = /Manage signing order|Manage this setting|Manage setting|Open policy|Open setting policy/i
+const changeDefaultButtonName = /^Change$/i
+const removeExceptionButtonName = /Remove exception|Remove rule/i
+const userRuleTargetLabel = 'policy-e2e-user'
+const instanceWideTargetLabel = 'Default (instance-wide)'
+const ruleDialogName = /Create rule|Edit rule|What do you want to create\?/i
+
+async function getActiveRuleDialog(page: Page): Promise<Locator> {
+	const roleDialog = page.getByRole('dialog', { name: ruleDialogName }).last()
+	if (await roleDialog.isVisible().catch(() => false)) {
+		return roleDialog
+	}
+
+	const headingDialog = page.locator('[role="dialog"]').filter({
+		has: page.getByRole('heading', { name: ruleDialogName }),
+	}).last()
+	await expect(headingDialog).toBeVisible({ timeout: 8000 })
+	return headingDialog
+}
+
+async function openSigningOrderDialog(page: Page) {
+	const manageButtonsByClass = page.locator('.policy-workbench__manage-button')
+	if (await manageButtonsByClass.count()) {
+		await expect(manageButtonsByClass.first()).toBeVisible({ timeout: 20000 })
+		await manageButtonsByClass.first().click()
+	} else {
+		const manageButtonsByName = page.getByRole('button', { name: openPolicyButtonName })
+		await expect(manageButtonsByName.first()).toBeVisible({ timeout: 20000 })
+		await manageButtonsByName.first().click()
+	}
+	await expect(page.getByLabel('Signing order')).toBeVisible()
+}
+
+async function getSigningOrderDialog(page: Page): Promise<Locator> {
+	const dialog = page.getByLabel('Signing order')
+	await expect(dialog).toBeVisible()
+	return dialog
+}
+
+async function waitForEditorIdle(dialog: Locator) {
+	const savingOverlays = dialog.page().locator('[aria-busy="true"]')
+	await savingOverlays.first().waitFor({ state: 'hidden', timeout: 10000 }).catch(() => {})
+}
+
+async function setSigningFlow(dialog: Locator, flow: 'parallel' | 'ordered_numeric' | 'none'): Promise<boolean> {
+	const label = flow === 'parallel'
+		? /Simultaneous \(Parallel\)/i
+		: flow === 'ordered_numeric'
+			? /Sequential/i
+			: /Let users choose/i
+	const page = dialog.page()
+	const activeDialog = await getActiveRuleDialog(page).catch(() => null)
+	const root = activeDialog ?? dialog
+	const flowRadio = root.getByRole('radio', { name: label }).first()
+
+	if (!(await flowRadio.count())) {
+		return false
+	}
+
+	if (!(await flowRadio.isChecked())) {
+		await flowRadio.click({ force: true })
+		if (!(await flowRadio.isChecked())) {
+			const optionRow = root.locator('.checkbox-radio-switch').filter({ hasText: label }).first()
+			if (await optionRow.count()) {
+				await optionRow.click({ force: true })
+			}
+		}
+	}
+	return true
+}
+
+async function submitRule(dialog: Locator) {
+	await waitForEditorIdle(dialog)
+	const page = dialog.page()
+	const activeDialog = await getActiveRuleDialog(page).catch(() => null)
+	const root = activeDialog ?? dialog
+
+	const createButton = root.getByRole('button', { name: /Create rule|Create policy rule/i }).last()
+	if (await createButton.isVisible().catch(() => false)) {
+		await expect(createButton).toBeEnabled({ timeout: 8000 })
+		await createButton.click()
+		await waitForEditorIdle(dialog)
+		return
+	}
+
+	const saveButton = root.getByRole('button', { name: /Save changes|Save policy rule changes|Save rule changes/i }).last()
+	await expect(saveButton).toBeVisible({ timeout: 8000 })
+	await expect(saveButton).toBeEnabled({ timeout: 8000 })
+	await saveButton.click()
+	await waitForEditorIdle(dialog)
+}
+
+async function submitSystemRuleAndWait(dialog: Locator) {
+	const page = dialog.page()
+	const saveSystemPolicyResponse = page.waitForResponse((response) => {
+		return ['POST', 'PUT', 'PATCH'].includes(response.request().method())
+			&& response.url().includes('/apps/libresign/api/v1/policies/system/signature_flow')
+	})
+
+	await submitRule(dialog)
+	const response = await saveSystemPolicyResponse
+	expect(response.status(), 'Expected system policy save request to succeed').toBe(200)
+}
+
+async function getSystemSignatureFlowValue(page: Page): Promise<unknown> {
+	const response = await page.request.get('./ocs/v2.php/apps/libresign/api/v1/policies/system/signature_flow', {
+		headers: {
+			'OCS-ApiRequest': 'true',
+			Accept: 'application/json',
+		},
+	})
+	expect(response.status(), 'Expected system policy fetch request to succeed').toBe(200)
+	const data = await response.json() as {
+		ocs?: {
+			data?: {
+				policy?: {
+					value?: unknown
+				}
+			}
+		}
+	}
+
+	return data.ocs?.data?.policy?.value ?? null
+}
+
+async function clearSystemSignatureFlowValue(page: Page): Promise<void> {
+	const response = await page.request.post('./ocs/v2.php/apps/libresign/api/v1/policies/system/signature_flow', {
+		headers: {
+			'OCS-ApiRequest': 'true',
+			Accept: 'application/json',
+		},
+		data: {
+			value: null,
+			allowChildOverride: true,
+		},
+	})
+	expect(response.status(), 'Expected system policy reset request to succeed').toBe(200)
+}
+
+function getRuleRow(dialog: Locator, _scope: 'Instance' | 'Group' | 'User', targetLabel: string) {
+	return dialog.locator('tbody tr').filter({
+		hasText: targetLabel,
+	}).first()
+}
+
+async function openSystemDefaultEditor(dialog: Locator) {
+	await dialog.getByRole('button', { name: changeDefaultButtonName }).first().click()
+	await getActiveRuleDialog(dialog.page())
+}
+
+async function getCreateScopeDialog(page: Page): Promise<Locator> {
+	const dialog = await getActiveRuleDialog(page)
+	await expect(dialog.getByRole('heading', { name: /What do you want to create\?/i })).toBeVisible()
+	return dialog
+}
+
+async function getCreateScopeOption(page: Page, scopeLabel: 'User' | 'Group' | 'Instance') {
+	const dialog = await getCreateScopeDialog(page)
+	return dialog.getByRole('option', { name: new RegExp(`^${scopeLabel}\\b`, 'i') }).first()
+}
+
+async function openRuleActions(dialog: Locator, scope: 'Instance' | 'Group' | 'User', targetLabel: string) {
+	const row = getRuleRow(dialog, scope, targetLabel)
+	await expect(row).toBeVisible({ timeout: 8000 })
+	await row.getByRole('button', { name: 'Rule actions' }).first().click()
+	return row
+}
+
+async function clickRuleMenuAction(dialog: Locator, actionName: 'Edit' | 'Remove'): Promise<boolean> {
+	const page = dialog.page()
+	const actionItem = page
+		.locator('.action-item:visible, [role="menuitem"]:visible, li.action:visible')
+		.filter({ hasText: new RegExp(`^${actionName}$`, 'i') })
+		.first()
+
+	if (!(await actionItem.isVisible().catch(() => false))) {
+		return false
+	}
+
+	await actionItem.click()
+	return true
+}
+
+async function editRule(dialog: Locator, scope: 'Instance' | 'Group' | 'User', targetLabel: string) {
+	for (let attempt = 0; attempt < 3; attempt += 1) {
+		await openRuleActions(dialog, scope, targetLabel)
+		if (await clickRuleMenuAction(dialog, 'Edit')) {
+			return
+		}
+		await dialog.page().waitForTimeout(200)
+	}
+
+	expect(false, 'Expected Edit action to be visible in rule menu').toBe(true)
+}
+
+async function removeRule(dialog: Locator, scope: 'Instance' | 'Group' | 'User', targetLabel: string) {
+	for (let attempt = 0; attempt < 3; attempt += 1) {
+		await openRuleActions(dialog, scope, targetLabel)
+		if (await clickRuleMenuAction(dialog, 'Remove')) {
+			const page = dialog.page()
+			const removeExceptionButton = page.getByRole('button', { name: removeExceptionButtonName }).first()
+			if (await removeExceptionButton.isVisible().catch(() => false)) {
+				await removeExceptionButton.click()
+			} else {
+				const removeExceptionText = page.getByText(/^Remove exception$/i).first()
+				if (await removeExceptionText.isVisible().catch(() => false)) {
+					await removeExceptionText.click()
+				}
+			}
+			await waitForEditorIdle(dialog)
+			await dialog.page().waitForTimeout(150)
+			return
+		}
+		await dialog.page().waitForTimeout(200)
+	}
+
+	expect(false, 'Expected Remove action to be visible in rule menu').toBe(true)
+}
+
+async function chooseTarget(dialog: Locator, ariaLabel: 'Target groups' | 'Target users', optionText: string) {
+	await waitForEditorIdle(dialog)
+	const page = dialog.page()
+	const activeDialog = await getActiveRuleDialog(page).catch(() => null)
+	const root = activeDialog ?? dialog
+
+	const combobox = root.getByRole('combobox', { name: ariaLabel }).first()
+	const labeledInput = root.getByLabel(ariaLabel).first()
+	const targetInput = await combobox.count() ? combobox : labeledInput
+
+	await expect(targetInput).toBeVisible({ timeout: 8000 })
+	await targetInput.click()
+
+	const searchInput = targetInput.locator('input').first()
+	if (await searchInput.count()) {
+		await searchInput.fill(optionText)
+		await page.waitForTimeout(250)
+		const matchingOption = page.getByRole('option', { name: new RegExp(optionText, 'i') }).first()
+		const matchingVisible = await matchingOption.waitFor({ state: 'visible', timeout: 3000 }).then(() => true).catch(() => false)
+		if (matchingVisible) {
+			await matchingOption.click()
+			await searchInput.press('Tab').catch(() => {})
+			return
+		}
+
+		const exactTextOption = page.getByText(new RegExp(`^${optionText}$`, 'i')).last()
+		const exactTextVisible = await exactTextOption.waitFor({ state: 'visible', timeout: 1500 }).then(() => true).catch(() => false)
+		if (exactTextVisible) {
+			await exactTextOption.click()
+			await searchInput.press('Tab').catch(() => {})
+			return
+		}
+
+		const anyOption = page.getByRole('option').first()
+		const anyVisible = await anyOption.waitFor({ state: 'visible', timeout: 3000 }).then(() => true).catch(() => false)
+		if (anyVisible) {
+			await anyOption.click()
+			await searchInput.press('Tab').catch(() => {})
+			return
+		}
+
+		await searchInput.press('ArrowDown')
+		await searchInput.press('Enter')
+		await searchInput.press('Tab').catch(() => {})
+	} else {
+		const fallbackTextbox = root.getByRole('textbox').first()
+		await fallbackTextbox.fill(optionText)
+		await fallbackTextbox.press('ArrowDown')
+		await fallbackTextbox.press('Enter')
+		await fallbackTextbox.press('Tab').catch(() => {})
+	}
+}
+
+async function resetSystemRuleToBaseline(dialog: Locator) {
+	await clearSystemSignatureFlowValue(dialog.page())
+}
+
+async function clearExistingRules(dialog: Locator) {
+	const page = dialog.page()
+
+	for (let round = 0; round < 6; round += 1) {
+		let removedInRound = false
+		const actions = dialog.getByRole('button', { name: 'Rule actions' })
+
+		while ((await actions.count()) > 0) {
+			const firstAction = actions.first()
+			if (!(await firstAction.isVisible().catch(() => false))) {
+				break
+			}
+
+			const clickedAction = await firstAction.click({ timeout: 1500 }).then(() => true).catch(() => false)
+			if (!clickedAction) {
+				await page.waitForTimeout(150)
+				continue
+			}
+			const hasRemoveAction = await clickRuleMenuAction(dialog, 'Remove')
+			if (!hasRemoveAction) {
+				break
+			}
+
+			const removeExceptionButton = page.getByRole('button', { name: removeExceptionButtonName }).first()
+			if (await removeExceptionButton.isVisible().catch(() => false)) {
+				await removeExceptionButton.click()
+			} else {
+				const removeExceptionText = page.getByText(/^Remove exception$/i).first()
+				if (await removeExceptionText.isVisible().catch(() => false)) {
+					await removeExceptionText.click()
+				}
+			}
+			await waitForEditorIdle(dialog)
+			await page.waitForTimeout(150)
+			removedInRound = true
+		}
+
+		if (!removedInRound) {
+			await page.waitForTimeout(700)
+			if ((await actions.count()) === 0) {
+				break
+			}
+		}
+	}
+
+	if (await dialog.getByText(/\(custom\)/i).first().isVisible().catch(() => false)) {
+		await resetSystemRuleToBaseline(dialog)
+	}
+
+	await expect(dialog).toBeVisible()
+}
+
+test('system default persists across edit cycles and can be reset to the system baseline', async ({ page }) => {
+	await login(
+		page.request,
+		process.env.NEXTCLOUD_ADMIN_USER ?? 'admin',
+		process.env.NEXTCLOUD_ADMIN_PASSWORD ?? 'admin',
+	)
+
+	await page.goto('./settings/admin/libresign')
+
+	await openSigningOrderDialog(page)
+
+	const signingOrderDialog = await getSigningOrderDialog(page)
+	await clearExistingRules(signingOrderDialog)
+
+	await page.reload()
+	await openSigningOrderDialog(page)
+	const stableDialog = await getSigningOrderDialog(page)
+
+	await openSystemDefaultEditor(stableDialog)
+	expect(await setSigningFlow(stableDialog, 'ordered_numeric'), 'Expected signing-flow radios in system editor').toBe(true)
+	await submitSystemRuleAndWait(stableDialog)
+	expect(await getSystemSignatureFlowValue(page)).toBe('ordered_numeric')
+
+	await page.reload()
+	await openSigningOrderDialog(page)
+	const reloadedDialog = await getSigningOrderDialog(page)
+	expect(await getSystemSignatureFlowValue(page)).toBe('ordered_numeric')
+
+	await openSystemDefaultEditor(reloadedDialog)
+	expect(await setSigningFlow(reloadedDialog, 'parallel'), 'Expected signing-flow radios in system editor').toBe(true)
+	await submitSystemRuleAndWait(reloadedDialog)
+	expect(await getSystemSignatureFlowValue(page)).toBe('parallel')
+
+	await resetSystemRuleToBaseline(reloadedDialog)
+	expect([null, 'none']).toContain(await getSystemSignatureFlowValue(page))
+})
+
+test('admin can manage instance, group, and user rules when system default is fixed', async ({ page }) => {
+	const userTarget = userRuleTargetLabel
+
+	await ensureUserExists(page.request, userTarget)
+
+	await login(
+		page.request,
+		process.env.NEXTCLOUD_ADMIN_USER ?? 'admin',
+		process.env.NEXTCLOUD_ADMIN_PASSWORD ?? 'admin',
+	)
+
+	await page.goto('./settings/admin/libresign')
+	await openSigningOrderDialog(page)
+
+	const dialog = await getSigningOrderDialog(page)
+	await clearExistingRules(dialog)
+
+	await page.reload()
+	await openSigningOrderDialog(page)
+	const stableDialog = await getSigningOrderDialog(page)
+
+	// Global rule: edit
+	await openSystemDefaultEditor(stableDialog)
+	expect(await setSigningFlow(stableDialog, 'ordered_numeric'), 'Expected signing-flow radios in global editor').toBe(true)
+	await submitSystemRuleAndWait(stableDialog)
+	expect(await getSystemSignatureFlowValue(page)).toBe('ordered_numeric')
+
+	// Instance admins can still create group-level exceptions even when the system default is fixed.
+	await stableDialog.getByRole('button', { name: 'Create rule' }).first().click()
+	const groupScopeOption = await getCreateScopeOption(stableDialog.page(), 'Group')
+	await expect(groupScopeOption).toBeEnabled()
+
+	// User rule: create
+	const userScopeOption = await getCreateScopeOption(stableDialog.page(), 'User')
+	await expect(userScopeOption).toBeEnabled()
+	await userScopeOption.click()
+	await chooseTarget(stableDialog, 'Target users', userTarget)
+	expect(await setSigningFlow(stableDialog, 'parallel'), 'Expected signing-flow radios in user editor').toBe(true)
+	await submitRule(stableDialog)
+	await expect(stableDialog).toContainText(userTarget)
+	await expect(stableDialog).toContainText('Simultaneous (Parallel)')
+
+	// User rule: edit
+	await editRule(stableDialog, 'User', userTarget)
+	expect(await setSigningFlow(stableDialog, 'ordered_numeric'), 'Expected signing-flow radios in user editor').toBe(true)
+	await submitRule(stableDialog)
+	await expect(stableDialog).toContainText(userTarget)
+	await expect(stableDialog).toContainText('Sequential')
+
+	await page.reload()
+	await openSigningOrderDialog(page)
+	const reloadedDialog = await getSigningOrderDialog(page)
+	expect(await getSystemSignatureFlowValue(page)).toBe('ordered_numeric')
+	await expect(reloadedDialog).toContainText(userTarget)
+	await expect(reloadedDialog).toContainText('Sequential')
+
+	// User rule: delete
+	await removeRule(reloadedDialog, 'User', userTarget)
+	await expect(reloadedDialog).not.toContainText(userTarget)
+
+	// Global rule: reset to explicit "let users choose" baseline
+	await resetSystemRuleToBaseline(reloadedDialog)
+	expect([null, 'none']).toContain(await getSystemSignatureFlowValue(page))
+})
diff --git a/playwright/e2e/send-reminder.spec.ts b/playwright/e2e/send-reminder.spec.ts
index 040c5b5133..fe53050b3b 100644
--- a/playwright/e2e/send-reminder.spec.ts
+++ b/playwright/e2e/send-reminder.spec.ts
@@ -67,7 +67,9 @@ test('admin can send a reminder to a pending signer', async ({ page }) => {
 	// The signer row renders as NcListItem with force-display-actions, so the
 	// three-dots NcActions toggle is always visible (aria-label="Actions").
 	await page.locator('li').filter({ hasText: 'Signer 01' }).getByRole('button', { name: 'Actions' }).click()
-	await page.getByRole('menuitem', { name: 'Send reminder' }).click()
+	const sendReminderAction = page.locator('[role="menuitem"], [role="dialog"] button').filter({ hasText: /^Send reminder$/i }).first()
+	await expect(sendReminderAction).toBeVisible({ timeout: 8000 })
+	await sendReminderAction.click()
 
 	// The reminder uses a different subject: "LibreSign: Changes into a file for you to sign".
 	await waitForEmailTo(mailpit, 'signer01@libresign.coop', 'LibreSign: Changes into a file for you to sign')
diff --git a/playwright/e2e/signature-flow-policy-request-sidebar.spec.ts b/playwright/e2e/signature-flow-policy-request-sidebar.spec.ts
new file mode 100644
index 0000000000..81867fe7e0
--- /dev/null
+++ b/playwright/e2e/signature-flow-policy-request-sidebar.spec.ts
@@ -0,0 +1,278 @@
+/**
+ * SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+import { expect, request, test, type APIRequestContext, type Page } from '@playwright/test'
+import { login } from '../support/nc-login'
+import {
+	configureOpenSsl,
+	ensureGroupExists,
+	ensureSubadminOfGroup,
+	ensureUserExists,
+	ensureUserInGroup,
+	setAppConfig,
+} from '../support/nc-provisioning'
+
+const POLICY_KEY = 'signature_flow'
+const GROUP_ADMIN_USER = 'signature-flow-e2e-group-admin'
+const GROUP_ADMIN_PASSWORD = '123456'
+const GROUP_ADMIN_GROUP = 'signature-flow-e2e-group'
+
+test.setTimeout(120_000)
+test.describe.configure({ mode: 'serial' })
+
+type OcsPolicyResponse = {
+	ocs?: {
+		meta?: {
+			statuscode?: number
+			message?: string
+		}
+		data?: Record<string, unknown>
+	}
+}
+
+async function createAuthenticatedRequestContext(authUser: string, authPassword: string): Promise<APIRequestContext> {
+	const auth = 'Basic ' + Buffer.from(`${authUser}:${authPassword}`).toString('base64')
+
+	return request.newContext({
+		baseURL: process.env.PLAYWRIGHT_BASE_URL ?? 'https://localhost',
+		ignoreHTTPSErrors: true,
+		extraHTTPHeaders: {
+			'OCS-ApiRequest': 'true',
+			Accept: 'application/json',
+			Authorization: auth,
+		},
+	})
+}
+
+async function policyRequest(
+	requestContext: APIRequestContext,
+	method: 'POST' | 'DELETE',
+	path: string,
+	body?: Record<string, unknown>,
+) {
+	const response = method === 'POST'
+		? await requestContext.post(`./ocs/v2.php${path}`, {
+			data: body,
+			headers: {
+				'Content-Type': 'application/json',
+			},
+			failOnStatusCode: false,
+		})
+		: await requestContext.delete(`./ocs/v2.php${path}`, { failOnStatusCode: false })
+
+	const text = await response.text()
+	const parsed = text ? JSON.parse(text) as OcsPolicyResponse : { ocs: { data: {} } }
+
+	return {
+		httpStatus: response.status(),
+		statusCode: parsed.ocs?.meta?.statuscode ?? response.status(),
+		message: parsed.ocs?.meta?.message ?? '',
+	}
+}
+
+async function setSystemSignatureFlowPolicy(
+	requestContext: APIRequestContext,
+	value: 'none' | 'parallel' | 'ordered_numeric',
+	allowChildOverride: boolean,
+) {
+	const result = await policyRequest(
+		requestContext,
+		'POST',
+		`/apps/libresign/api/v1/policies/system/${POLICY_KEY}`,
+		{ value, allowChildOverride },
+	)
+
+	expect(result.httpStatus, `Failed to set system signature flow policy: ${result.message}`).toBe(200)
+}
+
+async function clearOwnPreference(requestContext: APIRequestContext) {
+	const result = await policyRequest(
+		requestContext,
+		'DELETE',
+		`/apps/libresign/api/v1/policies/user/${POLICY_KEY}`,
+	)
+	// Can be 200 (cleared) or 500 when preference doesn't exist in some environments.
+	expect([200, 500]).toContain(result.httpStatus)
+}
+
+async function addEmailSigner(page: Page, email: string, name: string) {
+	const dialog = page.getByRole('dialog', { name: 'Add new signer' })
+	await page.getByRole('button', { name: 'Add signer' }).click()
+	await dialog.getByPlaceholder('Email').click()
+	await dialog.getByPlaceholder('Email').pressSequentially(email, { delay: 50 })
+	await expect(page.getByRole('option', { name: email })).toBeVisible({ timeout: 10_000 })
+	await page.getByRole('option', { name: email }).click()
+	await dialog.getByRole('textbox', { name: 'Signer name' }).fill(name)
+
+	const saveSignerResponsePromise = page.waitForResponse((response) => {
+		return response.url().includes('/apps/libresign/api/v1/request-signature')
+			&& ['POST', 'PATCH'].includes(response.request().method())
+	})
+
+	await dialog.getByRole('button', { name: 'Save' }).click()
+	const saveSignerResponse = await saveSignerResponsePromise
+	expect(saveSignerResponse.status()).toBe(200)
+	await expect(dialog).toBeHidden()
+}
+
+test('request sidebar persists signature flow preference through policies endpoint', async ({ page }) => {
+	const adminUser = process.env.NEXTCLOUD_ADMIN_USER ?? 'admin'
+	const adminPassword = process.env.NEXTCLOUD_ADMIN_PASSWORD ?? 'admin'
+	const adminRequest = await createAuthenticatedRequestContext(adminUser, adminPassword)
+
+	await login(page.request, adminUser, adminPassword)
+
+	await configureOpenSsl(adminRequest, 'LibreSign Test', {
+		C: 'BR',
+		OU: ['Organization Unit'],
+		ST: 'Rio de Janeiro',
+		O: 'LibreSign',
+		L: 'Rio de Janeiro',
+	})
+
+	await setAppConfig(
+		adminRequest,
+		'libresign',
+		'identify_methods',
+		JSON.stringify([
+			{ name: 'account', enabled: false, mandatory: false },
+			{ name: 'email', enabled: true, mandatory: true, signatureMethods: { clickToSign: { enabled: true } }, can_create_account: false },
+		]),
+	)
+
+	try {
+		await setSystemSignatureFlowPolicy(adminRequest, 'parallel', true)
+		await clearOwnPreference(adminRequest)
+
+		await page.goto('./apps/libresign')
+		await page.getByRole('button', { name: 'Upload from URL' }).click()
+		await page.getByRole('textbox', { name: 'URL of a PDF file' }).fill('https://raw.githubusercontent.com/LibreSign/libresign/main/tests/php/fixtures/pdfs/small_valid.pdf')
+		await page.getByRole('button', { name: 'Send' }).click()
+
+		await addEmailSigner(page, 'signer01@libresign.coop', 'Signer 01')
+		await addEmailSigner(page, 'signer02@libresign.coop', 'Signer 02')
+
+		// Enable remember preference first, then switch to ordered mode.
+		// The second action must persist ordered_numeric via policies endpoint.
+		await expect(page.getByLabel('Use this as my default signing order')).toBeVisible()
+		await page.getByText('Use this as my default signing order').click()
+
+		const saveOrderedPreference = page.waitForResponse((response) => {
+			const req = response.request()
+			return req.method() === 'PUT'
+				&& req.url().includes('/apps/libresign/api/v1/policies/user/signature_flow')
+				&& (req.postData() ?? '').includes('ordered_numeric')
+		})
+
+		await expect(page.getByLabel('Sign in order')).toBeVisible()
+		await page.getByText('Sign in order').click()
+		await expect(page.getByLabel('Sign in order')).toBeChecked()
+
+		const saveOrderedPreferenceResponse = await saveOrderedPreference
+		expect(saveOrderedPreferenceResponse.status()).toBe(200)
+	} finally {
+		await clearOwnPreference(adminRequest)
+		await setSystemSignatureFlowPolicy(adminRequest, 'none', true)
+		await adminRequest.dispose()
+	}
+})
+
+for (const systemFlow of ['ordered_numeric', 'parallel'] as const) {
+	test(`fixed system ${systemFlow} signature flow hides request toggles for groupadmin`, async ({ page }) => {
+		const adminUser = process.env.NEXTCLOUD_ADMIN_USER ?? 'admin'
+		const adminPassword = process.env.NEXTCLOUD_ADMIN_PASSWORD ?? 'admin'
+
+		const adminRequest = await createAuthenticatedRequestContext(adminUser, adminPassword)
+		const groupAdminRequest = await createAuthenticatedRequestContext(GROUP_ADMIN_USER, GROUP_ADMIN_PASSWORD)
+
+		await ensureUserExists(adminRequest, GROUP_ADMIN_USER, GROUP_ADMIN_PASSWORD)
+		await ensureGroupExists(adminRequest, GROUP_ADMIN_GROUP)
+		await ensureUserInGroup(adminRequest, GROUP_ADMIN_USER, GROUP_ADMIN_GROUP)
+		await ensureSubadminOfGroup(adminRequest, GROUP_ADMIN_USER, GROUP_ADMIN_GROUP)
+
+		await configureOpenSsl(adminRequest, 'LibreSign Test', {
+			C: 'BR',
+			OU: ['Organization Unit'],
+			ST: 'Rio de Janeiro',
+			O: 'LibreSign',
+			L: 'Rio de Janeiro',
+		})
+
+		await setAppConfig(
+			adminRequest,
+			'libresign',
+			'identify_methods',
+			JSON.stringify([
+				{ name: 'account', enabled: false, mandatory: false },
+				{ name: 'email', enabled: true, mandatory: true, signatureMethods: { clickToSign: { enabled: true } }, can_create_account: false },
+			]),
+		)
+
+		await setAppConfig(
+			adminRequest,
+			'libresign',
+			'groups_request_sign',
+			JSON.stringify(['admin', GROUP_ADMIN_GROUP]),
+		)
+
+		try {
+			await setSystemSignatureFlowPolicy(adminRequest, systemFlow, false)
+			await clearOwnPreference(groupAdminRequest)
+
+			await login(page.request, GROUP_ADMIN_USER, GROUP_ADMIN_PASSWORD)
+			await page.goto('./apps/libresign/f/request')
+			await expect(page.getByRole('heading', { name: 'Request Signatures' })).toBeVisible()
+			await page.getByRole('button', { name: 'Upload from URL' }).click()
+			await page.getByRole('textbox', { name: 'URL of a PDF file' }).fill('https://raw.githubusercontent.com/LibreSign/libresign/main/tests/php/fixtures/pdfs/small_valid.pdf')
+			await page.getByRole('button', { name: 'Send' }).click()
+
+			await addEmailSigner(page, 'signer11@libresign.coop', 'Signer 11')
+			await addEmailSigner(page, 'signer12@libresign.coop', 'Signer 12')
+
+			await expect(page.getByLabel('Sign in order')).toBeHidden()
+			await expect(page.getByLabel('Use this as my default signing order')).toBeHidden()
+
+			const sendRequestResponsePromise = page.waitForResponse((response) => {
+				const request = response.request()
+				const body = request.postData() ?? ''
+				return response.url().includes('/apps/libresign/api/v1/request-signature')
+					&& ['POST', 'PATCH'].includes(request.method())
+					&& body.includes('"status":1')
+			})
+
+			await page.getByRole('button', { name: 'Request signatures' }).click()
+			await page.getByRole('button', { name: 'Send' }).click()
+
+			const sendRequestResponse = await sendRequestResponsePromise
+			expect(sendRequestResponse.status()).toBe(200)
+			const sendRequestPayload = JSON.parse(sendRequestResponse.request().postData() ?? '{}') as {
+				signatureFlow?: string
+			}
+			expect(sendRequestPayload.signatureFlow).toBeUndefined()
+
+			const sendRequestBody = await sendRequestResponse.json() as {
+				ocs?: {
+					data?: {
+						signatureFlow?: string
+						signers?: Array<{ signingOrder?: number }>
+					}
+				}
+			}
+			expect(sendRequestBody.ocs?.data?.signatureFlow).toBe(systemFlow)
+
+			if (systemFlow === 'ordered_numeric') {
+				expect(sendRequestBody.ocs?.data?.signers?.map((signer) => signer.signingOrder)).toEqual([1, 2])
+			}
+		} finally {
+			await clearOwnPreference(groupAdminRequest)
+			await setSystemSignatureFlowPolicy(adminRequest, 'none', true)
+			await setAppConfig(adminRequest, 'libresign', 'groups_request_sign', JSON.stringify(['admin']))
+			await Promise.all([
+				adminRequest.dispose(),
+				groupAdminRequest.dispose(),
+			])
+		}
+	})
+}
diff --git a/playwright/support/nc-login.ts b/playwright/support/nc-login.ts
index f97f681ac6..775de89217 100644
--- a/playwright/support/nc-login.ts
+++ b/playwright/support/nc-login.ts
@@ -25,6 +25,12 @@ export async function login(
 	user: string,
 	password: string,
 ): Promise<void> {
+	// Ensure a previous authenticated session does not leak across persona switches.
+	await request.get('./logout', {
+		failOnStatusCode: false,
+		maxRedirects: 0,
+	}).catch(() => {})
+
 	const tokenResponse = await request.get('./csrftoken', {
 		failOnStatusCode: true,
 	})
diff --git a/playwright/support/nc-provisioning.ts b/playwright/support/nc-provisioning.ts
index 39e5665c37..08c7b82f29 100644
--- a/playwright/support/nc-provisioning.ts
+++ b/playwright/support/nc-provisioning.ts
@@ -27,6 +27,21 @@ type SignatureElementResponse = {
 	}>
 }
 
+function toStringList(data: unknown): string[] {
+	if (Array.isArray(data)) {
+		return data.filter((item): item is string => typeof item === 'string')
+	}
+
+	if (data && typeof data === 'object') {
+		const nested = data as { groups?: unknown[] }
+		if (Array.isArray(nested.groups)) {
+			return nested.groups.filter((item): item is string => typeof item === 'string')
+		}
+	}
+
+	return []
+}
+
 async function ocsRequest<T = unknown>(
 	request: APIRequestContext,
 	method: 'GET' | 'POST' | 'PUT' | 'DELETE',
@@ -124,6 +139,95 @@ export async function deleteUser(
 	await ocsRequest(request, 'DELETE', `/cloud/users/${userId}`)
 }
 
+// ---------------------------------------------------------------------------
+// Groups and delegated administration
+// ---------------------------------------------------------------------------
+
+/**
+ * Creates a group if it does not exist.
+ */
+export async function ensureGroupExists(
+	request: APIRequestContext,
+	groupId: string,
+): Promise<void> {
+	const check = await ocsRequest(request, 'GET', `/cloud/groups?search=${encodeURIComponent(groupId)}`)
+	const groups = toStringList(check.ocs.data)
+	if (groups.includes(groupId)) {
+		return
+	}
+
+	const create = await ocsRequest(request, 'POST', '/cloud/groups', undefined, undefined, {
+		groupid: groupId,
+	})
+	if (create.ocs.meta.statuscode !== 200 && create.ocs.meta.statuscode !== 102) {
+		throw new Error(`Failed to create group "${groupId}": ${create.ocs.meta.message}`)
+	}
+}
+
+/**
+ * Adds a user to a group.
+ */
+export async function ensureUserInGroup(
+	request: APIRequestContext,
+	userId: string,
+	groupId: string,
+): Promise<void> {
+	const groupsResponse = await ocsRequest(request, 'GET', `/cloud/users/${encodeURIComponent(userId)}/groups`)
+	const groups = toStringList(groupsResponse.ocs.data)
+	if (groups.includes(groupId)) {
+		return
+	}
+
+	const add = await ocsRequest(
+		request,
+		'POST',
+		`/cloud/users/${encodeURIComponent(userId)}/groups`,
+		undefined,
+		undefined,
+		{ groupid: groupId },
+	)
+	if (add.ocs.meta.statuscode !== 200) {
+		throw new Error(`Failed to add user "${userId}" to group "${groupId}": ${add.ocs.meta.message}`)
+	}
+
+	const verify = await ocsRequest(request, 'GET', `/cloud/users/${encodeURIComponent(userId)}/groups`)
+	if (!toStringList(verify.ocs.data).includes(groupId)) {
+		throw new Error(`User "${userId}" is not in group "${groupId}" after assignment.`)
+	}
+}
+
+/**
+ * Grants subadmin rights for a specific group.
+ */
+export async function ensureSubadminOfGroup(
+	request: APIRequestContext,
+	userId: string,
+	groupId: string,
+): Promise<void> {
+	const subadmins = await ocsRequest(request, 'GET', `/cloud/users/${encodeURIComponent(userId)}/subadmins`)
+	const groups = toStringList(subadmins.ocs.data)
+	if (groups.includes(groupId)) {
+		return
+	}
+
+	const grant = await ocsRequest(
+		request,
+		'POST',
+		`/cloud/users/${encodeURIComponent(userId)}/subadmins`,
+		undefined,
+		undefined,
+		{ groupid: groupId },
+	)
+	if (grant.ocs.meta.statuscode !== 200) {
+		throw new Error(`Failed to grant subadmin for user "${userId}" in group "${groupId}": ${grant.ocs.meta.message}`)
+	}
+
+	const verify = await ocsRequest(request, 'GET', `/cloud/users/${encodeURIComponent(userId)}/subadmins`)
+	if (!toStringList(verify.ocs.data).includes(groupId)) {
+		throw new Error(`User "${userId}" was not granted subadmin rights for group "${groupId}".`)
+	}
+}
+
 // ---------------------------------------------------------------------------
 // App config  (equivalent to `occ config:app:set`)
 // ---------------------------------------------------------------------------
diff --git a/src/components/RightSidebar/RequestSignatureTab.vue b/src/components/RightSidebar/RequestSignatureTab.vue
index b17c599146..b9202c7ea6 100644
--- a/src/components/RightSidebar/RequestSignatureTab.vue
+++ b/src/components/RightSidebar/RequestSignatureTab.vue
@@ -16,6 +16,9 @@
 		<NcNoteCard v-if="shouldLoadDetail && isLoadingFileDetail" type="info">
 			{{ t('libresign', 'Loading signer details...') }}
 		</NcNoteCard>
+		<NcNoteCard v-if="showSignatureFlowPreferenceClearedNotice" type="info">
+			{{ t('libresign', 'A previous signing order preference was removed because it is no longer compatible with higher-level policy.') }}
+		</NcNoteCard>
 		<NcButton v-if="filesStore.canAddSigner() && !isOriginalFileDeleted"
 			:variant="hasSigners ? 'secondary' : 'primary'"
 			@click="addSigner">
@@ -30,6 +33,12 @@
 			@update:modelValue="onPreserveOrderChange">
 			{{ t('libresign', 'Sign in order') }}
 		</NcCheckboxRadioSwitch>
+		<NcCheckboxRadioSwitch v-if="showRememberSignatureFlow && !isOriginalFileDeleted"
+			v-model="rememberSignatureFlow"
+			type="switch"
+			@update:modelValue="onRememberSignatureFlowChange">
+			{{ t('libresign', 'Use this as my default signing order') }}
+		</NcCheckboxRadioSwitch>
 		<NcButton v-if="showViewOrderButton && !isOriginalFileDeleted"
 			variant="tertiary"
 			@click="showOrderDiagram = true">
@@ -318,6 +327,7 @@ import { getSigningRouteUuid, getValidationRouteUuid } from '../../utils/signReq
 import { openDocument } from '../../utils/viewer.js'
 import router from '../../router/router'
 import { useFilesStore } from '../../store/files.js'
+import { usePoliciesStore } from '../../store/policies'
 import { useSidebarStore } from '../../store/sidebar.js'
 import { useSignStore } from '../../store/sign.js'
 import { useUserConfigStore } from '../../store/userconfig.js'
@@ -328,7 +338,6 @@ import type {
 	IdentifyMethodRecord,
 	IdentifyMethodSetting as IdentifyMethodConfig,
 	LibresignCapabilities as RequestSignatureTabCapabilities,
-	SignatureFlowMode,
 	SignatureFlowValue,
 } from '../../types/index'
 
@@ -345,6 +354,7 @@ type IdentifySignerToEdit = {
 	description?: string
 	identifyMethods?: IdentifySignerMethod[]
 }
+type ResolvedSignatureFlowMode = 'none' | 'parallel' | 'ordered_numeric'
 type SigningOrderDiagramSigner = {
 	displayName?: string
 	signed?: boolean
@@ -375,6 +385,7 @@ const props = withDefaults(defineProps<{
 })
 
 const filesStore = useFilesStore()
+const policiesStore = usePoliciesStore()
 const signStore = useSignStore()
 const sidebarStore = useSidebarStore()
 const userConfigStore = useUserConfigStore() as ReturnType<typeof useUserConfigStore> & {
@@ -396,33 +407,48 @@ const showConfirmRequestSigner = ref(false)
 const selectedSigner = ref<EditableRequestSigner | null>(null)
 const activeTab = ref('')
 const preserveOrder = ref(false)
+const rememberSignatureFlow = ref(false)
 const showOrderDiagram = ref(false)
 const showEnvelopeFilesDialog = ref(false)
-const adminSignatureFlow = ref<SignatureFlowMode>(loadState<SignatureFlowMode>('libresign', 'signature_flow', 'none'))
 const signingProgress = ref<components['schemas']['ProgressPayload'] | null>(null)
 const signingProgressStatus = ref<number | null>(null)
 const signingProgressStatusText = ref('')
 const stopPollingFunction = ref<null | (() => void)>(null)
 
+const signatureFlowPolicy = computed(() => policiesStore.getPolicy('signature_flow'))
+const canChooseSigningOrderAtRequestLevel = computed(() => policiesStore.canUseRequestOverride('signature_flow'))
+const isAdminFlowForced = computed(() => !canChooseSigningOrderAtRequestLevel.value)
+
 const signatureFlow = computed(() => {
 	const file = filesStore.getFile()
-	let flow = file?.signatureFlow
+	const resolvedPolicy = toSignatureFlowMode(signatureFlowPolicy.value?.effectiveValue)
+	const fileFlow = file?.signatureFlow
+	const resolvedFileFlow = toSignatureFlowMode(fileFlow)
 
-	if (typeof flow === 'number') {
-		const flowMap: Record<number, string> = { 0: 'none', 1: 'parallel', 2: 'ordered_numeric' }
-		return flowMap[flow]
+	if (!canChooseSigningOrderAtRequestLevel.value && resolvedPolicy && resolvedPolicy !== 'none') {
+		return resolvedPolicy
 	}
 
-	if (flow && flow !== 'none') {
-		return flow
+	if (typeof fileFlow === 'number' && fileFlow !== 0 && resolvedFileFlow) {
+		return resolvedFileFlow
 	}
-	if (adminSignatureFlow.value && adminSignatureFlow.value !== 'none') {
-		return adminSignatureFlow.value
+
+	if (resolvedFileFlow && resolvedFileFlow !== 'none') {
+		return resolvedFileFlow
+	}
+
+	if (resolvedPolicy && resolvedPolicy !== 'none') {
+		return resolvedPolicy
+	}
+
+	if (fileFlow === 0) {
+		return 'none'
 	}
+
 	return 'parallel'
 })
 
-const isAdminFlowForced = computed(() => adminSignatureFlow.value && adminSignatureFlow.value !== 'none')
+const canSaveSignatureFlowPreference = computed(() => signatureFlowPolicy.value?.canSaveAsUserDefault ?? false)
 const isOrderedNumeric = computed(() => signatureFlow.value === 'ordered_numeric')
 const hasSigners = computed(() => filesStore.hasSigners(filesStore.getFile()))
 const totalSigners = computed(() => Number(filesStore.getFile()?.signersCount || filesStore.getFile()?.signers?.length || 0))
@@ -430,10 +456,12 @@ const isOriginalFileDeleted = computed(() => filesStore.isOriginalFileDeleted())
 const currentFile = computed<EditableRequestFile | null>(() => (filesStore.getFile() as EditableRequestFile | null) ?? null)
 const isCurrentFileDetailed = computed(() => currentFile.value?.detailsLoaded === true)
 const shouldLoadDetail = computed(() => totalSigners.value > 0)
-const showSigningOrderOptions = computed(() => !isOriginalFileDeleted.value && isCurrentFileDetailed.value && hasSigners.value && filesStore.canSave() && !isAdminFlowForced.value)
-const showPreserveOrder = computed(() => !isOriginalFileDeleted.value && isCurrentFileDetailed.value && totalSigners.value > 1 && filesStore.canSave() && !isAdminFlowForced.value)
+const showSigningOrderOptions = computed(() => !isOriginalFileDeleted.value && isCurrentFileDetailed.value && hasSigners.value && filesStore.canSave() && canChooseSigningOrderAtRequestLevel.value)
+const showPreserveOrder = computed(() => !isOriginalFileDeleted.value && isCurrentFileDetailed.value && totalSigners.value > 1 && filesStore.canSave() && canChooseSigningOrderAtRequestLevel.value)
+const showRememberSignatureFlow = computed(() => showPreserveOrder.value && canSaveSignatureFlowPreference.value)
 const showViewOrderButton = computed(() => !isOriginalFileDeleted.value && isCurrentFileDetailed.value && isOrderedNumeric.value && totalSigners.value > 1 && hasSigners.value)
 const shouldShowOrderedOptions = computed(() => isOrderedNumeric.value && totalSigners.value > 1)
+const showSignatureFlowPreferenceClearedNotice = computed(() => signatureFlowPolicy.value?.preferenceWasCleared ?? false)
 const currentUserDisplayName = computed(() => OC.getCurrentUser()?.displayName || '')
 const showDocMdpWarning = computed(() => filesStore.isDocMdpNoChangesAllowed() && !filesStore.canAddSigner())
 const fileName = computed(() => filesStore.getSelectedFileView()?.name ?? '')
@@ -452,12 +480,59 @@ const signingOrderDiagramSigners = computed<SigningOrderDiagramSigner[]>(() => {
 })
 
 function normalizeSignatureFlow(flow: unknown): SignatureFlowValue | null {
+	if (flow && typeof flow === 'object' && 'flow' in (flow as Record<string, unknown>)) {
+		const nestedFlow = (flow as { flow?: unknown }).flow
+		return normalizeSignatureFlow(nestedFlow)
+	}
+
 	if (flow === 'none' || flow === 'parallel' || flow === 'ordered_numeric' || flow === 0 || flow === 1 || flow === 2) {
 		return flow
 	}
 	return null
 }
 
+function toSignatureFlowMode(flow: unknown): ResolvedSignatureFlowMode | null {
+	const normalizedFlow = normalizeSignatureFlow(flow)
+	if (normalizedFlow === 0) {
+		return 'none'
+	}
+
+	if (normalizedFlow === 1) {
+		return 'parallel'
+	}
+
+	if (normalizedFlow === 2) {
+		return 'ordered_numeric'
+	}
+
+	if (normalizedFlow === 'none' || normalizedFlow === 'parallel' || normalizedFlow === 'ordered_numeric') {
+		return normalizedFlow
+	}
+
+	return null
+}
+
+function getResolvedSignatureFlowForSave(): SignatureFlowValue {
+	const flow = signatureFlow.value
+	if (flow === 'ordered_numeric') {
+		return 'ordered_numeric'
+	}
+
+	if (flow === 'parallel') {
+		return 'parallel'
+	}
+
+	return 'parallel'
+}
+
+function getSignatureFlowPayloadForSave(): SignatureFlowValue | null {
+	if (!canChooseSigningOrderAtRequestLevel.value) {
+		return null
+	}
+
+	return getResolvedSignatureFlowForSave()
+}
+
 function getSignerMethod(signer: { identifyMethods?: Array<Pick<IdentifyMethodRecord, 'method'>> }): string | undefined {
 	return signer.identifyMethods?.[0]?.method
 }
@@ -747,7 +822,7 @@ const debouncedSave = debounce(async () => {
 	try {
 		const file = filesStore.getFile()
 		const signers = isOrderedNumeric.value ? file?.signers : null
-		const signatureFlow = normalizeSignatureFlow(file?.signatureFlow)
+		const signatureFlow = getSignatureFlowPayloadForSave()
 		await filesStore.saveOrUpdateSignatureRequest({
 			signers,
 			signatureFlow,
@@ -764,6 +839,7 @@ const debouncedTabChange = debounce((tabId: string) => {
 function onPreserveOrderChange(value: boolean) {
 	preserveOrder.value = value
 	const file = filesStore.getEditableFile()
+	const nextFlow = value ? 'ordered_numeric' : 'parallel'
 
 	if (value) {
 		if (file?.signers) {
@@ -776,7 +852,7 @@ function onPreserveOrderChange(value: boolean) {
 			})
 		}
 		if (file) {
-			file.signatureFlow = 'ordered_numeric'
+			file.signatureFlow = nextFlow
 		}
 	} else if (!isAdminFlowForced.value) {
 		if (file?.signers) {
@@ -787,23 +863,84 @@ function onPreserveOrderChange(value: boolean) {
 			})
 		}
 		if (file) {
-			file.signatureFlow = 'parallel'
+			file.signatureFlow = nextFlow
 		}
 	}
 
+	if (rememberSignatureFlow.value && canSaveSignatureFlowPreference.value) {
+		void saveSignatureFlowPreference(nextFlow)
+	}
+
 	debouncedSave()
 }
 
+async function saveSignatureFlowPreference(flow: 'parallel' | 'ordered_numeric'): Promise<void> {
+	try {
+		await policiesStore.saveUserPreference('signature_flow', flow)
+		syncRememberSignatureFlowWithPolicy()
+	} catch (error: unknown) {
+		showRequestError(error, t('libresign', 'Failed to save signing order preference'))
+		rememberSignatureFlow.value = false
+	}
+}
+
+async function onRememberSignatureFlowChange(value: boolean): Promise<void> {
+	const previousValue = rememberSignatureFlow.value
+	rememberSignatureFlow.value = value
+	if (!canSaveSignatureFlowPreference.value) {
+		return
+	}
+
+	try {
+		if (value) {
+			await saveSignatureFlowPreference(isOrderedNumeric.value ? 'ordered_numeric' : 'parallel')
+			return
+		}
+
+		await policiesStore.clearUserPreference('signature_flow')
+		syncRememberSignatureFlowWithPolicy()
+	} catch (error: unknown) {
+		showRequestError(error, t('libresign', 'Failed to clear signing order preference'))
+		rememberSignatureFlow.value = previousValue
+	}
+}
+
 function syncPreserveOrderWithFile() {
-	const file = filesStore.getFile()
+	preserveOrder.value = signatureFlow.value === 'ordered_numeric' && canChooseSigningOrderAtRequestLevel.value
+}
+
+function syncFileSignatureFlowWithPolicy() {
+	const resolvedPolicy = toSignatureFlowMode(signatureFlowPolicy.value?.effectiveValue)
+	if (canChooseSigningOrderAtRequestLevel.value || !resolvedPolicy || resolvedPolicy === 'none') {
+		return
+	}
+
+	const file = currentFile.value
 	if (!file) {
-		preserveOrder.value = false
 		return
 	}
 
-	const flow = file.signatureFlow
-	const normalizedFlow = normalizeSignatureFlow(flow)
-	preserveOrder.value = (normalizedFlow === 'ordered_numeric' || normalizedFlow === 2) && !isAdminFlowForced.value
+	file.signatureFlow = resolvedPolicy
+
+	if (resolvedPolicy !== 'ordered_numeric' || !Array.isArray(file.signers)) {
+		return
+	}
+
+	const orders = file.signers.map((signer: EditableRequestSigner) => signer.signingOrder || 0)
+	const hasDuplicateOrders = orders.length !== new Set(orders).size
+	file.signers.forEach((signer: EditableRequestSigner, index: number) => {
+		if (!signer.signingOrder || hasDuplicateOrders) {
+			signer.signingOrder = index + 1
+		}
+	})
+
+	if (file.signers.every((signer: EditableRequestSigner) => typeof signer.signingOrder === 'number')) {
+		normalizeSigningOrders(file.signers as Array<{ signingOrder: number }>)
+	}
+}
+
+function syncRememberSignatureFlowWithPolicy() {
+	rememberSignatureFlow.value = signatureFlowPolicy.value?.sourceScope === 'user'
 }
 
 async function ensureCurrentFileDetail(force = false) {
@@ -815,6 +952,8 @@ async function ensureCurrentFileDetail(force = false) {
 	isLoadingFileDetail.value = true
 	try {
 		await filesStore.fetchFileDetail({ fileId: file.id, force })
+		syncFileSignatureFlowWithPolicy()
+		syncPreserveOrderWithFile()
 	} catch (error: unknown) {
 		showRequestError(error, t('libresign', 'Failed to load signer details'))
 	} finally {
@@ -1036,7 +1175,7 @@ async function confirmRequestSigner() {
 			}
 			return signer
 		})
-		await filesStore.saveOrUpdateSignatureRequest({ signers: signers as never, status: 1 })
+		await filesStore.saveOrUpdateSignatureRequest({ signers: signers as never, status: 1, signatureFlow: getSignatureFlowPayloadForSave() })
 		showSuccess(t('libresign', 'Signature requested'))
 		showConfirmRequestSigner.value = false
 		selectedSigner.value = null
@@ -1073,7 +1212,7 @@ async function save() {
 	await ensureCurrentFileDetail()
 	hasLoading.value = true
 	try {
-		await filesStore.saveOrUpdateSignatureRequest({})
+		await filesStore.saveOrUpdateSignatureRequest({ signatureFlow: getSignatureFlowPayloadForSave() })
 		emit('libresign:show-visible-elements', new CustomEvent('libresign:show-visible-elements'))
 	} catch (error: unknown) {
 		showRequestError(error, t('libresign', 'Failed to save signature request'))
@@ -1089,7 +1228,7 @@ async function confirmRequest() {
 	await ensureCurrentFileDetail()
 	hasLoading.value = true
 	try {
-		const response = await filesStore.saveOrUpdateSignatureRequest({ status: 1 })
+		const response = await filesStore.saveOrUpdateSignatureRequest({ status: 1, signatureFlow: getSignatureFlowPayloadForSave() })
 		showSuccess(t('libresign', response.message || 'Signature requested'))
 		showConfirmRequest.value = false
 	} catch (error: unknown) {
@@ -1100,7 +1239,7 @@ async function confirmRequest() {
 
 async function openManageFiles() {
 	hasLoading.value = true
-	const response = await filesStore.saveOrUpdateSignatureRequest({})
+	const response = await filesStore.saveOrUpdateSignatureRequest({ signatureFlow: getSignatureFlowPayloadForSave() })
 	hasLoading.value = false
 	if (response && 'success' in response && response.success === false && response.message) {
 		showError(response.message)
@@ -1190,11 +1329,19 @@ function stopSigningProgressPolling() {
 
 watch(() => filesStore.selectedFileId, (newFileId) => {
 	if (newFileId) {
+		syncFileSignatureFlowWithPolicy()
 		syncPreserveOrderWithFile()
+		syncRememberSignatureFlowWithPolicy()
 		void ensureCurrentFileDetail()
 	}
 }, { immediate: true })
 
+watch(signatureFlowPolicy, () => {
+	syncFileSignatureFlowWithPolicy()
+	syncPreserveOrderWithFile()
+	syncRememberSignatureFlowWithPolicy()
+})
+
 const handleEditSigner = ((event: NextcloudEvent) => {
 	editSigner((event as CustomEvent<EditableRequestSigner>).detail)
 }) as EventHandler<NextcloudEvent>
@@ -1211,7 +1358,10 @@ onMounted(() => {
 	subscribe('libresign:edit-signer', handleEditSigner)
 	filesStore.disableIdentifySigner()
 	activeTab.value = userConfigStore.files_list_signer_identify_tab || ''
+	void policiesStore.fetchEffectivePolicies()
+	syncFileSignatureFlowWithPolicy()
 	syncPreserveOrderWithFile()
+	syncRememberSignatureFlowWithPolicy()
 	void ensureCurrentFileDetail()
 })
 
@@ -1233,9 +1383,10 @@ defineExpose({
 	selectedSigner,
 	activeTab,
 	preserveOrder,
+	rememberSignatureFlow,
 	showOrderDiagram,
 	showEnvelopeFilesDialog,
-	adminSignatureFlow,
+	signatureFlowPolicy,
 	debouncedSave,
 	debouncedTabChange,
 	signingProgress,
@@ -1244,9 +1395,12 @@ defineExpose({
 	stopPollingFunction,
 	signatureFlow,
 	isAdminFlowForced,
+	getSignatureFlowPayloadForSave,
 	isOrderedNumeric,
 	showSigningOrderOptions,
 	showPreserveOrder,
+	showRememberSignatureFlow,
+	showSignatureFlowPreferenceClearedNotice,
 	showViewOrderButton,
 	shouldShowOrderedOptions,
 	currentUserDisplayName,
@@ -1274,6 +1428,8 @@ defineExpose({
 	showSigningProgress,
 	isSignerSigned,
 	onPreserveOrderChange,
+	onRememberSignatureFlowChange,
+	syncFileSignatureFlowWithPolicy,
 	syncPreserveOrderWithFile,
 	getSvgIcon,
 	canSignerActInOrder,
diff --git a/src/components/Settings/Settings.vue b/src/components/Settings/Settings.vue
index e5e9b34953..c5e766cb7d 100644
--- a/src/components/Settings/Settings.vue
+++ b/src/components/Settings/Settings.vue
@@ -11,11 +11,24 @@
 				<NcIconSvgWrapper class="account-icon" :path="mdiAccount" :size="20" />
 			</template>
 		</NcAppNavigationItem>
-		<NcAppNavigationItem v-if="isAdmin" icon="icon-settings"
+		<NcAppNavigationItem :name="t('libresign', 'Preferences')"
+			:to="{name: 'Preferences'}">
+			<template #icon>
+				<NcIconSvgWrapper class="preferences-icon" :path="mdiTuneVariant" :size="20" />
+			</template>
+		</NcAppNavigationItem>
+		<NcAppNavigationItem v-if="canManagePolicies"
+			:name="t('libresign', 'Policies')"
+			:to="{name: 'Policies'}">
+			<template #icon>
+				<NcIconSvgWrapper class="policies-icon" :path="mdiShieldCheckOutline" :size="20" />
+			</template>
+		</NcAppNavigationItem>
+		<NcAppNavigationItem v-if="isAdmin"
 			:name="t('libresign', 'Administration')"
 			:href="getAdminRoute()">
 			<template #icon>
-				<NcIconSvgWrapper class="tune-icon" :path="mdiTune" :size="20" />
+				<NcIconSvgWrapper class="tune-icon" :path="mdiCogOutline" :size="20" />
 			</template>
 		</NcAppNavigationItem>
 		<NcAppNavigationItem icon="icon-star" :name="t('libresign', 'Rate LibreSign  ❤️')"
@@ -30,6 +43,7 @@
 <script setup lang="ts">
 import { t } from '@nextcloud/l10n'
 import { getCurrentUser } from '@nextcloud/auth'
+import { loadState } from '@nextcloud/initial-state'
 import { generateUrl } from '@nextcloud/router'
 
 
@@ -37,8 +51,10 @@ import NcAppNavigationItem from '@nextcloud/vue/components/NcAppNavigationItem'
 import NcIconSvgWrapper from '@nextcloud/vue/components/NcIconSvgWrapper'
 import {
 	mdiAccount,
+	mdiCogOutline,
 	mdiStar,
-	mdiTune,
+	mdiShieldCheckOutline,
+	mdiTuneVariant,
 } from '@mdi/js'
 
 defineOptions({
@@ -46,6 +62,8 @@ defineOptions({
 })
 
 const isAdmin = getCurrentUser()?.isAdmin ?? false
+const config = loadState<{ can_manage_group_policies?: boolean }>('libresign', 'config', {})
+const canManagePolicies = isAdmin || Boolean(config.can_manage_group_policies)
 
 function getAdminRoute() {
 	return generateUrl('settings/admin/libresign')
@@ -53,5 +71,6 @@ function getAdminRoute() {
 
 defineExpose({
 	getAdminRoute,
+	canManagePolicies,
 })
 </script>
diff --git a/src/router/router.ts b/src/router/router.ts
index 26344bfa7a..25f455e86a 100644
--- a/src/router/router.ts
+++ b/src/router/router.ts
@@ -180,6 +180,16 @@ const routes: RouteRecordRaw[] = [
 		name: 'Account',
 		component: () => import('../views/Account/Account.vue'),
 	},
+	{
+		path: '/f/preferences',
+		name: 'Preferences',
+		component: () => import('../views/Preferences/Preferences.vue'),
+	},
+	{
+		path: '/f/policies',
+		name: 'Policies',
+		component: () => import('../views/Policies/Policies.vue'),
+	},
 	{
 		path: '/f/docs/id-docs/validation',
 		name: 'DocsIdDocsValidation',
diff --git a/src/store/files.js b/src/store/files.js
index aee1a10214..e5c56971b3 100644
--- a/src/store/files.js
+++ b/src/store/files.js
@@ -17,6 +17,7 @@ import { generateOcsUrl } from '@nextcloud/router'
 import { useFilesSortingStore } from './filesSorting.js'
 import { useFiltersStore } from './filters.js'
 import { useIdentificationDocumentStore } from './identificationDocument.js'
+import { usePoliciesStore } from './policies'
 import { useSidebarStore } from './sidebar.js'
 import { FILE_STATUS } from '../constants.js'
 import { getSigningRouteUuid } from '../utils/signRequestUuid.ts'
@@ -1199,15 +1200,20 @@ const _filesStore = defineStore('files', () => {
 	 */
 	async function saveOrUpdateSignatureRequest({ visibleElements = [], signers = null, uuid = null, status = 0, signatureFlow = null } = {}) {
 		const store = getStore()
+		const policiesStore = usePoliciesStore()
 		const currentFileKey = selectedFileId.value
 		const selectedFile = getFile()
 		const requestSigners = serializeRequestSigners(signers || selectedFile?.signers || [])
 		const requestVisibleElements = serializeVisibleElements(visibleElements)
-
-		let flowValue = signatureFlow || selectedFile.signatureFlow
-		if (typeof flowValue === 'number') {
-			const flowMap = { 0: 'none', 1: 'parallel', 2: 'ordered_numeric' }
-			flowValue = flowMap[flowValue] || 'parallel'
+		const canUseSignatureFlowOverride = policiesStore.canUseRequestOverride('signature_flow')
+
+		let flowValue = signatureFlow
+		if (canUseSignatureFlowOverride) {
+			flowValue = signatureFlow ?? selectedFile.signatureFlow
+			if (typeof flowValue === 'number') {
+				const flowMap = { 0: 'none', 1: 'parallel', 2: 'ordered_numeric' }
+				flowValue = flowMap[flowValue] || 'parallel'
+			}
 		}
 
 		const config = {
@@ -1218,7 +1224,7 @@ const _filesStore = defineStore('files', () => {
 				signers: requestSigners,
 				visibleElements: requestVisibleElements,
 				status,
-				signatureFlow: flowValue,
+				...(flowValue !== null && flowValue !== undefined ? { signatureFlow: flowValue } : {}),
 			},
 		}
 
diff --git a/src/store/policies.ts b/src/store/policies.ts
new file mode 100644
index 0000000000..a8243f6aed
--- /dev/null
+++ b/src/store/policies.ts
@@ -0,0 +1,325 @@
+/**
+ * SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+import { defineStore } from 'pinia'
+import { computed, ref } from 'vue'
+
+import axios from '@nextcloud/axios'
+import { loadState } from '@nextcloud/initial-state'
+import { generateOcsUrl } from '@nextcloud/router'
+
+import type {
+	EffectivePolicyState,
+	EffectivePolicyValue,
+	EffectivePoliciesResponse,
+	EffectivePoliciesState,
+	GroupPolicyResponse,
+	GroupPolicyState,
+	GroupPolicyWritePayload,
+	GroupPolicyWriteResponse,
+	SystemPolicyWritePayload,
+	SystemPolicyResponse,
+	SystemPolicyState,
+	SystemPolicyWriteResponse,
+	UserPolicyResponse,
+	UserPolicyState,
+} from '../types/index'
+
+function isEffectivePolicyState(value: unknown): value is EffectivePolicyState {
+	if (typeof value !== 'object' || value === null) {
+		return false
+	}
+
+	const candidate = value as Partial<EffectivePolicyState>
+	return typeof candidate.policyKey === 'string'
+		&& Array.isArray(candidate.allowedValues)
+		&& typeof candidate.sourceScope === 'string'
+		&& typeof candidate.visible === 'boolean'
+		&& typeof candidate.editableByCurrentActor === 'boolean'
+		&& typeof candidate.canSaveAsUserDefault === 'boolean'
+		&& typeof candidate.canUseAsRequestOverride === 'boolean'
+		&& typeof candidate.preferenceWasCleared === 'boolean'
+		&& (candidate.blockedBy === null || typeof candidate.blockedBy === 'string')
+}
+
+function isGroupPolicyState(value: unknown): value is GroupPolicyState {
+	if (typeof value !== 'object' || value === null) {
+		return false
+	}
+
+	const candidate = value as Partial<GroupPolicyState>
+	return typeof candidate.policyKey === 'string'
+		&& candidate.scope === 'group'
+		&& typeof candidate.targetId === 'string'
+		&& typeof candidate.allowChildOverride === 'boolean'
+		&& typeof candidate.visibleToChild === 'boolean'
+		&& Array.isArray(candidate.allowedValues)
+}
+
+function isSystemPolicyState(value: unknown): value is SystemPolicyState {
+	if (typeof value !== 'object' || value === null) {
+		return false
+	}
+
+	const candidate = value as Partial<SystemPolicyState>
+	return typeof candidate.policyKey === 'string'
+		&& (candidate.scope === 'system' || candidate.scope === 'global')
+		&& typeof candidate.allowChildOverride === 'boolean'
+		&& typeof candidate.visibleToChild === 'boolean'
+		&& Array.isArray(candidate.allowedValues)
+}
+
+function isUserPolicyState(value: unknown): value is UserPolicyState {
+	if (typeof value !== 'object' || value === null) {
+		return false
+	}
+
+	const candidate = value as Partial<UserPolicyState>
+	return typeof candidate.policyKey === 'string'
+		&& candidate.scope === 'user'
+		&& typeof candidate.targetId === 'string'
+}
+
+function sanitizePolicies(rawPolicies: Record<string, unknown>): EffectivePoliciesState {
+	const nextPolicies: EffectivePoliciesState = {}
+
+	for (const [policyKey, candidate] of Object.entries(rawPolicies)) {
+		if (isEffectivePolicyState(candidate)) {
+			nextPolicies[policyKey] = candidate
+		}
+	}
+
+	return nextPolicies
+}
+
+const _policiesStore = defineStore('policies', () => {
+	const initialPolicies = loadState<EffectivePoliciesResponse>('libresign', 'effective_policies', { policies: {} })
+	const policies = ref<EffectivePoliciesState>(sanitizePolicies(initialPolicies.policies ?? {}))
+
+	const setPolicies = (nextPolicies: Record<string, unknown>): void => {
+		policies.value = sanitizePolicies(nextPolicies)
+	}
+
+	const fetchEffectivePolicies = async (): Promise<void> => {
+		try {
+			const response = await axios.get<{ ocs?: { data?: EffectivePoliciesResponse } }>(generateOcsUrl('/apps/libresign/api/v1/policies/effective'))
+			setPolicies(response.data?.ocs?.data?.policies ?? {})
+		} catch (error: unknown) {
+			console.error('Failed to load effective policies', error)
+		}
+	}
+
+	const saveSystemPolicy = async (
+		policyKey: string,
+		value: EffectivePolicyValue,
+		allowChildOverride?: boolean,
+	): Promise<EffectivePolicyState | null> => {
+		const payload: SystemPolicyWritePayload & { allowChildOverride?: boolean } = { value }
+		if (typeof allowChildOverride === 'boolean') {
+			payload.allowChildOverride = allowChildOverride
+		}
+		const response = await axios.post<{ ocs?: { data?: SystemPolicyWriteResponse } }>(
+			generateOcsUrl(`/apps/libresign/api/v1/policies/system/${policyKey}`),
+			payload,
+		)
+
+		const savedPolicy = response.data?.ocs?.data?.policy
+		if (!isEffectivePolicyState(savedPolicy)) {
+			return null
+		}
+
+		policies.value = {
+			...policies.value,
+			[policyKey]: savedPolicy,
+		}
+
+		return savedPolicy
+	}
+
+	const fetchGroupPolicy = async (groupId: string, policyKey: string): Promise<GroupPolicyState | null> => {
+		const response = await axios.get<{ ocs?: { data?: GroupPolicyResponse } }>(
+			generateOcsUrl(`/apps/libresign/api/v1/policies/group/${groupId}/${policyKey}`),
+		)
+
+		const policy = response.data?.ocs?.data?.policy
+		if (!isGroupPolicyState(policy)) {
+			return null
+		}
+
+		return policy
+	}
+
+	const fetchSystemPolicy = async (policyKey: string): Promise<SystemPolicyState | null> => {
+		const response = await axios.get<{ ocs?: { data?: SystemPolicyResponse } }>(
+			generateOcsUrl(`/apps/libresign/api/v1/policies/system/${policyKey}`),
+		)
+
+		const policy = response.data?.ocs?.data?.policy
+		if (!isSystemPolicyState(policy)) {
+			return null
+		}
+
+		return policy
+	}
+
+	const fetchUserPolicyForUser = async (userId: string, policyKey: string): Promise<UserPolicyState | null> => {
+		const response = await axios.get<{ ocs?: { data?: UserPolicyResponse } }>(
+			generateOcsUrl(`/apps/libresign/api/v1/policies/user/${userId}/${policyKey}`),
+		)
+
+		const policy = response.data?.ocs?.data?.policy
+		if (!isUserPolicyState(policy)) {
+			return null
+		}
+
+		return policy
+	}
+
+	const saveGroupPolicy = async (
+		groupId: string,
+		policyKey: string,
+		value: EffectivePolicyValue,
+		allowChildOverride: boolean,
+	): Promise<GroupPolicyState | null> => {
+		const payload: GroupPolicyWritePayload = { value, allowChildOverride }
+		const response = await axios.put<{ ocs?: { data?: GroupPolicyWriteResponse } }>(
+			generateOcsUrl(`/apps/libresign/api/v1/policies/group/${groupId}/${policyKey}`),
+			payload,
+		)
+
+		const policy = response.data?.ocs?.data?.policy
+		if (!isGroupPolicyState(policy)) {
+			return null
+		}
+
+		return policy
+	}
+
+	const clearGroupPolicy = async (groupId: string, policyKey: string): Promise<GroupPolicyState | null> => {
+		const response = await axios.delete<{ ocs?: { data?: GroupPolicyWriteResponse } }>(
+			generateOcsUrl(`/apps/libresign/api/v1/policies/group/${groupId}/${policyKey}`),
+		)
+
+		const policy = response.data?.ocs?.data?.policy
+		if (!isGroupPolicyState(policy)) {
+			return null
+		}
+
+		return policy
+	}
+
+	const saveUserPreference = async (policyKey: string, value: EffectivePolicyValue): Promise<EffectivePolicyState | null> => {
+		const payload: SystemPolicyWritePayload = { value }
+		const response = await axios.put<{ ocs?: { data?: SystemPolicyWriteResponse } }>(
+			generateOcsUrl(`/apps/libresign/api/v1/policies/user/${policyKey}`),
+			payload,
+		)
+
+		const savedPolicy = response.data?.ocs?.data?.policy
+		if (!isEffectivePolicyState(savedPolicy)) {
+			return null
+		}
+
+		policies.value = {
+			...policies.value,
+			[policyKey]: savedPolicy,
+		}
+
+		return savedPolicy
+	}
+
+	const clearUserPreference = async (policyKey: string): Promise<EffectivePolicyState | null> => {
+		const response = await axios.delete<{ ocs?: { data?: SystemPolicyWriteResponse } }>(
+			generateOcsUrl(`/apps/libresign/api/v1/policies/user/${policyKey}`),
+		)
+
+		const savedPolicy = response.data?.ocs?.data?.policy
+		if (!isEffectivePolicyState(savedPolicy)) {
+			return null
+		}
+
+		policies.value = {
+			...policies.value,
+			[policyKey]: savedPolicy,
+		}
+
+		return savedPolicy
+	}
+
+	const saveUserPolicyForUser = async (userId: string, policyKey: string, value: EffectivePolicyValue): Promise<UserPolicyState | null> => {
+		const payload: SystemPolicyWritePayload = { value }
+		const response = await axios.put<{ ocs?: { data?: UserPolicyResponse } }>(
+			generateOcsUrl(`/apps/libresign/api/v1/policies/user/${userId}/${policyKey}`),
+			payload,
+		)
+
+		const savedPolicy = response.data?.ocs?.data?.policy
+		if (!isUserPolicyState(savedPolicy)) {
+			return null
+		}
+
+		return savedPolicy
+	}
+
+	const clearUserPolicyForUser = async (userId: string, policyKey: string): Promise<UserPolicyState | null> => {
+		const response = await axios.delete<{ ocs?: { data?: UserPolicyResponse } }>(
+			generateOcsUrl(`/apps/libresign/api/v1/policies/user/${userId}/${policyKey}`),
+		)
+
+		const savedPolicy = response.data?.ocs?.data?.policy
+		if (!isUserPolicyState(savedPolicy)) {
+			return null
+		}
+
+		return savedPolicy
+	}
+
+	const getPolicy = (policyKey: string): EffectivePolicyState | null => {
+		const policy = policies.value[policyKey]
+		if (!policy) {
+			return null
+		}
+
+		return policy
+	}
+
+	const getEffectiveValue = (policyKey: string): EffectivePolicyState['effectiveValue'] | null => {
+		return getPolicy(policyKey)?.effectiveValue ?? null
+	}
+
+	const canUseRequestOverride = (policyKey: string): boolean => {
+		return getPolicy(policyKey)?.canUseAsRequestOverride ?? true
+	}
+
+	return {
+		policies: computed(() => policies.value),
+		setPolicies,
+		fetchEffectivePolicies,
+		fetchGroupPolicy,
+		fetchSystemPolicy,
+		fetchUserPolicyForUser,
+		saveSystemPolicy,
+		saveGroupPolicy,
+		clearGroupPolicy,
+		saveUserPreference,
+		clearUserPreference,
+		saveUserPolicyForUser,
+		clearUserPolicyForUser,
+		getPolicy,
+		getEffectiveValue,
+		canUseRequestOverride,
+	}
+})
+
+export const usePoliciesStore = function(...args: Parameters<typeof _policiesStore>) {
+	return _policiesStore(...args)
+}
+
+export {
+	isEffectivePolicyState,
+	isGroupPolicyState,
+	isSystemPolicyState,
+	isUserPolicyState,
+}
diff --git a/src/store/userconfig.js b/src/store/userconfig.js
index 5ebd054119..c577188c33 100644
--- a/src/store/userconfig.js
+++ b/src/store/userconfig.js
@@ -14,6 +14,7 @@ import { generateOcsUrl } from '@nextcloud/router'
  * @typedef {Record<string, unknown> & {
  * 	locale?: string
  * 	files_list_grid_view?: boolean
+ * 	policy_workbench_catalog_compact_view?: boolean
  * 	files_list_signer_identify_tab?: string
  * 	crl_filters?: { serialNumber?: string, status?: string | null, owner?: string }
  * 	crl_sort?: { sortBy?: string | null, sortOrder?: 'ASC' | 'DESC' | null }
diff --git a/src/tests/App.spec.ts b/src/tests/App.spec.ts
index 218e3425c3..04165f4bcf 100644
--- a/src/tests/App.spec.ts
+++ b/src/tests/App.spec.ts
@@ -71,6 +71,28 @@ describe('App', () => {
 		expect(wrapper.find('.left-sidebar').exists()).toBe(true)
 	})
 
+	it('shows left sidebar on request route', () => {
+		routeState.path = '/f/request'
+		routeState.name = 'requestFiles'
+		routeState.matched = []
+
+		const wrapper = mount(App, {
+			global: {
+				stubs: {
+					NcContent: { template: '<div><slot /></div>' },
+					NcAppContent: { template: '<main><slot /></main>' },
+					NcEmptyContent: { template: '<div><slot /></div>' },
+					LeftSidebar: { name: 'LeftSidebar', template: '<aside class="left-sidebar" />' },
+					RightSidebar: true,
+					DefaultPageError: true,
+					RouterView: { template: '<div class="router-view" />' },
+				},
+			},
+		})
+
+		expect(wrapper.find('.left-sidebar').exists()).toBe(true)
+	})
+
 	it('hides left sidebar on incomplete setup routes', () => {
 		routeState.path = '/f/incomplete'
 		routeState.name = 'Incomplete'
diff --git a/src/tests/components/FooterTemplateEditor.spec.ts b/src/tests/components/FooterTemplateEditor.spec.ts
index 1f49ca0baf..3243fc726a 100644
--- a/src/tests/components/FooterTemplateEditor.spec.ts
+++ b/src/tests/components/FooterTemplateEditor.spec.ts
@@ -181,9 +181,9 @@ describe('FooterTemplateEditor.vue', () => {
 		const wrapper = createWrapper()
 		await flushPromises()
 
-		wrapper.vm.previewWidth = 700
+		wrapper.vm.previewWidth = 800
 		wrapper.vm.previewHeight = 150
-		wrapper.vm.resetDimensions()
+		await wrapper.vm.resetDimensions()
 
 		expect(wrapper.vm.previewWidth).toBe(wrapper.vm.DEFAULT_PREVIEW_WIDTH)
 		expect(wrapper.vm.previewHeight).toBe(wrapper.vm.DEFAULT_PREVIEW_HEIGHT)
diff --git a/src/tests/components/RightSidebar/RequestSignatureTab.spec.ts b/src/tests/components/RightSidebar/RequestSignatureTab.spec.ts
index 6ecbb9feee..f9e84ca961 100644
--- a/src/tests/components/RightSidebar/RequestSignatureTab.spec.ts
+++ b/src/tests/components/RightSidebar/RequestSignatureTab.spec.ts
@@ -4,12 +4,13 @@
  */
 
 import { beforeEach, describe, expect, it, vi } from 'vitest'
-import { shallowMount } from '@vue/test-utils'
+import { flushPromises, shallowMount } from '@vue/test-utils'
 import type { VueWrapper } from '@vue/test-utils'
 import { createPinia, setActivePinia } from 'pinia'
 import axios from '@nextcloud/axios'
 import { loadState } from '@nextcloud/initial-state'
 import type { useFilesStore as useFilesStoreType } from '../../../store/files.js'
+import { usePoliciesStore } from '../../../store/policies'
 import RequestSignatureTab from '../../../components/RightSidebar/RequestSignatureTab.vue'
 import { useFilesStore } from '../../../store/files.js'
 import { FILE_STATUS } from '../../../constants.js'
@@ -38,6 +39,24 @@ vi.mock('@nextcloud/initial-state', () => ({
 			}
 		}
 		if (key === 'can_request_sign') return true
+		if (key === 'effective_policies') {
+			return {
+				policies: {
+					signature_flow: {
+						policyKey: 'signature_flow',
+						effectiveValue: 'none',
+						sourceScope: 'system',
+						visible: true,
+						editableByCurrentActor: true,
+						allowedValues: ['none', 'parallel', 'ordered_numeric'],
+						canSaveAsUserDefault: true,
+						canUseAsRequestOverride: true,
+						preferenceWasCleared: false,
+						blockedBy: null,
+					},
+				},
+			}
+		}
 		return defaultValue
 	}),
 }))
@@ -63,6 +82,7 @@ vi.mock('@nextcloud/axios', () => ({
 	default: {
 		get: vi.fn(),
 		post: vi.fn(),
+		put: vi.fn(),
 		delete: vi.fn(),
 		patch: vi.fn(),
 	},
@@ -74,13 +94,41 @@ vi.mock('@nextcloud/router', () => ({
 }))
 
 vi.mock('@libresign/pdf-elements', () => ({
-	ensureWorkerReady: vi.fn(),
+	setWorkerPath: vi.fn(),
 }))
 
 describe('RequestSignatureTab - Critical Business Rules', () => {
 	let wrapper: VueWrapper<any>
 	let filesStore: ReturnType<typeof useFilesStoreType>
 
+	const createEffectivePoliciesResponse = (policyOverrides: Record<string, unknown> = {}) => ({
+		data: {
+			ocs: {
+				data: {
+					policies: {
+						signature_flow: {
+							policyKey: 'signature_flow',
+							effectiveValue: 'none',
+							sourceScope: 'system',
+							visible: true,
+							editableByCurrentActor: true,
+							allowedValues: ['none', 'parallel', 'ordered_numeric'],
+							canSaveAsUserDefault: true,
+							canUseAsRequestOverride: true,
+							preferenceWasCleared: false,
+							blockedBy: null,
+							...policyOverrides,
+						},
+					},
+				},
+			},
+		},
+	})
+
+	const createSignatureFlowPolicy = (policyOverrides: Record<string, unknown> = {}) => {
+		return createEffectivePoliciesResponse(policyOverrides).data.ocs.data.policies.signature_flow
+	}
+
 	const updateFile = async (patch: Record<string, unknown>) => {
 		const current = filesStore.files[1] || { id: 1 }
 		const hasSigners = Object.prototype.hasOwnProperty.call(patch, 'signers')
@@ -101,21 +149,24 @@ describe('RequestSignatureTab - Critical Business Rules', () => {
 	const updateMethods = async (methods: unknown[]) => {
 		await setVmState({ methods })
 	}
+	const updatePolicies = async (policyOverrides: Record<string, unknown>) => {
+		const policiesStore = usePoliciesStore()
+		policiesStore.setPolicies({
+			signature_flow: createSignatureFlowPolicy(policyOverrides),
+		})
+		await wrapper.vm.$nextTick()
+	}
 
 	beforeEach(async () => {
 		setActivePinia(createPinia())
 		generateUrlMock.mockClear()
-		vi.mocked(loadState).mockImplementation((app, key, defaultValue) => {
-			if (key === 'config') {
-				return {
-					'sign-elements': { 'is-available': true },
-					'identification_documents': { enabled: false },
-				}
+		vi.mocked(axios.get).mockImplementation(async (url: string) => {
+			if (url.includes('/apps/libresign/api/v1/policies/effective')) {
+				return createEffectivePoliciesResponse() as Awaited<ReturnType<typeof axios.get>>
 			}
-			if (key === 'can_request_sign') return true
-			return defaultValue
+
+			return { data: { ocs: { data: null } } } as Awaited<ReturnType<typeof axios.get>>
 		})
-		vi.mocked(axios.get).mockResolvedValue({ data: { ocs: { data: null } } } as Awaited<ReturnType<typeof axios.get>>)
 		filesStore = useFilesStore()
 
 		await filesStore.addFile({
@@ -158,6 +209,7 @@ describe('RequestSignatureTab - Critical Business Rules', () => {
 				},
 			},
 		}) as VueWrapper<any>
+		await flushPromises()
 	})
 
 	describe('RULE: showDocMdpWarning when DocMDP level prevents changes', () => {
@@ -278,6 +330,84 @@ describe('RequestSignatureTab - Critical Business Rules', () => {
 		})
 	})
 
+	describe('RULE: showRememberSignatureFlow only when signing order is meaningful', () => {
+		it('shows when document has multiple signers and user can save preference', async () => {
+			await updateFile({
+				status: FILE_STATUS.DRAFT,
+				signers: [
+					{ email: 'test1@example.com', signed: [] },
+					{ email: 'test2@example.com', signed: [] },
+				],
+			})
+
+			expect(wrapper.vm.showRememberSignatureFlow).toBe(true)
+		})
+
+		it('hides when document has only one signer', async () => {
+			await updateFile({
+				status: FILE_STATUS.DRAFT,
+				signers: [{ email: 'test@example.com', signed: [] }],
+			})
+
+			expect(wrapper.vm.showRememberSignatureFlow).toBe(false)
+		})
+
+		it('hides when user cannot save preference even with multiple signers', async () => {
+			await updateFile({
+				status: FILE_STATUS.DRAFT,
+				signers: [
+					{ email: 'test1@example.com', signed: [] },
+					{ email: 'test2@example.com', signed: [] },
+				],
+			})
+			await updatePolicies({ canSaveAsUserDefault: false })
+
+			expect(wrapper.vm.showRememberSignatureFlow).toBe(false)
+		})
+
+		it('hides when effective signature flow policy is fixed to parallel', async () => {
+			await updateFile({
+				status: FILE_STATUS.DRAFT,
+				signers: [
+					{ email: 'test1@example.com', signed: [] },
+					{ email: 'test2@example.com', signed: [] },
+				],
+			})
+			await updatePolicies({ effectiveValue: 'parallel', canUseAsRequestOverride: false })
+
+			expect(wrapper.vm.showPreserveOrder).toBe(false)
+			expect(wrapper.vm.showRememberSignatureFlow).toBe(false)
+		})
+
+		it('hides when effective signature flow policy is fixed to ordered_numeric', async () => {
+			await updateFile({
+				status: FILE_STATUS.DRAFT,
+				signers: [
+					{ email: 'test1@example.com', signed: [] },
+					{ email: 'test2@example.com', signed: [] },
+				],
+			})
+			await updatePolicies({ effectiveValue: 'ordered_numeric', canUseAsRequestOverride: false })
+
+			expect(wrapper.vm.showPreserveOrder).toBe(false)
+			expect(wrapper.vm.showRememberSignatureFlow).toBe(false)
+		})
+
+		it('keeps toggles available when ordered_numeric is only the default and request overrides are still allowed', async () => {
+			await updateFile({
+				status: FILE_STATUS.DRAFT,
+				signers: [
+					{ email: 'test1@example.com', signed: [] },
+					{ email: 'test2@example.com', signed: [] },
+				],
+			})
+			await updatePolicies({ effectiveValue: 'ordered_numeric', canUseAsRequestOverride: true })
+
+			expect(wrapper.vm.showPreserveOrder).toBe(true)
+			expect(wrapper.vm.showRememberSignatureFlow).toBe(true)
+		})
+	})
+
 	describe('RULE: showViewOrderButton for ordered signatures', () => {
 		it('shows when signature flow is ordered_numeric', async () => {
 			await updateFile({
@@ -448,7 +578,7 @@ describe('RequestSignatureTab - Critical Business Rules', () => {
 		})
 
 		it('does not use stale sign_request_uuid from initial state when file has no signing UUIDs', async () => {
-			vi.mocked(loadState).mockImplementation((app, key, defaultValue) => {
+			vi.mocked(loadState).mockImplementation((_app: string, key: string, defaultValue: unknown) => {
 				if (key === 'sign_request_uuid') {
 					return 'stale-sign-request-uuid'
 				}
@@ -691,7 +821,59 @@ describe('RequestSignatureTab - Critical Business Rules', () => {
 		})
 	})
 
-	describe('RULE: signatureFlow calculation with admin override', () => {
+	describe('RULE: signatureFlow calculation with effective policy bootstrap', () => {
+		it('refreshes policy state from effective policies endpoint on mount', async () => {
+			wrapper.unmount()
+			vi.mocked(axios.get).mockImplementation(async (url: string) => {
+				if (url.includes('/apps/libresign/api/v1/policies/effective')) {
+					return createEffectivePoliciesResponse({
+						effectiveValue: 'ordered_numeric',
+						sourceScope: 'group',
+						canUseAsRequestOverride: false,
+						blockedBy: 'group',
+					}) as Awaited<ReturnType<typeof axios.get>>
+				}
+
+				return { data: { ocs: { data: null } } } as Awaited<ReturnType<typeof axios.get>>
+			})
+
+			wrapper = shallowMount(RequestSignatureTab, {
+				mocks: {
+					t: (_app: string, text: string) => text,
+				},
+				global: {
+					stubs: {
+						EnvelopeFilesList: { name: 'EnvelopeFilesList', template: '<div><slot /></div>' },
+						NcButton: true,
+						NcCheckboxRadioSwitch: true,
+						NcNoteCard: true,
+						NcActionInput: true,
+						NcActionButton: true,
+						NcFormBox: true,
+						NcLoadingIcon: true,
+						Signers: true,
+						SigningProgress: true,
+						AccountPlus: true,
+						ChartGantt: true,
+						FileMultiple: true,
+						Send: true,
+						Delete: true,
+						Bell: true,
+						Draw: true,
+						Pencil: true,
+						MessageText: true,
+						OrderNumericAscending: true,
+					},
+				},
+			}) as VueWrapper<any>
+
+			await flushPromises()
+
+			expect(wrapper.vm.signatureFlowPolicy.effectiveValue).toBe('ordered_numeric')
+			expect(wrapper.vm.signatureFlowPolicy.sourceScope).toBe('group')
+			expect(wrapper.vm.signatureFlowPolicy.canUseAsRequestOverride).toBe(false)
+		})
+
 		it('returns ordered_numeric when file flow is 2', async () => {
 			await updateFile({ signatureFlow: 2 })
 			expect(wrapper.vm.signatureFlow).toBe('ordered_numeric')
@@ -707,37 +889,67 @@ describe('RequestSignatureTab - Critical Business Rules', () => {
 			expect(wrapper.vm.signatureFlow).toBe('none')
 		})
 
-		it('uses admin flow when file flow is none', async () => {
-			await setVmState({ adminSignatureFlow: 'ordered_numeric' })
+		it('uses effective policy when file flow is none', async () => {
+			await updatePolicies({ effectiveValue: 'ordered_numeric' })
 			await updateFile({ signatureFlow: 'none' })
 			expect(wrapper.vm.signatureFlow).toBe('ordered_numeric')
 		})
 
-		it('defaults to parallel when both file and admin are none', async () => {
-			await setVmState({ adminSignatureFlow: 'none' })
+		it('uses fixed effective policy even when file flow was parallel', async () => {
+			await updatePolicies({ effectiveValue: 'ordered_numeric', canUseAsRequestOverride: false })
+			await updateFile({ signatureFlow: 'parallel' })
+			expect(wrapper.vm.signatureFlow).toBe('ordered_numeric')
+		})
+
+		it('uses fixed effective policy when value comes as object with flow', async () => {
+			await updatePolicies({ effectiveValue: { flow: 'ordered_numeric' }, canUseAsRequestOverride: false })
+			await updateFile({ signatureFlow: 'parallel' })
+			expect(wrapper.vm.signatureFlow).toBe('ordered_numeric')
+		})
+
+		it('keeps request-level file flow when policy defaults to ordered_numeric but still allows overrides', async () => {
+			await updatePolicies({ effectiveValue: 'ordered_numeric', canUseAsRequestOverride: true })
+			await updateFile({ signatureFlow: 'parallel' })
+			expect(wrapper.vm.signatureFlow).toBe('parallel')
+		})
+
+		it('defaults to parallel when both file and policy are none', async () => {
+			await updatePolicies({ effectiveValue: 'none' })
 			await updateFile({ signatureFlow: 'none' })
 			expect(wrapper.vm.signatureFlow).toBe('parallel')
 		})
 	})
 
 	describe('RULE: isAdminFlowForced detection', () => {
-		it('returns true when admin flow set to ordered_numeric', async () => {
-			await setVmState({ adminSignatureFlow: 'ordered_numeric' })
+		it('returns true when policy blocks request overrides', async () => {
+			await updatePolicies({ canUseAsRequestOverride: false })
 			expect(wrapper.vm.isAdminFlowForced).toBe(true)
 		})
 
-		it('returns true when admin flow set to parallel', async () => {
-			await setVmState({ adminSignatureFlow: 'parallel' })
-			expect(wrapper.vm.isAdminFlowForced).toBe(true)
+		it('returns false when policy allows request overrides', async () => {
+			await updatePolicies({ canUseAsRequestOverride: true })
+			expect(wrapper.vm.isAdminFlowForced).toBe(false)
 		})
 
-		it('returns false when admin flow is none', async () => {
-			await setVmState({ adminSignatureFlow: 'none' })
-			expect(wrapper.vm.isAdminFlowForced).toBe(false)
+		it('hides preserve order switch when policy forces flow', async () => {
+			await updatePolicies({
+				canUseAsRequestOverride: false,
+				effectiveValue: 'ordered_numeric',
+			})
+			await updateFile({
+				signers: [
+					{ email: 'test1@example.com' },
+					{ email: 'test2@example.com' },
+				],
+			})
+			expect(wrapper.vm.showPreserveOrder).toBe(false)
 		})
 
-		it('hides preserve order switch when admin forces flow', async () => {
-			await setVmState({ adminSignatureFlow: 'ordered_numeric' })
+		it('hides preserve order switch when fixed policy comes as object with flow', async () => {
+			await updatePolicies({
+				canUseAsRequestOverride: false,
+				effectiveValue: { flow: 'ordered_numeric' },
+			})
 			await updateFile({
 				signers: [
 					{ email: 'test1@example.com' },
@@ -904,6 +1116,43 @@ describe('RequestSignatureTab - Critical Business Rules', () => {
 			expect(filesStore.files[1].signatureFlow).toBe('ordered_numeric')
 		})
 
+			it('persists user preference when remember choice is enabled', async () => {
+				vi.mocked(axios.put).mockResolvedValue({
+					data: {
+						ocs: {
+							data: {
+								policy: createSignatureFlowPolicy({
+									effectiveValue: 'ordered_numeric',
+									sourceScope: 'user',
+									canSaveAsUserDefault: true,
+									canUseAsRequestOverride: true,
+								}),
+							},
+						},
+					},
+				})
+				await updatePolicies({
+					canSaveAsUserDefault: true,
+					canUseAsRequestOverride: true,
+				})
+				await updateFile({
+					signatureFlow: 'parallel',
+					signers: [
+						{ email: 'signer1@example.com', signed: [] },
+						{ email: 'signer2@example.com', signed: [] },
+					],
+				})
+
+				wrapper.vm.rememberSignatureFlow = true
+				wrapper.vm.onPreserveOrderChange(true)
+				await flushPromises()
+
+				expect(axios.put).toHaveBeenCalledWith(
+					'/ocs/apps/libresign/api/v1/policies/user/signature_flow',
+					{ value: 'ordered_numeric' },
+				)
+			})
+
 		it('assigns sequential orders when enabling', async () => {
 			await updateFile({
 				signatureFlow: 'parallel',
@@ -936,7 +1185,10 @@ describe('RequestSignatureTab - Critical Business Rules', () => {
 		})
 
 		it('reverts to parallel when disabling', async () => {
-			await setVmState({ adminSignatureFlow: 'none' })
+			await updatePolicies({
+				effectiveValue: 'none',
+				canUseAsRequestOverride: true,
+			})
 			await updateFile({
 				signatureFlow: 'ordered_numeric',
 				signers: [
@@ -949,7 +1201,10 @@ describe('RequestSignatureTab - Critical Business Rules', () => {
 		})
 
 		it('preserves admin flow when disabling user preference', async () => {
-			await setVmState({ adminSignatureFlow: 'ordered_numeric' })
+			await updatePolicies({
+				effectiveValue: 'ordered_numeric',
+				canUseAsRequestOverride: false,
+			})
 			await updateFile({
 				signatureFlow: 'ordered_numeric',
 				signers: [
@@ -982,11 +1237,35 @@ describe('RequestSignatureTab - Critical Business Rules', () => {
 		})
 
 		it('disables preserve order when admin forces flow', async () => {
-			await setVmState({ adminSignatureFlow: 'ordered_numeric' })
+			await updatePolicies({
+				effectiveValue: 'ordered_numeric',
+				canUseAsRequestOverride: false,
+			})
 			await updateFile({ signatureFlow: 'ordered_numeric' })
 			wrapper.vm.syncPreserveOrderWithFile()
 			expect(wrapper.vm.preserveOrder).toBe(false)
 		})
+
+		it('synchronizes stale draft flow and signing orders when policy locks ordered_numeric', async () => {
+			await updatePolicies({
+				effectiveValue: 'ordered_numeric',
+				canUseAsRequestOverride: false,
+			})
+			await updateFile({
+				signatureFlow: 'parallel',
+				signers: [
+					{ email: 'signer1@example.com', signed: [], signingOrder: 1 },
+					{ email: 'signer2@example.com', signed: [], signingOrder: 1 },
+				],
+			})
+
+			wrapper.vm.syncFileSignatureFlowWithPolicy()
+
+			const syncedFile = filesStore.getEditableFile()
+			expect(syncedFile.signatureFlow).toBe('ordered_numeric')
+			expect(syncedFile.signers?.[0]?.signingOrder).toBe(1)
+			expect(syncedFile.signers?.[1]?.signingOrder).toBe(2)
+		})
 	})
 
 	describe('RULE: updateSigningOrder and sort signers', () => {
diff --git a/src/tests/components/Settings/Settings.spec.ts b/src/tests/components/Settings/Settings.spec.ts
index d139d13a59..d11f919e6d 100644
--- a/src/tests/components/Settings/Settings.spec.ts
+++ b/src/tests/components/Settings/Settings.spec.ts
@@ -11,12 +11,15 @@ import type { TranslationFunction } from '../../test-types'
 
 type SettingsComponent = typeof import('../../../components/Settings/Settings.vue').default
 type AuthModule = typeof import('@nextcloud/auth')
+type InitialStateModule = typeof import('@nextcloud/initial-state')
 
 const t: TranslationFunction = (_app, text) => text
 
 let Settings: SettingsComponent
 let auth: AuthModule
+let initialState: InitialStateModule
 let getCurrentUserMock: MockedFunction<typeof import('@nextcloud/auth').getCurrentUser>
+let loadStateMock: MockedFunction<typeof import('@nextcloud/initial-state').loadState>
 
 type SettingsVm = {
 	getAdminRoute: () => string
@@ -33,13 +36,18 @@ vi.mock('@nextcloud/auth', () => ({
 	})),
 }))
 vi.mock('@nextcloud/l10n', () => globalThis.mockNextcloudL10n())
+vi.mock('@nextcloud/initial-state', () => ({
+	loadState: vi.fn((app, key, defaults) => defaults),
+}))
 vi.mock('@nextcloud/router', () => ({
 	generateUrl: vi.fn((url) => `/admin/${url}`),
 }))
 
 beforeAll(async () => {
 	auth = await import('@nextcloud/auth')
+	initialState = await import('@nextcloud/initial-state')
 	getCurrentUserMock = auth.getCurrentUser as MockedFunction<typeof auth.getCurrentUser>
+	loadStateMock = initialState.loadState as MockedFunction<typeof initialState.loadState>
 	;({ default: Settings } = await import('../../../components/Settings/Settings.vue'))
 })
 
@@ -82,9 +90,18 @@ describe('Settings', () => {
 		return item
 	}
 
-	const createWrapper = (isAdmin = false): SettingsWrapper => {
+	const createWrapper = (isAdmin = false, canManagePolicies = false): SettingsWrapper => {
 		const user = { isAdmin } as ReturnType<typeof auth.getCurrentUser>
 		getCurrentUserMock.mockReturnValue(user)
+		loadStateMock.mockImplementation((app, key, defaults) => {
+			if (key === 'config') {
+				return {
+					...(defaults as Record<string, unknown>),
+					can_manage_group_policies: canManagePolicies,
+				}
+			}
+			return defaults
+		})
 
 		return mount(Settings, {
 			global: {
@@ -111,6 +128,7 @@ describe('Settings', () => {
 			wrapper = null
 		}
 		vi.clearAllMocks()
+		loadStateMock.mockImplementation((app, key, defaults) => defaults)
 	})
 
 	describe('RULE: Account navigation item always displays', () => {
@@ -301,8 +319,8 @@ describe('Settings', () => {
 			wrapper = createUnauthenticatedWrapper()
 			const items = getItems()
 
-			// Account + Rate = 2
-			expect(items.length).toBe(2)
+			// Account + Preferences + Rate = 3
+			expect(items.length).toBe(3)
 		})
 	})
 
@@ -311,16 +329,71 @@ describe('Settings', () => {
 			wrapper = createWrapper(false)
 			const items = getItems()
 
-			// Account + Rate = 2
-			expect(items.length).toBe(2)
+			// Account + Preferences + Rate = 3
+			expect(items.length).toBe(3)
 		})
 
 		it('shows 3 items for admin', () => {
 			wrapper = createWrapper(true)
 			const items = getItems()
 
-			// Account + Administration + Rate = 3
-			expect(items.length).toBe(3)
+			// Account + Preferences + Policies + Administration + Rate = 5
+			expect(items.length).toBe(5)
+		})
+	})
+
+	describe('RULE: Preferences item is always available inside the app', () => {
+		it('shows Preferences for non-admin users', () => {
+			wrapper = createWrapper(false)
+			const items = getItems()
+			const preferencesItem = expectItem(findItemByName(items, 'Preferences'))
+
+			expect(preferencesItem.props('to')).toEqual({ name: 'Preferences' })
+		})
+
+		it('shows Preferences for admin users', () => {
+			wrapper = createWrapper(true)
+			const items = getItems()
+			const preferencesItem = expectItem(findItemByName(items, 'Preferences'))
+
+			expect(preferencesItem).toBeTruthy()
+		})
+
+		it('renders the preferences icon', () => {
+			wrapper = createWrapper(false)
+
+			expect(getWrapper().find('.preferences-icon').exists()).toBe(true)
+		})
+	})
+
+	describe('RULE: Policies item follows policy-management capability in the app menu', () => {
+		it('hides Policies for non-admin users', () => {
+			wrapper = createWrapper(false)
+			const items = getItems()
+
+			expect(findItemByName(items, 'Policies')).toBeUndefined()
+		})
+
+		it('shows Policies for admin users', () => {
+			wrapper = createWrapper(true)
+			const items = getItems()
+			const policiesItem = expectItem(findItemByName(items, 'Policies'))
+
+			expect(policiesItem.props('to')).toEqual({ name: 'Policies' })
+		})
+
+		it('shows Policies for non-admin users with group policy capability', () => {
+			wrapper = createWrapper(false, true)
+			const items = getItems()
+			const policiesItem = expectItem(findItemByName(items, 'Policies'))
+
+			expect(policiesItem.props('to')).toEqual({ name: 'Policies' })
+		})
+
+		it('renders the policies icon for admin users', () => {
+			wrapper = createWrapper(true)
+
+			expect(getWrapper().find('.policies-icon').exists()).toBe(true)
 		})
 	})
 
@@ -350,6 +423,18 @@ describe('Settings', () => {
 			expect(adminItem.props('name')).toBeTruthy()
 			expect(adminItem.props('href')).toBeTruthy()
 		})
+
+		it('does not use fallback icon prop when custom icon slot is present', () => {
+			wrapper = createWrapper(true)
+			const items = getItems()
+			const preferencesItem = expectItem(findItemByName(items, 'Preferences'))
+			const policiesItem = expectItem(findItemByName(items, 'Policies'))
+			const adminItem = expectItem(findItemByName(items, 'Administration'))
+
+			expect(preferencesItem.props('icon')).toBeUndefined()
+			expect(policiesItem.props('icon')).toBeUndefined()
+			expect(adminItem.props('icon')).toBeUndefined()
+		})
 	})
 
 	describe('RULE: icons render correctly', () => {
@@ -397,7 +482,17 @@ describe('Settings', () => {
 			const items = getItems()
 			const secondItem = expectItemAt(items, 1)
 
-			expect(secondItem.props('name')).toContain('Administration')
+			expect(secondItem.props('name')).toContain('Preferences')
+		})
+
+		it('renders Policies before Administration for admin users', () => {
+			wrapper = createWrapper(true)
+			const items = getItems()
+			const thirdItem = expectItemAt(items, 2)
+			const fourthItem = expectItemAt(items, 3)
+
+			expect(thirdItem.props('name')).toContain('Policies')
+			expect(fourthItem.props('name')).toContain('Administration')
 		})
 
 		it('renders Rate last', async () => {
@@ -430,13 +525,15 @@ describe('Settings', () => {
 			wrapper = createWrapper(false)
 			const items = getItems()
 
-			expect(items).toHaveLength(2)
+			expect(items).toHaveLength(3)
 
 			const hasAccount = items.some(i => i.props('name')?.includes('Account'))
+			const hasPreferences = items.some(i => i.props('name')?.includes('Preferences'))
 			const hasRate = items.some(i => i.props('name')?.includes('Rate'))
 			const hasAdmin = items.some(i => i.props('name')?.includes('Administration'))
 
 			expect(hasAccount).toBe(true)
+			expect(hasPreferences).toBe(true)
 			expect(hasRate).toBe(true)
 			expect(hasAdmin).toBe(false)
 		})
@@ -445,16 +542,39 @@ describe('Settings', () => {
 			wrapper = createWrapper(true)
 			const items = getItems()
 
-			expect(items).toHaveLength(3)
+			expect(items).toHaveLength(5)
 
 			const hasAccount = items.some(i => i.props('name')?.includes('Account'))
+			const hasPreferences = items.some(i => i.props('name')?.includes('Preferences'))
+			const hasPolicies = items.some(i => i.props('name')?.includes('Policies'))
 			const hasRate = items.some(i => i.props('name')?.includes('Rate'))
 			const hasAdmin = items.some(i => i.props('name')?.includes('Administration'))
 
 			expect(hasAccount).toBe(true)
+			expect(hasPreferences).toBe(true)
+			expect(hasPolicies).toBe(true)
 			expect(hasRate).toBe(true)
 			expect(hasAdmin).toBe(true)
 		})
+
+		it('provides policies entry for group manager without global admin link', () => {
+			wrapper = createWrapper(false, true)
+			const items = getItems()
+
+			expect(items).toHaveLength(4)
+
+			const hasAccount = items.some(i => i.props('name')?.includes('Account'))
+			const hasPreferences = items.some(i => i.props('name')?.includes('Preferences'))
+			const hasPolicies = items.some(i => i.props('name')?.includes('Policies'))
+			const hasRate = items.some(i => i.props('name')?.includes('Rate'))
+			const hasAdmin = items.some(i => i.props('name')?.includes('Administration'))
+
+			expect(hasAccount).toBe(true)
+			expect(hasPreferences).toBe(true)
+			expect(hasPolicies).toBe(true)
+			expect(hasRate).toBe(true)
+			expect(hasAdmin).toBe(false)
+		})
 	})
 
 	describe('RULE: Account item icon configuration', () => {
diff --git a/src/tests/setup.js b/src/tests/setup.js
index 70b3c40f0c..7abdba9656 100644
--- a/src/tests/setup.js
+++ b/src/tests/setup.js
@@ -57,6 +57,13 @@ vi.mock('@nextcloud/vue/components/NcSelect', () => ({
 	},
 }))
 
+vi.mock('@nextcloud/vue/components/NcSelectUsers', () => ({
+	default: {
+		name: 'NcSelectUsers',
+		template: '<div></div>',
+	},
+}))
+
 
 vi.mock('@nextcloud/vue/components/NcRichText', () => ({
 	default: {
diff --git a/src/tests/store/files.spec.ts b/src/tests/store/files.spec.ts
index c7a1ec9416..52c5929bdf 100644
--- a/src/tests/store/files.spec.ts
+++ b/src/tests/store/files.spec.ts
@@ -10,6 +10,7 @@ import { createPinia, setActivePinia } from 'pinia'
 import axios from '@nextcloud/axios'
 import { emit } from '@nextcloud/event-bus'
 import { generateOCSResponse } from '../test-helpers'
+import { usePoliciesStore } from '../../store/policies'
 
 type AxiosMock = Mock & {
 	get: Mock
@@ -1227,6 +1228,41 @@ describe('files store - critical business rules', () => {
 			expect(config.data.file.settings).toEqual({ path: '/files/contract.pdf' })
 		})
 
+		it('omits signatureFlow when policy blocks request overrides', async () => {
+			const store = useFilesStore()
+			const policiesStore = usePoliciesStore()
+			policiesStore.setPolicies({
+				signature_flow: {
+					policyKey: 'signature_flow',
+					effectiveValue: 'ordered_numeric',
+					sourceScope: 'global',
+					visible: true,
+					editableByCurrentActor: false,
+					allowedValues: ['ordered_numeric'],
+					canSaveAsUserDefault: false,
+					canUseAsRequestOverride: false,
+					preferenceWasCleared: false,
+					blockedBy: 'global',
+				},
+			})
+			store.selectedFileId = 1
+			store.files[1] = {
+				id: 1,
+				nodeId: 99,
+				name: 'contract.pdf',
+				signatureFlow: 'ordered_numeric',
+				signers: [],
+			}
+			axiosMock.mockResolvedValue({
+				data: { ocs: { data: { id: 1, nodeId: 99, signatureFlow: 'ordered_numeric', signers: [] } } },
+			})
+
+			await store.saveOrUpdateSignatureRequest({ status: 1 })
+
+			const config = axiosMock.mock.calls[0][0]
+			expect(config.data.signatureFlow).toBeUndefined()
+		})
+
 		it('sorts ordered_numeric signers by signingOrder', async () => {
 			const store = useFilesStore()
 			store.selectedFileId = 1
diff --git a/src/tests/store/policies.spec.ts b/src/tests/store/policies.spec.ts
new file mode 100644
index 0000000000..c1027013d3
--- /dev/null
+++ b/src/tests/store/policies.spec.ts
@@ -0,0 +1,358 @@
+/*
+ * SPDX-FileCopyrightText: 2026 LibreSign contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { createPinia, setActivePinia } from 'pinia'
+import axios from '@nextcloud/axios'
+
+vi.mock('@nextcloud/axios', () => ({
+	default: {
+		get: vi.fn(),
+		post: vi.fn(),
+		put: vi.fn(),
+		delete: vi.fn(),
+	},
+}))
+
+vi.mock('@nextcloud/router', () => ({
+	generateOcsUrl: vi.fn((path: string) => `/ocs/v2.php${path}`),
+}))
+
+vi.mock('@nextcloud/initial-state', () => ({
+	loadState: vi.fn((_app, _key, defaultValue) => defaultValue),
+}))
+
+describe('policies store', () => {
+	beforeEach(() => {
+		setActivePinia(createPinia())
+		vi.clearAllMocks()
+	})
+
+	it('stores backend policy payload as provided', async () => {
+		vi.mocked(axios.get).mockResolvedValue({
+			data: {
+				ocs: {
+					data: {
+						policies: {
+							signature_flow: {
+								policyKey: 'signature_flow',
+								effectiveValue: 'banana',
+								allowedValues: ['parallel'],
+								sourceScope: 'system',
+								visible: true,
+								editableByCurrentActor: true,
+								canSaveAsUserDefault: true,
+								canUseAsRequestOverride: true,
+								preferenceWasCleared: false,
+								blockedBy: null,
+							},
+						},
+					},
+				},
+			},
+		})
+
+		const { usePoliciesStore } = await import('../../store/policies')
+		const store = usePoliciesStore()
+		await store.fetchEffectivePolicies()
+
+		expect(store.getPolicy('signature_flow')?.effectiveValue).toBe('banana')
+	})
+
+	it('replaces a policy with the latest backend payload', async () => {
+		vi.mocked(axios.get).mockResolvedValue({
+			data: {
+				ocs: {
+					data: {
+						policies: {
+							signature_flow: {
+								policyKey: 'signature_flow',
+								effectiveValue: 'ordered_numeric',
+								allowedValues: ['ordered_numeric'],
+								sourceScope: 'group',
+								visible: true,
+								editableByCurrentActor: false,
+								canSaveAsUserDefault: false,
+								canUseAsRequestOverride: false,
+								preferenceWasCleared: false,
+								blockedBy: 'group',
+							},
+						},
+					},
+				},
+			},
+		})
+
+		const { usePoliciesStore } = await import('../../store/policies')
+		const store = usePoliciesStore()
+		await store.fetchEffectivePolicies()
+
+		expect(store.getPolicy('signature_flow')?.effectiveValue).toBe('ordered_numeric')
+		expect(store.getPolicy('signature_flow')?.canUseAsRequestOverride).toBe(false)
+	})
+
+	it('saves a system policy through the generic endpoint', async () => {
+		vi.mocked(axios.post).mockResolvedValue({
+			data: {
+				ocs: {
+					data: {
+						policy: {
+							policyKey: 'signature_flow',
+							effectiveValue: 'ordered_numeric',
+							allowedValues: ['none', 'parallel', 'ordered_numeric'],
+							sourceScope: 'system',
+							visible: true,
+							editableByCurrentActor: true,
+							canSaveAsUserDefault: true,
+							canUseAsRequestOverride: false,
+							preferenceWasCleared: false,
+							blockedBy: null,
+						},
+					},
+				},
+			},
+		})
+
+		const { usePoliciesStore } = await import('../../store/policies')
+		const store = usePoliciesStore()
+		const policy = await store.saveSystemPolicy('signature_flow', 'ordered_numeric')
+
+		expect(axios.post).toHaveBeenCalledWith(
+			'/ocs/v2.php/apps/libresign/api/v1/policies/system/signature_flow',
+			{ value: 'ordered_numeric' },
+		)
+		expect(policy?.effectiveValue).toBe('ordered_numeric')
+		expect(store.getPolicy('signature_flow')?.sourceScope).toBe('system')
+	})
+
+	it('saves system allowChildOverride when provided', async () => {
+		vi.mocked(axios.post).mockResolvedValue({
+			data: {
+				ocs: {
+					data: {
+						policy: {
+							policyKey: 'signature_flow',
+							effectiveValue: 'ordered_numeric',
+							allowedValues: [],
+							sourceScope: 'system',
+							visible: true,
+							editableByCurrentActor: true,
+							canSaveAsUserDefault: true,
+							canUseAsRequestOverride: true,
+							preferenceWasCleared: false,
+							blockedBy: null,
+						},
+					},
+				},
+			},
+		})
+
+		const { usePoliciesStore } = await import('../../store/policies')
+		const store = usePoliciesStore()
+		await store.saveSystemPolicy('signature_flow', 'ordered_numeric', true)
+
+		expect(axios.post).toHaveBeenCalledWith(
+			'/ocs/v2.php/apps/libresign/api/v1/policies/system/signature_flow',
+			{ value: 'ordered_numeric', allowChildOverride: true },
+		)
+	})
+
+	it('saves a user preference through the generic endpoint', async () => {
+		vi.mocked(axios.put).mockResolvedValue({
+			data: {
+				ocs: {
+					data: {
+						policy: {
+							policyKey: 'signature_flow',
+							effectiveValue: 'parallel',
+							allowedValues: ['parallel', 'ordered_numeric'],
+							sourceScope: 'user',
+							visible: true,
+							editableByCurrentActor: true,
+							canSaveAsUserDefault: true,
+							canUseAsRequestOverride: true,
+							preferenceWasCleared: false,
+							blockedBy: null,
+						},
+					},
+				},
+			},
+		})
+
+		const { usePoliciesStore } = await import('../../store/policies')
+		const store = usePoliciesStore()
+		const policy = await store.saveUserPreference('signature_flow', 'parallel')
+
+		expect(axios.put).toHaveBeenCalledWith(
+			'/ocs/v2.php/apps/libresign/api/v1/policies/user/signature_flow',
+			{ value: 'parallel' },
+		)
+		expect(policy?.sourceScope).toBe('user')
+	})
+
+	it('loads a group policy through the generic endpoint', async () => {
+		vi.mocked(axios.get).mockResolvedValueOnce({
+			data: {
+				ocs: {
+					data: {
+						policy: {
+							policyKey: 'signature_flow',
+							scope: 'group',
+							targetId: 'finance',
+							value: 'parallel',
+							allowChildOverride: true,
+							visibleToChild: true,
+							allowedValues: [],
+						},
+					},
+				},
+			},
+		})
+
+		const { usePoliciesStore } = await import('../../store/policies')
+		const store = usePoliciesStore()
+		const policy = await store.fetchGroupPolicy('finance', 'signature_flow')
+
+		expect(axios.get).toHaveBeenCalledWith('/ocs/v2.php/apps/libresign/api/v1/policies/group/finance/signature_flow')
+		expect(policy?.targetId).toBe('finance')
+		expect(policy?.value).toBe('parallel')
+	})
+
+	it('loads an explicit system policy through the generic endpoint', async () => {
+		vi.mocked(axios.get).mockResolvedValueOnce({
+			data: {
+				ocs: {
+					data: {
+						policy: {
+							policyKey: 'signature_flow',
+							scope: 'global',
+							value: 'ordered_numeric',
+							allowChildOverride: false,
+							visibleToChild: true,
+							allowedValues: ['ordered_numeric'],
+						},
+					},
+				},
+			},
+		})
+
+		const { usePoliciesStore } = await import('../../store/policies')
+		const store = usePoliciesStore()
+		const policy = await store.fetchSystemPolicy('signature_flow')
+
+		expect(axios.get).toHaveBeenCalledWith('/ocs/v2.php/apps/libresign/api/v1/policies/system/signature_flow')
+		expect(policy?.scope).toBe('global')
+		expect(policy?.value).toBe('ordered_numeric')
+	})
+
+	it('loads a target user policy through the admin endpoint', async () => {
+		vi.mocked(axios.get).mockResolvedValueOnce({
+			data: {
+				ocs: {
+					data: {
+						policy: {
+							policyKey: 'signature_flow',
+							scope: 'user',
+							targetId: 'user1',
+							value: 'parallel',
+						},
+					},
+				},
+			},
+		})
+
+		const { usePoliciesStore } = await import('../../store/policies')
+		const store = usePoliciesStore()
+		const policy = await store.fetchUserPolicyForUser('user1', 'signature_flow')
+
+		expect(axios.get).toHaveBeenCalledWith('/ocs/v2.php/apps/libresign/api/v1/policies/user/user1/signature_flow')
+		expect(policy?.targetId).toBe('user1')
+		expect(policy?.value).toBe('parallel')
+	})
+
+	it('saves a group policy through the generic endpoint', async () => {
+		vi.mocked(axios.put).mockResolvedValueOnce({
+			data: {
+				ocs: {
+					data: {
+						policy: {
+							policyKey: 'signature_flow',
+							scope: 'group',
+							targetId: 'finance',
+							value: 'ordered_numeric',
+							allowChildOverride: false,
+							visibleToChild: true,
+							allowedValues: ['ordered_numeric'],
+						},
+					},
+				},
+			},
+		})
+
+		const { usePoliciesStore } = await import('../../store/policies')
+		const store = usePoliciesStore()
+		const policy = await store.saveGroupPolicy('finance', 'signature_flow', 'ordered_numeric', false)
+
+		expect(axios.put).toHaveBeenCalledWith(
+			'/ocs/v2.php/apps/libresign/api/v1/policies/group/finance/signature_flow',
+			{ value: 'ordered_numeric', allowChildOverride: false },
+		)
+		expect(policy?.value).toBe('ordered_numeric')
+		expect(policy?.allowChildOverride).toBe(false)
+	})
+
+	it('saves a user policy for a target user through the admin endpoint', async () => {
+		vi.mocked(axios.put).mockResolvedValueOnce({
+			data: {
+				ocs: {
+					data: {
+						policy: {
+							policyKey: 'signature_flow',
+							scope: 'user',
+							targetId: 'user1',
+							value: 'ordered_numeric',
+						},
+					},
+				},
+			},
+		})
+
+		const { usePoliciesStore } = await import('../../store/policies')
+		const store = usePoliciesStore()
+		const policy = await store.saveUserPolicyForUser('user1', 'signature_flow', 'ordered_numeric')
+
+		expect(axios.put).toHaveBeenCalledWith(
+			'/ocs/v2.php/apps/libresign/api/v1/policies/user/user1/signature_flow',
+			{ value: 'ordered_numeric' },
+		)
+		expect(policy?.scope).toBe('user')
+		expect(policy?.value).toBe('ordered_numeric')
+	})
+
+	it('clears a user policy for a target user through the admin endpoint', async () => {
+		vi.mocked(axios.delete).mockResolvedValueOnce({
+			data: {
+				ocs: {
+					data: {
+						policy: {
+							policyKey: 'signature_flow',
+							scope: 'user',
+							targetId: 'user1',
+							value: null,
+						},
+					},
+				},
+			},
+		})
+
+		const { usePoliciesStore } = await import('../../store/policies')
+		const store = usePoliciesStore()
+		const policy = await store.clearUserPolicyForUser('user1', 'signature_flow')
+
+		expect(axios.delete).toHaveBeenCalledWith('/ocs/v2.php/apps/libresign/api/v1/policies/user/user1/signature_flow')
+		expect(policy?.scope).toBe('user')
+		expect(policy?.value).toBeNull()
+	})
+})
diff --git a/src/tests/views/Preferences/Preferences.spec.ts b/src/tests/views/Preferences/Preferences.spec.ts
new file mode 100644
index 0000000000..e6790414c8
--- /dev/null
+++ b/src/tests/views/Preferences/Preferences.spec.ts
@@ -0,0 +1,148 @@
+/**
+ * SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { mount } from '@vue/test-utils'
+import { defineComponent, nextTick } from 'vue'
+
+import type { EffectivePolicyState, SignatureFlowMode } from '../../../types/index'
+import { createL10nMock } from '../../testHelpers/l10n.js'
+
+const fetchEffectivePoliciesMock = vi.fn()
+const saveUserPreferenceMock = vi.fn()
+const clearUserPreferenceMock = vi.fn()
+const getPolicyMock = vi.fn<() => EffectivePolicyState | null>()
+
+vi.mock('@nextcloud/l10n', () => createL10nMock())
+
+vi.mock('../../../store/policies', () => ({
+	usePoliciesStore: () => ({
+		fetchEffectivePolicies: fetchEffectivePoliciesMock,
+		saveUserPreference: saveUserPreferenceMock,
+		clearUserPreference: clearUserPreferenceMock,
+		getPolicy: getPolicyMock,
+	}),
+}))
+
+const NcSettingsSection = defineComponent({
+	name: 'NcSettingsSection',
+	props: ['name', 'description'],
+	template: '<section><h2>{{ name }}</h2><p>{{ description }}</p><slot /></section>',
+})
+
+const NcNoteCard = defineComponent({
+	name: 'NcNoteCard',
+	props: ['type'],
+	template: '<div class="note-card"><slot /></div>',
+})
+
+const NcCheckboxRadioSwitch = defineComponent({
+	name: 'NcCheckboxRadioSwitch',
+	props: ['value', 'modelValue', 'type', 'disabled', 'name'],
+	emits: ['update:modelValue'],
+	template: '<label class="switch"><slot /></label>',
+})
+
+const NcButton = defineComponent({
+	name: 'NcButton',
+	props: ['type', 'disabled'],
+	emits: ['click'],
+	template: '<button :disabled="disabled" @click="$emit(\'click\')"><slot /></button>',
+})
+
+describe('Preferences view', () => {
+	beforeEach(() => {
+		fetchEffectivePoliciesMock.mockReset().mockResolvedValue(undefined)
+		saveUserPreferenceMock.mockReset().mockResolvedValue(undefined)
+		clearUserPreferenceMock.mockReset().mockResolvedValue(undefined)
+		getPolicyMock.mockReset().mockReturnValue({
+			policyKey: 'signature_flow',
+			effectiveValue: 'parallel',
+			sourceScope: 'system',
+			visible: true,
+			editableByCurrentActor: true,
+			allowedValues: ['parallel', 'ordered_numeric'],
+			blockedBy: null,
+			canSaveAsUserDefault: true,
+			canUseAsRequestOverride: true,
+			preferenceWasCleared: false,
+		})
+	})
+
+	async function createWrapper() {
+		const { default: Preferences } = await import('../../../views/Preferences/Preferences.vue')
+		return mount(Preferences, {
+			global: {
+				stubs: {
+					NcSettingsSection,
+					NcNoteCard,
+					NcCheckboxRadioSwitch,
+					NcButton,
+				},
+			},
+		})
+	}
+
+	it('loads effective policies on mount', async () => {
+		await createWrapper()
+
+		expect(fetchEffectivePoliciesMock).toHaveBeenCalledTimes(1)
+	})
+
+	it('shows the effective signing order summary', async () => {
+		const wrapper = await createWrapper()
+
+		expect(wrapper.text()).toContain('Effective signing order')
+		expect(wrapper.text()).toContain('Simultaneous (Parallel)')
+		expect(wrapper.text()).toContain('Global default')
+	})
+
+	it('saves a user preference when requested', async () => {
+		const wrapper = await createWrapper()
+
+		await wrapper.vm.savePreference('ordered_numeric' as SignatureFlowMode)
+
+		expect(saveUserPreferenceMock).toHaveBeenCalledWith('signature_flow', 'ordered_numeric')
+	})
+
+	it('clears a saved user preference', async () => {
+		getPolicyMock.mockReturnValue({
+			policyKey: 'signature_flow',
+			effectiveValue: 'ordered_numeric',
+			sourceScope: 'user',
+			visible: true,
+			editableByCurrentActor: true,
+			allowedValues: ['parallel', 'ordered_numeric'],
+			blockedBy: null,
+			canSaveAsUserDefault: true,
+			canUseAsRequestOverride: true,
+			preferenceWasCleared: false,
+		})
+		const wrapper = await createWrapper()
+
+		await wrapper.vm.clearPreference()
+
+		expect(clearUserPreferenceMock).toHaveBeenCalledWith('signature_flow')
+	})
+
+	it('shows an informational note when saving is blocked', async () => {
+		getPolicyMock.mockReturnValue({
+			policyKey: 'signature_flow',
+			effectiveValue: 'parallel',
+			sourceScope: 'group',
+			visible: true,
+			editableByCurrentActor: false,
+			allowedValues: ['parallel'],
+			blockedBy: 'group',
+			canSaveAsUserDefault: false,
+			canUseAsRequestOverride: false,
+			preferenceWasCleared: false,
+		})
+		const wrapper = await createWrapper()
+		await nextTick()
+
+		expect(wrapper.text()).toContain('does not allow saving a personal default')
+	})
+})
diff --git a/src/tests/views/Settings/DocMDP.spec.ts b/src/tests/views/Settings/DocMDP.spec.ts
deleted file mode 100644
index 6cb5055f53..0000000000
--- a/src/tests/views/Settings/DocMDP.spec.ts
+++ /dev/null
@@ -1,206 +0,0 @@
-/*
- * SPDX-FileCopyrightText: 2026 LibreSign contributors
- * SPDX-License-Identifier: AGPL-3.0-or-later
- */
-
-import { beforeAll, beforeEach, describe, expect, it, vi } from 'vitest'
-import { flushPromises, mount } from '@vue/test-utils'
-
-type DocMDPLevel = {
-	value: number
-	label: string
-	description: string
-}
-
-type DocMDPVm = {
-	enabled: boolean
-	selectedLevel?: DocMDPLevel
-	onEnabledChange: () => void
-}
-
-const loadStateMock = vi.fn()
-const generateOcsUrlMock = vi.fn((path: string) => path)
-const axiosPostMock = vi.fn((..._args: unknown[]) => Promise.resolve({ data: { ocs: { data: {} } } }))
-
-vi.mock('@nextcloud/initial-state', () => ({
-	loadState: (...args: unknown[]) => loadStateMock(...args),
-}))
-
-vi.mock('@nextcloud/router', () => ({
-	generateOcsUrl: (...args: unknown[]) => generateOcsUrlMock(...(args as [string])),
-}))
-
-vi.mock('@nextcloud/axios', () => ({
-	default: {
-		post: axiosPostMock,
-	},
-}))
-
-vi.mock('@nextcloud/l10n', () => globalThis.mockNextcloudL10n())
-
-let DocMDP: unknown
-
-const NcCheckboxRadioSwitchStub = {
-	name: 'NcCheckboxRadioSwitch',
-	props: ['modelValue', 'value', 'type'],
-	emits: ['update:modelValue'],
-	template: '<button class="checkbox-radio-switch-stub" @click="$emit(\'update:modelValue\', type === \'radio\' ? value : !modelValue)"><slot /></button>',
-}
-
-beforeAll(async () => {
-	;({ default: DocMDP } = await import('../../../views/Settings/DocMDP.vue'))
-})
-
-describe('DocMDP', () => {
-	beforeEach(() => {
-		loadStateMock.mockReset()
-		generateOcsUrlMock.mockClear()
-		axiosPostMock.mockClear()
-	})
-
-	it('uses typed backend config on load', async () => {
-		loadStateMock.mockImplementation((_app: string, key: string, fallback: unknown) => {
-			if (key === 'docmdp_config') {
-				return {
-					enabled: false,
-					defaultLevel: 2,
-					availableLevels: [
-						{ value: 1, label: 'L1', description: 'D1' },
-						{ value: 2, label: 'L2', description: 'D2' },
-					],
-				}
-			}
-			return fallback
-		})
-
-		const wrapper = mount(DocMDP as never, {
-			global: {
-				stubs: {
-					NcSettingsSection: { template: '<div><slot /></div>' },
-					NcCheckboxRadioSwitch: NcCheckboxRadioSwitchStub,
-					NcLoadingIcon: true,
-					NcNoteCard: true,
-					NcSavingIndicatorIcon: true,
-				},
-			},
-		})
-		const vm = wrapper.vm as unknown as DocMDPVm
-		await flushPromises()
-
-		expect(vm.enabled).toBe(false)
-		expect(vm.selectedLevel?.value).toBe(2)
-	})
-
-	it('respects backend default config when storage is empty', async () => {
-		loadStateMock.mockImplementation((_app: string, key: string, fallback: unknown) => {
-			if (key === 'docmdp_config') {
-				return {
-					enabled: true,
-					defaultLevel: 2,
-					availableLevels: [
-						{ value: 0, label: 'L0', description: 'D0' },
-						{ value: 1, label: 'L1', description: 'D1' },
-						{ value: 2, label: 'L2', description: 'D2' },
-					],
-				}
-			}
-			return fallback
-		})
-
-		const wrapper = mount(DocMDP as never, {
-			global: {
-				stubs: {
-					NcSettingsSection: { template: '<div><slot /></div>' },
-					NcCheckboxRadioSwitch: NcCheckboxRadioSwitchStub,
-					NcLoadingIcon: true,
-					NcNoteCard: true,
-					NcSavingIndicatorIcon: true,
-				},
-			},
-		})
-		const vm = wrapper.vm as unknown as DocMDPVm
-		await flushPromises()
-
-		expect(vm.enabled).toBe(true)
-		expect(vm.selectedLevel?.value).toBe(2)
-	})
-
-	it('changes selected level and persists selected radio value', async () => {
-		loadStateMock.mockImplementation((_app: string, key: string, fallback: unknown) => {
-			if (key === 'docmdp_config') {
-				return {
-					enabled: true,
-					defaultLevel: 1,
-					availableLevels: [
-						{ value: 1, label: 'L1', description: 'D1' },
-						{ value: 2, label: 'L2', description: 'D2' },
-						{ value: 3, label: 'L3', description: 'D3' },
-					],
-				}
-			}
-			return fallback
-		})
-
-		const wrapper = mount(DocMDP as never, {
-			global: {
-				stubs: {
-					NcSettingsSection: { template: '<div><slot /></div>' },
-					NcCheckboxRadioSwitch: NcCheckboxRadioSwitchStub,
-					NcLoadingIcon: true,
-					NcNoteCard: true,
-					NcSavingIndicatorIcon: true,
-				},
-			},
-		})
-		const vm = wrapper.vm as unknown as DocMDPVm
-		await flushPromises()
-
-		const radioAndSwitchButtons = wrapper.findAll('.checkbox-radio-switch-stub')
-		await radioAndSwitchButtons[3].trigger('click')
-		await flushPromises()
-
-		expect(vm.selectedLevel?.value).toBe(3)
-		expect(axiosPostMock).toHaveBeenCalled()
-		const lastCall = axiosPostMock.mock.calls[axiosPostMock.mock.calls.length - 1] as [string, { enabled: boolean, defaultLevel: number }]
-		expect(lastCall[1].defaultLevel).toBe(3)
-	})
-
-	it('uses preferred level 2 when enabling without explicit selected level', async () => {
-		loadStateMock.mockImplementation((_app: string, key: string, fallback: unknown) => {
-			if (key === 'docmdp_config') {
-				return {
-					enabled: false,
-					defaultLevel: 2,
-					availableLevels: [
-						{ value: 0, label: 'L0', description: 'D0' },
-						{ value: 1, label: 'L1', description: 'D1' },
-						{ value: 2, label: 'L2', description: 'D2' },
-					],
-				}
-			}
-			return fallback
-		})
-
-		const wrapper = mount(DocMDP as never, {
-			global: {
-				stubs: {
-					NcSettingsSection: { template: '<div><slot /></div>' },
-					NcCheckboxRadioSwitch: NcCheckboxRadioSwitchStub,
-					NcLoadingIcon: true,
-					NcNoteCard: true,
-					NcSavingIndicatorIcon: true,
-				},
-			},
-		})
-		const vm = wrapper.vm as unknown as DocMDPVm
-		await flushPromises()
-
-		expect(vm.selectedLevel?.value).toBe(2)
-		vm.enabled = true
-		vm.onEnabledChange()
-		await flushPromises()
-
-		const lastCall = axiosPostMock.mock.calls[axiosPostMock.mock.calls.length - 1] as [string, { enabled: boolean, defaultLevel: number }]
-		expect(lastCall[1]).toMatchObject({ enabled: true, defaultLevel: 2 })
-	})
-})
diff --git a/src/tests/views/Settings/PolicyWorkbench/SignatureFlowScalarRuleEditor.spec.ts b/src/tests/views/Settings/PolicyWorkbench/SignatureFlowScalarRuleEditor.spec.ts
new file mode 100644
index 0000000000..da62408cd5
--- /dev/null
+++ b/src/tests/views/Settings/PolicyWorkbench/SignatureFlowScalarRuleEditor.spec.ts
@@ -0,0 +1,112 @@
+/*
+ * SPDX-FileCopyrightText: 2026 LibreSign contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+import { mount } from '@vue/test-utils'
+import { describe, expect, it, vi } from 'vitest'
+
+import { createL10nMock } from '../../../testHelpers/l10n.js'
+
+vi.mock('@nextcloud/l10n', () => createL10nMock())
+
+import SignatureFlowScalarRuleEditor from '../../../../views/Settings/PolicyWorkbench/settings/signature-flow/SignatureFlowScalarRuleEditor.vue'
+
+describe('SignatureFlowScalarRuleEditor.vue', () => {
+	it('shows three explicit options and emits the selected scalar value', async () => {
+		const wrapper = mount(SignatureFlowScalarRuleEditor, {
+			props: {
+				modelValue: 'parallel',
+			},
+			global: {
+				stubs: {
+					NcCheckboxRadioSwitch: {
+						template: '<div class="switch" @click="$emit(\'update:modelValue\', true)"><slot /></div>',
+					},
+				},
+			},
+		})
+
+		expect(wrapper.text()).toContain('Simultaneous (Parallel)')
+		expect(wrapper.text()).toContain('Sequential')
+		expect(wrapper.text()).toContain('User choice')
+		expect(wrapper.text()).toContain('Users can choose between simultaneous or sequential signing.')
+
+		const switches = wrapper.findAll('.switch')
+		expect(switches).toHaveLength(3)
+		await switches[2].trigger('click')
+
+		const emissions = wrapper.emitted('update:modelValue')
+		expect(emissions).toBeTruthy()
+		expect(emissions?.[0]?.[0]).toBe('none')
+	})
+
+	it('emits selected value even when radio update payload is omitted', async () => {
+		const wrapper = mount(SignatureFlowScalarRuleEditor, {
+			props: {
+				modelValue: 'parallel',
+			},
+			global: {
+				stubs: {
+					NcCheckboxRadioSwitch: {
+						template: '<div class="switch-no-payload" @click="$emit(\'update:modelValue\')"><slot /></div>',
+					},
+				},
+			},
+		})
+
+		const switches = wrapper.findAll('.switch-no-payload')
+		expect(switches).toHaveLength(3)
+		await switches[1].trigger('click')
+
+		const emissions = wrapper.emitted('update:modelValue')
+		expect(emissions).toBeTruthy()
+		expect(emissions?.[0]?.[0]).toBe('ordered_numeric')
+	})
+
+	it('starts with no option selected when draft value is empty', () => {
+		const wrapper = mount(SignatureFlowScalarRuleEditor, {
+			props: {
+				modelValue: '' as never,
+			},
+			global: {
+				stubs: {
+					NcCheckboxRadioSwitch: {
+						props: ['modelValue'],
+						template: "<div class='switch-state' :data-selected=\"modelValue ? 'true' : 'false'\"><slot /></div>",
+					},
+				},
+			},
+		})
+
+		const selectedStates = wrapper.findAll('.switch-state').map((node) => node.attributes('data-selected'))
+		expect(selectedStates).toEqual(['false', 'false', 'false'])
+	})
+
+	it('disables default option and shows helper copy for instance rule creation', async () => {
+		const wrapper = mount(SignatureFlowScalarRuleEditor, {
+			props: {
+				modelValue: 'none',
+				editorScope: 'system',
+				editorMode: 'create',
+			},
+			global: {
+				stubs: {
+					NcCheckboxRadioSwitch: {
+						props: ['disabled'],
+						template: '<div class="switch-disabled" :data-disabled="disabled ? \'true\' : \'false\'" @click="!disabled && $emit(\'update:modelValue\', true)"><slot /></div>',
+					},
+				},
+			},
+		})
+
+		expect(wrapper.text()).toContain('already matches the default')
+
+		const switches = wrapper.findAll('.switch-disabled')
+		expect(switches).toHaveLength(3)
+		expect(switches[2]?.attributes('data-disabled')).toBe('true')
+
+		await switches[2]?.trigger('click')
+		expect(wrapper.emitted('update:modelValue')).toBeFalsy()
+	})
+})
diff --git a/src/tests/views/Settings/PolicyWorkbench/signatureFooterModel.spec.ts b/src/tests/views/Settings/PolicyWorkbench/signatureFooterModel.spec.ts
new file mode 100644
index 0000000000..8bd415eb8d
--- /dev/null
+++ b/src/tests/views/Settings/PolicyWorkbench/signatureFooterModel.spec.ts
@@ -0,0 +1,55 @@
+/*
+ * SPDX-FileCopyrightText: 2026 LibreSign contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+import { describe, expect, it } from 'vitest'
+
+import {
+	getDefaultSignatureFooterPolicyConfig,
+	normalizeSignatureFooterPolicyConfig,
+	serializeSignatureFooterPolicyConfig,
+} from '../../../../views/Settings/PolicyWorkbench/settings/signature-footer/model'
+
+describe('signature-footer model', () => {
+	it('normalizes legacy boolean values', () => {
+		expect(normalizeSignatureFooterPolicyConfig(true)).toEqual({
+			enabled: true,
+			writeQrcodeOnFooter: true,
+			validationSite: '',
+			customizeFooterTemplate: false,
+		})
+
+		expect(normalizeSignatureFooterPolicyConfig('0')).toEqual({
+			enabled: false,
+			writeQrcodeOnFooter: true,
+			validationSite: '',
+			customizeFooterTemplate: false,
+		})
+	})
+
+	it('normalizes structured JSON payload', () => {
+		const payload = '{"enabled":true,"writeQrcodeOnFooter":false,"validationSite":"https://validation.example","customizeFooterTemplate":true}'
+		expect(normalizeSignatureFooterPolicyConfig(payload)).toEqual({
+			enabled: true,
+			writeQrcodeOnFooter: false,
+			validationSite: 'https://validation.example',
+			customizeFooterTemplate: true,
+		})
+	})
+
+	it('serializes canonical payload from config object', () => {
+		const serialized = serializeSignatureFooterPolicyConfig({
+			enabled: true,
+			writeQrcodeOnFooter: true,
+			validationSite: '',
+			customizeFooterTemplate: false,
+		})
+
+		expect(serialized).toBe('{"enabled":true,"writeQrcodeOnFooter":true,"validationSite":"","customizeFooterTemplate":false}')
+	})
+
+	it('returns defaults when payload is empty', () => {
+		expect(normalizeSignatureFooterPolicyConfig('')).toEqual(getDefaultSignatureFooterPolicyConfig())
+	})
+})
diff --git a/src/tests/views/Settings/PolicyWorkbench/useRealPolicyWorkbench.spec.ts b/src/tests/views/Settings/PolicyWorkbench/useRealPolicyWorkbench.spec.ts
new file mode 100644
index 0000000000..c953d47442
--- /dev/null
+++ b/src/tests/views/Settings/PolicyWorkbench/useRealPolicyWorkbench.spec.ts
@@ -0,0 +1,1025 @@
+/*
+ * SPDX-FileCopyrightText: 2026 LibreSign contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { createL10nMock } from '../../../testHelpers/l10n.js'
+
+vi.mock('@nextcloud/l10n', () => createL10nMock())
+
+const { currentUserState } = vi.hoisted(() => ({
+	currentUserState: {
+		isAdmin: true,
+	},
+}))
+
+vi.mock('@nextcloud/auth', () => ({
+	getCurrentUser: vi.fn(() => currentUserState),
+}))
+
+vi.mock('@nextcloud/initial-state', () => ({
+	loadState: vi.fn((_app, key: string, defaultValue: unknown) => {
+		if (key === 'config') {
+			return { can_manage_group_policies: true }
+		}
+
+		return defaultValue
+	}),
+}))
+
+const { axiosGet } = vi.hoisted(() => ({
+	axiosGet: vi.fn(),
+}))
+
+vi.mock('@nextcloud/axios', () => ({
+	default: {
+		get: axiosGet,
+	},
+}))
+
+vi.mock('@nextcloud/router', () => ({
+	generateOcsUrl: vi.fn((path: string) => path),
+}))
+
+const saveSystemPolicy = vi.fn()
+const saveGroupPolicy = vi.fn()
+const fetchGroupPolicy = vi.fn()
+const fetchSystemPolicy = vi.fn()
+const fetchUserPolicyForUser = vi.fn()
+const saveUserPolicyForUser = vi.fn()
+const clearUserPreference = vi.fn()
+const clearGroupPolicy = vi.fn()
+const clearUserPolicyForUser = vi.fn()
+const getPolicy = vi.fn()
+const fetchEffectivePolicies = vi.fn()
+
+vi.mock('../../../../store/policies', () => ({
+	usePoliciesStore: () => ({
+		saveSystemPolicy,
+		saveGroupPolicy,
+		fetchGroupPolicy,
+		fetchSystemPolicy,
+		fetchUserPolicyForUser,
+		saveUserPolicyForUser,
+		clearUserPreference,
+		clearGroupPolicy,
+		clearUserPolicyForUser,
+		getPolicy,
+		fetchEffectivePolicies,
+	}),
+}))
+
+import { createRealPolicyWorkbenchState } from '../../../../views/Settings/PolicyWorkbench/useRealPolicyWorkbench'
+
+describe('useRealPolicyWorkbench', () => {
+	beforeEach(() => {
+		currentUserState.isAdmin = true
+		axiosGet.mockReset()
+		saveSystemPolicy.mockReset()
+		saveGroupPolicy.mockReset()
+		fetchGroupPolicy.mockReset()
+		fetchSystemPolicy.mockReset()
+		fetchUserPolicyForUser.mockReset()
+		saveUserPolicyForUser.mockReset()
+		clearUserPreference.mockReset()
+		clearGroupPolicy.mockReset()
+		clearUserPolicyForUser.mockReset()
+		getPolicy.mockReset()
+		fetchEffectivePolicies.mockReset()
+		getPolicy.mockReturnValue({ effectiveValue: 'parallel' })
+		fetchSystemPolicy.mockResolvedValue(null)
+		fetchGroupPolicy.mockResolvedValue(null)
+		fetchUserPolicyForUser.mockResolvedValue(null)
+		clearUserPreference.mockResolvedValue(null)
+		fetchEffectivePolicies.mockResolvedValue(undefined)
+		axiosGet.mockImplementation((url: string) => {
+			if (url === 'cloud/groups/details') {
+				return Promise.resolve({
+					data: {
+						ocs: {
+							data: {
+								groups: [
+									{ id: 'finance', displayname: 'Finance', usercount: 3 },
+									{ id: 'legal', displayname: 'Legal', usercount: 2 },
+								],
+							},
+						},
+					},
+				})
+			}
+
+			if (url === 'cloud/users/details') {
+				return Promise.resolve({
+					data: {
+						ocs: {
+							data: {
+								users: {
+									user1: { id: 'user1', displayname: 'User One', email: 'user1@example.com' },
+									user3: { id: 'user3', 'display-name': 'User Three', email: 'user3@example.com' },
+									fakeGroupLike: { id: 'finance', displayname: 'Finance', usercount: 3, isNoUser: true },
+								},
+							},
+						},
+					},
+				})
+			}
+
+			return Promise.resolve({ data: { ocs: { data: {} } } })
+		})
+	})
+
+	it('hydrates persisted group rules when opening a setting', async () => {
+		fetchGroupPolicy.mockImplementation(async (groupId: string) => {
+			if (groupId !== 'finance') {
+				return null
+			}
+
+			return {
+				policyKey: 'signature_flow',
+				scope: 'group',
+				targetId: 'finance',
+				value: 'ordered_numeric',
+				allowChildOverride: false,
+				visibleToChild: true,
+				allowedValues: ['ordered_numeric'],
+			}
+		})
+
+		const state = createRealPolicyWorkbenchState()
+		state.openSetting('signature_flow')
+
+		await vi.waitFor(() => {
+			expect(fetchGroupPolicy).toHaveBeenCalledWith('finance', 'signature_flow')
+			expect(state.visibleGroupRules).toHaveLength(1)
+		})
+
+		expect(fetchGroupPolicy).toHaveBeenCalledWith('finance', 'signature_flow')
+		expect(state.visibleGroupRules).toHaveLength(1)
+		expect(state.visibleGroupRules[0]).toMatchObject({
+			targetId: 'finance',
+			value: 'ordered_numeric',
+			allowChildOverride: false,
+		})
+	})
+
+	it('shows docmdp as available setting in policy workbench summaries', async () => {
+		const state = createRealPolicyWorkbenchState()
+		const keys = state.visibleSettingSummaries.map((summary) => summary.key)
+
+		expect(keys).toContain('signature_flow')
+		expect(keys).toContain('docmdp')
+	})
+
+	it('keeps override counts isolated per setting after opening and closing dialogs', async () => {
+		fetchGroupPolicy.mockImplementation(async (groupId: string, policyKey: string) => {
+			if (policyKey !== 'signature_flow' || groupId !== 'finance') {
+				return null
+			}
+
+			return {
+				policyKey: 'signature_flow',
+				scope: 'group',
+				targetId: 'finance',
+				value: 'ordered_numeric',
+				allowChildOverride: false,
+				visibleToChild: true,
+				allowedValues: ['ordered_numeric'],
+			}
+		})
+
+		fetchUserPolicyForUser.mockImplementation(async (userId: string, policyKey: string) => {
+			if (policyKey !== 'signature_flow' || userId !== 'user1') {
+				return null
+			}
+
+			return {
+				policyKey: 'signature_flow',
+				scope: 'user',
+				targetId: 'user1',
+				value: 'parallel',
+			}
+		})
+
+		const state = createRealPolicyWorkbenchState()
+
+		state.openSetting('signature_flow')
+		await vi.waitFor(() => {
+			expect(state.visibleGroupRules).toHaveLength(1)
+			expect(state.visibleUserRules).toHaveLength(1)
+		})
+		state.closeSetting()
+
+		state.openSetting('docmdp')
+		await vi.waitFor(() => {
+			expect(state.visibleGroupRules).toHaveLength(0)
+			expect(state.visibleUserRules).toHaveLength(0)
+		})
+		state.closeSetting()
+
+		const summariesByKey = Object.fromEntries(state.visibleSettingSummaries.map((summary) => [summary.key, summary]))
+
+		expect(summariesByKey.signature_flow?.groupCount).toBe(1)
+		expect(summariesByKey.signature_flow?.userCount).toBe(1)
+		expect(summariesByKey.docmdp?.groupCount).toBe(0)
+		expect(summariesByKey.docmdp?.userCount).toBe(0)
+	})
+
+	it('saves system docmdp rule through generic policy endpoint flow', async () => {
+		getPolicy.mockImplementation((key: string) => {
+			if (key === 'docmdp') {
+				return {
+					policyKey: 'docmdp',
+					effectiveValue: 2,
+					allowedValues: [0, 1, 2, 3],
+					sourceScope: 'system',
+					visible: true,
+					editableByCurrentActor: true,
+					canSaveAsUserDefault: false,
+					canUseAsRequestOverride: false,
+					preferenceWasCleared: false,
+					blockedBy: null,
+				}
+			}
+
+			return { effectiveValue: 'parallel' }
+		})
+
+		const state = createRealPolicyWorkbenchState()
+		state.openSetting('docmdp')
+		await Promise.resolve()
+		await Promise.resolve()
+
+		state.startEditor({ scope: 'system' })
+		state.updateDraftValue(3)
+		await state.saveDraft()
+
+		expect(saveSystemPolicy).toHaveBeenCalledWith('docmdp', 3, true)
+		expect(fetchEffectivePolicies).toHaveBeenCalled()
+	})
+
+	it('hydrates explicit system rule and persisted user rules when opening a setting', async () => {
+		getPolicy.mockReturnValue({
+			effectiveValue: 'parallel',
+			sourceScope: 'user',
+		})
+
+		fetchSystemPolicy.mockResolvedValue({
+			policyKey: 'signature_flow',
+			scope: 'global',
+			value: 'ordered_numeric',
+			allowChildOverride: true,
+			visibleToChild: true,
+			allowedValues: [],
+		})
+		fetchUserPolicyForUser.mockImplementation(async (userId: string) => {
+			if (userId !== 'user1') {
+				return null
+			}
+
+			return {
+				policyKey: 'signature_flow',
+				scope: 'user',
+				targetId: 'user1',
+				value: 'parallel',
+			}
+		})
+
+		const state = createRealPolicyWorkbenchState()
+		state.openSetting('signature_flow')
+
+		await vi.waitFor(() => {
+			expect(fetchSystemPolicy).toHaveBeenCalledWith('signature_flow')
+			expect(fetchUserPolicyForUser).toHaveBeenCalledWith('user1', 'signature_flow')
+			expect(state.inheritedSystemRule?.value).toBe('ordered_numeric')
+			expect(state.visibleUserRules).toHaveLength(1)
+		})
+
+		expect(state.visibleUserRules[0]).toMatchObject({
+			targetId: 'user1',
+			value: 'parallel',
+		})
+	})
+
+	it('hydrates persisted user rules beyond the first users page', async () => {
+		axiosGet.mockImplementation((url: string, config?: { params?: { offset?: number } }) => {
+			if (url === 'cloud/groups/details') {
+				return Promise.resolve({
+					data: {
+						ocs: {
+							data: {
+								groups: [],
+							},
+						},
+					},
+				})
+			}
+
+			if (url === 'cloud/users/details') {
+				const offset = config?.params?.offset ?? 0
+				if (offset === 0) {
+					const firstPageUsers = Object.fromEntries(
+						Array.from({ length: 20 }, (_, index) => {
+							const id = `user${index + 1}`
+							return [id, { id, displayname: `User ${index + 1}` }]
+						}),
+					)
+
+					return Promise.resolve({
+						data: {
+							ocs: {
+								data: {
+									users: firstPageUsers,
+								},
+							},
+						},
+					})
+				}
+
+				if (offset === 20) {
+					return Promise.resolve({
+						data: {
+							ocs: {
+								data: {
+									users: {
+										user21: { id: 'user21', displayname: 'User 21' },
+									},
+								},
+							},
+						},
+					})
+				}
+
+				return Promise.resolve({
+					data: {
+						ocs: {
+							data: {
+								users: {},
+							},
+						},
+					},
+				})
+			}
+
+			return Promise.resolve({ data: { ocs: { data: {} } } })
+		})
+
+		fetchUserPolicyForUser.mockImplementation(async (userId: string) => {
+			if (userId !== 'user21') {
+				return null
+			}
+
+			return {
+				policyKey: 'signature_flow',
+				scope: 'user',
+				targetId: 'user21',
+				value: 'ordered_numeric',
+			}
+		})
+
+		const state = createRealPolicyWorkbenchState()
+		state.openSetting('signature_flow')
+
+		await vi.waitFor(() => {
+			expect(fetchUserPolicyForUser).toHaveBeenCalledWith('user21', 'signature_flow')
+			expect(state.visibleUserRules).toHaveLength(1)
+		})
+
+		expect(state.visibleUserRules[0]).toMatchObject({
+			targetId: 'user21',
+			value: 'ordered_numeric',
+		})
+	})
+
+	it('loads real group targets from OCS when opening the group editor', async () => {
+		const state = createRealPolicyWorkbenchState()
+		state.openSetting('signature_flow')
+		state.startEditor({ scope: 'group' })
+
+		await Promise.resolve()
+		await Promise.resolve()
+
+		expect(axiosGet).toHaveBeenCalledWith('cloud/groups/details', {
+			params: {
+				search: '',
+				limit: 20,
+				offset: 0,
+			},
+		})
+		expect(state.availableTargets).toEqual([
+			{ id: 'finance', displayName: 'Finance', subname: '3 members', isNoUser: true },
+			{ id: 'legal', displayName: 'Legal', subname: '2 members', isNoUser: true },
+		])
+	})
+
+	it('loads real user targets from OCS when searching the user editor', async () => {
+		const state = createRealPolicyWorkbenchState()
+		state.openSetting('signature_flow')
+		state.startEditor({ scope: 'user' })
+
+		await Promise.resolve()
+		state.searchAvailableTargets('user')
+		await Promise.resolve()
+		await Promise.resolve()
+
+		expect(axiosGet).toHaveBeenLastCalledWith('cloud/users/details', {
+			params: {
+				search: 'user',
+				limit: 20,
+				offset: 0,
+			},
+		})
+		expect(state.availableTargets).toEqual([
+			{ id: 'user1', displayName: 'User One', subname: 'user1@example.com', user: 'user1' },
+			{ id: 'user3', displayName: 'User Three', subname: 'user3@example.com', user: 'user3' },
+		])
+		expect(state.availableTargets.some((target) => target.id === 'finance')).toBe(false)
+	})
+
+	it('saves system signature_flow rule', async () => {
+		const state = createRealPolicyWorkbenchState()
+		state.openSetting('signature_flow')
+		state.startEditor({ scope: 'system' })
+		state.updateDraftValue('ordered_numeric' as never)
+
+		await state.saveDraft()
+
+		expect(saveSystemPolicy).toHaveBeenCalledWith('signature_flow', 'ordered_numeric', false)
+	})
+
+	it('saves fixed parallel system signature_flow rule without child override', async () => {
+		getPolicy.mockReturnValue({
+			effectiveValue: 'none',
+			sourceScope: 'system',
+		})
+
+		const state = createRealPolicyWorkbenchState()
+		state.openSetting('signature_flow')
+		state.startEditor({ scope: 'system' })
+		state.updateDraftValue('parallel' as never)
+
+		await state.saveDraft()
+
+		expect(saveSystemPolicy).toHaveBeenCalledWith('signature_flow', 'parallel', false)
+	})
+
+	it('forces hidden signature_flow override state to remain locked in system and group editors', async () => {
+		fetchSystemPolicy.mockResolvedValue({
+			policyKey: 'signature_flow',
+			scope: 'global',
+			value: 'ordered_numeric',
+			allowChildOverride: true,
+			visibleToChild: true,
+			allowedValues: [],
+		})
+		getPolicy.mockReturnValue({
+			effectiveValue: 'ordered_numeric',
+			sourceScope: 'global',
+		})
+
+		const state = createRealPolicyWorkbenchState()
+		state.openSetting('signature_flow')
+
+		await vi.waitFor(() => {
+			expect(fetchSystemPolicy).toHaveBeenCalledWith('signature_flow')
+			expect(state.inheritedSystemRule?.allowChildOverride).toBe(true)
+		})
+
+		state.startEditor({ scope: 'system', ruleId: 'system-default' })
+		expect(state.editorDraft?.allowChildOverride).toBe(false)
+
+		state.cancelEditor()
+		state.startEditor({ scope: 'group' })
+		expect(state.editorDraft?.allowChildOverride).toBe(false)
+	})
+
+	it('locks signature_flow system create draft even when inherited rule allows overrides', async () => {
+		fetchSystemPolicy.mockResolvedValue({
+			policyKey: 'signature_flow',
+			scope: 'global',
+			value: 'parallel',
+			allowChildOverride: true,
+			visibleToChild: true,
+			allowedValues: [],
+		})
+		getPolicy.mockReturnValue({
+			effectiveValue: 'parallel',
+			sourceScope: 'global',
+		})
+
+		const state = createRealPolicyWorkbenchState()
+		state.openSetting('signature_flow')
+
+		await vi.waitFor(() => {
+			expect(fetchSystemPolicy).toHaveBeenCalledWith('signature_flow')
+			expect(state.inheritedSystemRule?.allowChildOverride).toBe(true)
+		})
+
+		state.startEditor({ scope: 'system' })
+		expect(state.editorMode).toBe('create')
+		expect(state.editorDraft?.allowChildOverride).toBe(false)
+	})
+
+	it('transitions from fallback none to persisted global default after saving system rule', async () => {
+		let currentPolicy: any = {
+			effectiveValue: 'none',
+			allowedValues: ['parallel', 'ordered_numeric'],
+			sourceScope: 'system',
+		}
+
+		getPolicy.mockImplementation((key: string) => {
+			if (key === 'signature_flow') {
+				return currentPolicy
+			}
+
+			return null
+		})
+
+		saveSystemPolicy.mockImplementation(async (_policyKey: string, value: unknown, allowChildOverride?: boolean) => {
+			currentPolicy = {
+				effectiveValue: value,
+				allowedValues: allowChildOverride === false ? [value] : [],
+				sourceScope: 'global',
+			}
+			return currentPolicy
+		})
+
+		const state = createRealPolicyWorkbenchState()
+		state.openSetting('signature_flow')
+
+		expect(state.inheritedSystemRule).not.toBeNull()
+		expect(state.summary?.baseSource).toBe('System default')
+
+		state.startEditor({ scope: 'system' })
+		state.updateDraftValue('ordered_numeric' as never)
+		await state.saveDraft()
+		await Promise.resolve()
+		await Promise.resolve()
+
+		expect(saveSystemPolicy).toHaveBeenCalledWith('signature_flow', 'ordered_numeric', false)
+		expect(fetchEffectivePolicies).toHaveBeenCalled()
+		expect(getPolicy('signature_flow')?.effectiveValue).toBe('ordered_numeric')
+
+		const refreshedState = createRealPolicyWorkbenchState()
+		refreshedState.openSetting('signature_flow')
+		expect(refreshedState.inheritedSystemRule).not.toBeNull()
+		expect(refreshedState.summary?.baseSource).toBe('Global default')
+		expect(refreshedState.summary?.currentBaseValue).toBe('Sequential')
+	})
+
+	it('supports multi-target group save for signature_flow', async () => {
+		const state = createRealPolicyWorkbenchState()
+		state.openSetting('signature_flow')
+		state.startEditor({ scope: 'group' })
+		state.updateDraftTargets(['finance', 'legal'])
+		state.updateDraftValue('ordered_numeric' as never)
+		state.updateDraftAllowOverride(false)
+
+		await state.saveDraft()
+
+		expect(saveGroupPolicy).toHaveBeenCalledTimes(2)
+		expect(saveGroupPolicy).toHaveBeenNthCalledWith(1, 'finance', 'signature_flow', 'ordered_numeric', false)
+		expect(saveGroupPolicy).toHaveBeenNthCalledWith(2, 'legal', 'signature_flow', 'ordered_numeric', false)
+	})
+
+	it('keeps explicit instance rule visible after saving when effective source remains group', async () => {
+		let currentPolicy: any = {
+			effectiveValue: 'parallel',
+			allowedValues: ['parallel', 'ordered_numeric'],
+			sourceScope: 'group',
+		}
+
+		getPolicy.mockImplementation((key: string) => {
+			if (key === 'signature_flow') {
+				return currentPolicy
+			}
+
+			return null
+		})
+
+		saveSystemPolicy.mockImplementation(async (_policyKey: string, value: unknown) => {
+			currentPolicy = {
+				effectiveValue: currentPolicy.effectiveValue,
+				allowedValues: currentPolicy.allowedValues,
+				sourceScope: 'group',
+			}
+
+			return {
+				effectiveValue: value,
+				sourceScope: 'group',
+				allowedValues: ['parallel', 'ordered_numeric'],
+			}
+		})
+
+		const state = createRealPolicyWorkbenchState()
+		state.openSetting('signature_flow')
+
+		expect(state.inheritedSystemRule).toBeNull()
+
+		state.startEditor({ scope: 'system' })
+		state.updateDraftValue('ordered_numeric' as never)
+		await state.saveDraft()
+
+		expect(saveSystemPolicy).toHaveBeenCalledWith('signature_flow', 'ordered_numeric', false)
+		expect(state.inheritedSystemRule).not.toBeNull()
+		expect(state.inheritedSystemRule?.value).toBe('ordered_numeric')
+		expect(state.hasGlobalDefault).toBe(true)
+	})
+
+	it('supports multi-target user save for signature_flow', async () => {
+		const state = createRealPolicyWorkbenchState()
+		state.openSetting('signature_flow')
+		state.startEditor({ scope: 'user' })
+		state.updateDraftTargets(['user1', 'user3'])
+		state.updateDraftValue('parallel' as never)
+
+		await state.saveDraft()
+
+		expect(saveUserPolicyForUser).toHaveBeenCalledTimes(2)
+		expect(saveUserPolicyForUser).toHaveBeenNthCalledWith(1, 'user1', 'signature_flow', 'parallel')
+		expect(saveUserPolicyForUser).toHaveBeenNthCalledWith(2, 'user3', 'signature_flow', 'parallel')
+	})
+
+	it('hides groups that already have a rule when creating a new group rule', async () => {
+		const state = createRealPolicyWorkbenchState()
+		state.openSetting('signature_flow')
+
+		state.startEditor({ scope: 'group' })
+		state.updateDraftTargets(['finance'])
+		state.updateDraftValue('parallel' as never)
+		await state.saveDraft()
+
+		state.startEditor({ scope: 'group' })
+		await Promise.resolve()
+		await Promise.resolve()
+
+		expect(state.availableTargets).toEqual([
+			{ id: 'legal', displayName: 'Legal', subname: '2 members', isNoUser: true },
+		])
+	})
+
+	it('hides users that already have a rule when creating a new user rule', async () => {
+		const state = createRealPolicyWorkbenchState()
+		state.openSetting('signature_flow')
+
+		state.startEditor({ scope: 'user' })
+		state.updateDraftTargets(['user1'])
+		state.updateDraftValue('parallel' as never)
+		await state.saveDraft()
+
+		state.startEditor({ scope: 'user' })
+		await Promise.resolve()
+		await Promise.resolve()
+
+		expect(state.availableTargets).toEqual([
+			{ id: 'user3', displayName: 'User Three', subname: 'user3@example.com', user: 'user3' },
+		])
+	})
+
+	it('removes persisted group and user rules', async () => {
+		const state = createRealPolicyWorkbenchState()
+		state.openSetting('signature_flow')
+
+		state.startEditor({ scope: 'group' })
+		state.updateDraftTargets(['finance'])
+		state.updateDraftValue('parallel' as never)
+		await state.saveDraft()
+
+		state.startEditor({ scope: 'user' })
+		state.updateDraftTargets(['user1'])
+		state.updateDraftValue('parallel' as never)
+		await state.saveDraft()
+
+		const groupRuleId = state.visibleGroupRules[0]?.id
+		const userRuleId = state.visibleUserRules[0]?.id
+		expect(groupRuleId).toBeTruthy()
+		expect(userRuleId).toBeTruthy()
+
+		if (!groupRuleId || !userRuleId) {
+			throw new Error('Expected created group and user rules')
+		}
+
+		await state.removeRule(groupRuleId)
+		await state.removeRule(userRuleId)
+
+		expect(clearGroupPolicy).toHaveBeenCalledTimes(1)
+		expect(clearGroupPolicy).toHaveBeenCalledWith('finance', 'signature_flow')
+		expect(clearUserPolicyForUser).toHaveBeenCalledTimes(1)
+		expect(clearUserPolicyForUser).toHaveBeenCalledWith('user1', 'signature_flow')
+		expect(state.visibleGroupRules).toHaveLength(0)
+		expect(state.visibleUserRules).toHaveLength(0)
+	})
+
+	it('resets system default rule through backend request', async () => {
+		const state = createRealPolicyWorkbenchState()
+		state.openSetting('signature_flow')
+
+		await state.removeRule('system-default')
+
+		expect(saveSystemPolicy).toHaveBeenCalledTimes(1)
+		expect(saveSystemPolicy).toHaveBeenCalledWith('signature_flow', null, false)
+	})
+
+	it('closes editor when the edited system rule is reset', async () => {
+		const state = createRealPolicyWorkbenchState()
+		state.openSetting('signature_flow')
+		state.startEditor({ scope: 'system', ruleId: 'system-default' })
+
+		expect(state.editorDraft).not.toBeNull()
+		expect(state.editorMode).toBe('edit')
+
+		await state.removeRule('system-default')
+
+		expect(state.editorDraft).toBeNull()
+		expect(state.editorMode).toBeNull()
+	})
+
+	it('closes editor when the edited group rule is removed', async () => {
+		const state = createRealPolicyWorkbenchState()
+		state.openSetting('signature_flow')
+
+		state.startEditor({ scope: 'group' })
+		state.updateDraftTargets(['finance'])
+		state.updateDraftValue('parallel' as never)
+		await state.saveDraft()
+
+		const groupRuleId = state.visibleGroupRules[0]?.id
+		expect(groupRuleId).toBeTruthy()
+
+		if (!groupRuleId) {
+			throw new Error('Expected a created group rule')
+		}
+
+		state.startEditor({ scope: 'group', ruleId: groupRuleId })
+		expect(state.editorMode).toBe('edit')
+
+		await state.removeRule(groupRuleId)
+
+		expect(state.editorDraft).toBeNull()
+		expect(state.editorMode).toBeNull()
+	})
+
+	it('keeps a visible instance row for system-sourced baseline values', () => {
+		getPolicy.mockReturnValue({ effectiveValue: 'none', sourceScope: 'system' })
+
+		const state = createRealPolicyWorkbenchState()
+		state.openSetting('signature_flow')
+
+		expect(state.inheritedSystemRule).not.toBeNull()
+		expect(state.inheritedSystemRule?.value).toBe('none')
+		expect(state.hasGlobalDefault).toBe(false)
+	})
+
+	it('treats none with empty allowedValues as explicit global "let users choose" rule', () => {
+		getPolicy.mockReturnValue({
+			effectiveValue: 'none',
+			sourceScope: 'global',
+			allowedValues: ['none', 'parallel', 'ordered_numeric'],
+		})
+
+		const state = createRealPolicyWorkbenchState()
+		state.openSetting('signature_flow')
+
+		expect(state.inheritedSystemRule).not.toBeNull()
+		expect(state.inheritedSystemRule?.value).toBe('none')
+		expect(state.summary?.currentBaseValue).toBe('User choice')
+	})
+
+	it('keeps persisted numeric system default visible after reload', () => {
+		getPolicy.mockReturnValue({
+			effectiveValue: 0,
+			sourceScope: 'system',
+			allowedValues: [0, 1, 2],
+		})
+
+		const state = createRealPolicyWorkbenchState()
+		state.openSetting('signature_flow')
+
+		expect(state.inheritedSystemRule).not.toBeNull()
+		expect(state.inheritedSystemRule?.value).toBe(0)
+		expect(state.summary?.currentBaseValue).toBe('User choice')
+	})
+
+	it('does not treat group-sourced effective value as explicit instance rule', () => {
+		getPolicy.mockReturnValue({
+			effectiveValue: 'parallel',
+			sourceScope: 'group',
+			allowedValues: ['none', 'parallel', 'ordered_numeric'],
+		})
+
+		const state = createRealPolicyWorkbenchState()
+		state.openSetting('signature_flow')
+
+		expect(state.inheritedSystemRule).toBeNull()
+		expect(state.hasGlobalDefault).toBe(false)
+	})
+
+	it('prefills system rule creation with the current baseline value', () => {
+		getPolicy.mockReturnValue({
+			effectiveValue: 'ordered_numeric',
+			sourceScope: 'global',
+			allowedValues: ['none', 'parallel', 'ordered_numeric'],
+		})
+
+		const state = createRealPolicyWorkbenchState()
+		state.openSetting('signature_flow')
+		state.startEditor({ scope: 'system' })
+
+		expect(state.editorMode).toBe('create')
+		expect(state.editorDraft?.value).toBe('ordered_numeric')
+	})
+
+	it('normalizes numeric system value when opening editor in edit mode', () => {
+		getPolicy.mockReturnValue({
+			effectiveValue: 2,
+			allowedValues: ['parallel', 'ordered_numeric'],
+		})
+
+		const state = createRealPolicyWorkbenchState()
+		state.openSetting('signature_flow')
+		state.startEditor({ scope: 'system', ruleId: 'system-default' })
+
+		expect(state.editorMode).toBe('edit')
+		expect(state.editorDraft?.value).toBe('ordered_numeric')
+	})
+
+	it('hydrates system rule override toggle from backend allowed values', () => {
+		getPolicy.mockReturnValue({
+			effectiveValue: 'parallel',
+			allowedValues: ['parallel'],
+		})
+
+		const state = createRealPolicyWorkbenchState()
+		state.openSetting('signature_flow')
+
+		expect(state.inheritedSystemRule?.allowChildOverride).toBe(false)
+
+		state.startEditor({ scope: 'system', ruleId: 'system-default' })
+		expect(state.editorDraft?.allowChildOverride).toBe(false)
+	})
+
+	it('builds sticky summary metadata with precedence mode and fallback', () => {
+		getPolicy.mockReturnValue({
+			effectiveValue: 'ordered_numeric',
+			sourceScope: 'global',
+			allowedValues: ['parallel', 'ordered_numeric'],
+		})
+
+		const state = createRealPolicyWorkbenchState()
+		state.openSetting('signature_flow')
+
+		expect(state.policyResolutionMode).toBe('precedence')
+		expect(state.summary).not.toBeNull()
+		expect(state.summary?.currentBaseValue).toBe('Sequential')
+		expect(state.summary?.platformFallback).toBe('User choice')
+		expect(state.summary?.baseSource).toBe('Global default')
+	})
+
+	it('allows system-admin to create user exceptions even when a group blocks inheritance', async () => {
+		getPolicy.mockReturnValue({ effectiveValue: 'parallel', sourceScope: 'global' })
+
+		const state = createRealPolicyWorkbenchState()
+		state.openSetting('signature_flow')
+		state.startEditor({ scope: 'group' })
+		state.updateDraftTargets(['finance'])
+		state.updateDraftValue('parallel' as never)
+		state.updateDraftAllowOverride(false)
+		await state.saveDraft()
+
+		expect(state.viewMode).toBe('system-admin')
+		expect(state.createUserOverrideDisabledReason).toBeNull()
+
+		state.startEditor({ scope: 'user' })
+		expect(state.editorDraft?.scope).toBe('user')
+	})
+
+	it('blocks user exceptions for group-admin when a group rule disables inheritance', async () => {
+		getPolicy.mockReturnValue({ effectiveValue: 'parallel', sourceScope: 'global' })
+
+		const state = createRealPolicyWorkbenchState()
+		state.setViewMode('group-admin')
+		state.openSetting('signature_flow')
+		state.startEditor({ scope: 'group' })
+		state.updateDraftTargets(['finance'])
+		state.updateDraftValue('parallel' as never)
+		state.updateDraftAllowOverride(false)
+		await state.saveDraft()
+
+		expect(state.createUserOverrideDisabledReason).toContain('Blocked by the Finance group rule')
+
+		state.startEditor({ scope: 'user' })
+		expect(state.editorDraft).toBeNull()
+	})
+
+	it('allows creating group rule when no system rule is set', () => {
+		getPolicy.mockReturnValue({ effectiveValue: null })
+
+		const state = createRealPolicyWorkbenchState()
+		state.openSetting('signature_flow')
+
+		expect(state.inheritedSystemRule).toBeNull()
+		expect(state.createGroupOverrideDisabledReason).toBeNull()
+	})
+
+	it('allows instance admin to create group rule even when system rule disallows child override', () => {
+		// Single allowedValues → backend signals allowChildOverride = false
+		getPolicy.mockReturnValue({
+			effectiveValue: 'parallel',
+			allowedValues: ['parallel'],
+		})
+
+		const state = createRealPolicyWorkbenchState()
+		state.openSetting('signature_flow')
+
+		expect(state.inheritedSystemRule?.allowChildOverride).toBe(false)
+		expect(state.createGroupOverrideDisabledReason).toBeNull()
+	})
+
+	it('blocks group-admin from creating group rule when system rule disallows child override', () => {
+		currentUserState.isAdmin = false
+		getPolicy.mockReturnValue({
+			effectiveValue: 'parallel',
+			allowedValues: ['parallel'],
+		})
+
+		const state = createRealPolicyWorkbenchState()
+		state.setViewMode('group-admin')
+		state.openSetting('signature_flow')
+
+		expect(state.inheritedSystemRule?.allowChildOverride).toBe(false)
+		expect(state.createGroupOverrideDisabledReason).not.toBeNull()
+	})
+
+	it('allows creating user rule when no system rule is set', () => {
+		getPolicy.mockReturnValue({ effectiveValue: null })
+
+		const state = createRealPolicyWorkbenchState()
+		state.openSetting('signature_flow')
+
+		expect(state.inheritedSystemRule).toBeNull()
+		expect(state.createUserOverrideDisabledReason).toBeNull()
+	})
+
+	it('clears current user preference when system-admin saves system rule', async () => {
+		const state = createRealPolicyWorkbenchState()
+		state.openSetting('signature_flow')
+		state.startEditor({ scope: 'system' })
+		state.updateDraftValue('ordered_numeric' as never)
+
+		await state.saveDraft()
+
+		expect(saveSystemPolicy).toHaveBeenCalledWith('signature_flow', 'ordered_numeric', false)
+		expect(clearUserPreference).toHaveBeenCalledWith('signature_flow')
+	})
+
+	it('requires dirty draft changes before save is enabled in edit mode', async () => {
+		const state = createRealPolicyWorkbenchState()
+		state.openSetting('signature_flow')
+		state.startEditor({ scope: 'group' })
+		state.updateDraftTargets(['finance'])
+		state.updateDraftValue('parallel' as never)
+		await state.saveDraft()
+
+		const groupRuleId = state.visibleGroupRules[0]?.id
+		expect(groupRuleId).toBeTruthy()
+		if (!groupRuleId) {
+			throw new Error('Expected created group rule')
+		}
+
+		state.startEditor({ scope: 'group', ruleId: groupRuleId })
+		expect(state.isDraftDirty).toBe(false)
+		expect(state.canSaveDraft).toBe(false)
+
+		state.updateDraftValue('ordered_numeric' as never)
+		expect(state.isDraftDirty).toBe(true)
+		expect(state.canSaveDraft).toBe(true)
+	})
+
+	it('requires explicit value selection before enabling group create save', () => {
+		const state = createRealPolicyWorkbenchState()
+		state.openSetting('signature_flow')
+		state.startEditor({ scope: 'group' })
+
+		state.updateDraftTargets(['finance'])
+		expect(state.canSaveDraft).toBe(false)
+
+		state.updateDraftValue('parallel' as never)
+		expect(state.canSaveDraft).toBe(true)
+	})
+
+	it('requires changing the value before enabling system create save', () => {
+		getPolicy.mockReturnValue({ effectiveValue: 'parallel', sourceScope: 'system' })
+
+		const state = createRealPolicyWorkbenchState()
+		state.openSetting('signature_flow')
+		state.startEditor({ scope: 'system' })
+
+		expect(state.canSaveDraft).toBe(false)
+
+		state.updateDraftValue('ordered_numeric' as never)
+		expect(state.canSaveDraft).toBe(true)
+
+		state.updateDraftValue('parallel' as never)
+		expect(state.canSaveDraft).toBe(false)
+	})
+})
diff --git a/src/tests/views/Settings/Settings.spec.ts b/src/tests/views/Settings/Settings.spec.ts
index 54e19825f1..f2cac21a9d 100644
--- a/src/tests/views/Settings/Settings.spec.ts
+++ b/src/tests/views/Settings/Settings.spec.ts
@@ -3,8 +3,11 @@
  * SPDX-License-Identifier: AGPL-3.0-or-later
  */
 
-import { describe, expect, it } from 'vitest'
+import { describe, expect, it, vi } from 'vitest'
 import { mount } from '@vue/test-utils'
+import { createL10nMock } from '../../testHelpers/l10n.js'
+
+vi.mock('@nextcloud/l10n', () => createL10nMock())
 
 import Settings from '../../../views/Settings/Settings.vue'
 
@@ -16,6 +19,7 @@ describe('Settings.vue', () => {
 					SupportProject: { template: '<div class="support-project-stub" />' },
 					CertificateEngine: true,
 					SignatureEngine: true,
+					SettingsPolicyWorkbench: true,
 					DownloadBinaries: true,
 					ConfigureCheck: true,
 					RootCertificateCfssl: true,
@@ -24,8 +28,6 @@ describe('Settings.vue', () => {
 					ExpirationRules: true,
 					Validation: true,
 					CrlValidation: true,
-					DocMDP: true,
-					SignatureFlow: true,
 					SigningMode: true,
 					AllowedGroups: true,
 					LegalInformation: true,
@@ -37,7 +39,6 @@ describe('Settings.vue', () => {
 					Envelope: true,
 					Reminders: true,
 					TSA: true,
-					Confetti: true,
 				},
 			},
 		})
@@ -54,6 +55,7 @@ describe('Settings.vue', () => {
 					SupportProject: true,
 					CertificateEngine: true,
 					SignatureEngine: true,
+					SettingsPolicyWorkbench: true,
 					DownloadBinaries: true,
 					ConfigureCheck: true,
 					RootCertificateCfssl: true,
@@ -62,8 +64,6 @@ describe('Settings.vue', () => {
 					ExpirationRules: true,
 					Validation: true,
 					CrlValidation: true,
-					DocMDP: true,
-					SignatureFlow: true,
 					SigningMode: { name: 'SigningMode', template: '<div class="signing-mode-stub" />' },
 					AllowedGroups: true,
 					LegalInformation: true,
@@ -75,7 +75,6 @@ describe('Settings.vue', () => {
 					Envelope: true,
 					Reminders: true,
 					TSA: true,
-					Confetti: true,
 				},
 			},
 		})
diff --git a/src/tests/views/Settings/SettingsPolicyWorkbench.spec.ts b/src/tests/views/Settings/SettingsPolicyWorkbench.spec.ts
new file mode 100644
index 0000000000..350ce6f467
--- /dev/null
+++ b/src/tests/views/Settings/SettingsPolicyWorkbench.spec.ts
@@ -0,0 +1,343 @@
+/*
+ * SPDX-FileCopyrightText: 2026 LibreSign contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+import { mount } from '@vue/test-utils'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+import { createL10nMock } from '../../testHelpers/l10n.js'
+
+vi.mock('@nextcloud/l10n', () => createL10nMock())
+
+const getPolicy = vi.fn((key: string) => {
+	if (key === 'signature_flow') {
+		return { effectiveValue: 'ordered_numeric' }
+	}
+
+	return null
+})
+const fetchSystemPolicy = vi.fn().mockResolvedValue(null)
+const fetchGroupPolicy = vi.fn().mockResolvedValue(null)
+const fetchUserPolicyForUser = vi.fn().mockResolvedValue(null)
+
+vi.mock('../../../store/policies', () => ({
+	usePoliciesStore: () => ({
+		getPolicy,
+		fetchEffectivePolicies: vi.fn().mockResolvedValue(undefined),
+		fetchSystemPolicy,
+		fetchGroupPolicy,
+		fetchUserPolicyForUser,
+		saveSystemPolicy: vi.fn().mockResolvedValue(undefined),
+		saveGroupPolicy: vi.fn().mockResolvedValue(undefined),
+		saveUserPreference: vi.fn().mockResolvedValue(undefined),
+	}),
+}))
+
+import RealPolicyWorkbench from '../../../views/Settings/PolicyWorkbench/RealPolicyWorkbench.vue'
+
+function mountWorkbench() {
+	return mount(RealPolicyWorkbench, {
+		global: {
+			stubs: {
+				NcSettingsSection: { template: '<div><slot /></div>' },
+				NcTextField: { template: '<div><label>Find setting</label><input type="text" @input="$emit(\'update:modelValue\', $event.target.value)" /></div>' },
+				NcAppNavigationSearch: { template: '<div class="nc-app-navigation-search-stub"><input type="text" @input="$emit(\'update:modelValue\', $event.target.value)" /><div class="nc-app-navigation-search-stub__actions"><slot name="actions" /></div></div>' },
+				NcButton: { template: '<button v-bind="$attrs" @click="$emit(\'click\', $event)"><slot /></button>' },
+				NcIconSvgWrapper: { template: '<span class="icon-stub" />' },
+				NcNoteCard: { template: '<div class="note-card"><slot /></div>' },
+				NcDialog: {
+					props: ['name', 'buttons'],
+					template: '<div class="dialog"><h2 v-if="name" class="dialog-title">{{ name }}</h2><slot /><div v-if="buttons" class="dialog-footer"><button v-for="button in buttons" :key="button.label" :disabled="button.disabled" @click="button.callback()">{{ button.label }}</button></div></div>',
+				},
+				NcChip: { template: '<button class="nc-chip-stub">{{ text }}</button>', props: ['text'] },
+				NcCheckboxRadioSwitch: {
+					props: ['modelValue', 'type', 'name', 'value'],
+					template: "<label class=\"nc-checkbox-radio-switch-stub\"><input :checked=\"type === 'radio' ? modelValue === value : modelValue\" :type=\"type === 'radio' ? 'radio' : 'checkbox'\" :name=\"name\" @change=\"$emit('update:modelValue', type === 'radio' ? value : $event.target.checked)\" /><span><slot /></span></label>",
+				},
+				NcSelectUsers: {
+					props: ['placeholder', 'ariaLabel'],
+					template: '<div class="nc-select-users-stub"><label>{{ ariaLabel }}</label><span>{{ placeholder }}</span><button type="button" class="nc-select-users-stub__select" @click="$emit(\'update:modelValue\', [{ id: \'user-1\' }])">Select target</button></div>',
+				},
+				NcActions: {
+					props: ['open', 'ariaLabel'],
+					emits: ['update:open'],
+					template: '<div class="nc-actions-stub"><button class="nc-actions-stub__trigger" :aria-label="ariaLabel" @click="$emit(\'update:open\', !open)"><slot name="icon" /></button><div v-if="open" class="nc-actions-stub__menu"><slot /></div></div>',
+				},
+				NcActionButton: { template: '<button @click="$emit(\'click\')"><slot /></button>' },
+			},
+		},
+	})
+}
+
+function findButtonByText(wrapper: ReturnType<typeof mountWorkbench>, text: string) {
+	return wrapper.findAll('button').find((button) => button.text() === text)
+}
+
+function findButtonContainingText(wrapper: ReturnType<typeof mountWorkbench>, text: string) {
+	return wrapper.findAll('button').find((button) => button.text().includes(text))
+}
+
+function findConfigureButtonForSetting(wrapper: ReturnType<typeof mountWorkbench>, settingTitle: string) {
+	const settingCard = wrapper.findAll('article').find((article) => article.text().includes(settingTitle))
+	if (!settingCard) {
+		return undefined
+	}
+
+	return settingCard.findAll('button').find((button) => button.text().includes('Configure'))
+}
+
+describe('RealPolicyWorkbench.vue', () => {
+	beforeEach(() => {
+		getPolicy.mockReset()
+		fetchSystemPolicy.mockReset().mockResolvedValue(null)
+		fetchGroupPolicy.mockReset().mockResolvedValue(null)
+		fetchUserPolicyForUser.mockReset().mockResolvedValue(null)
+		getPolicy.mockImplementation((key: string) => {
+			if (key === 'signature_flow') {
+				return { effectiveValue: 'ordered_numeric' }
+			}
+
+			return null
+		})
+	})
+
+	it('keeps rule creation inside a modal multi-step flow', async () => {
+		const wrapper = mountWorkbench()
+
+		const openPolicyButton = findConfigureButtonForSetting(wrapper, 'Signing order')
+		expect(openPolicyButton).toBeTruthy()
+		await openPolicyButton?.trigger('click')
+		await findButtonByText(wrapper, 'Create rule')?.trigger('click')
+
+		expect(wrapper.findAll('.dialog-title').some((title) => title.text() === 'What do you want to create?')).toBe(true)
+
+		const createScopeDialog = wrapper.find('.policy-workbench__create-scope-dialog')
+		expect(createScopeDialog.exists()).toBe(true)
+
+		const text = createScopeDialog.text()
+		expect(text).toContain('User')
+		expect(text).toContain('Group')
+		expect(text).not.toContain('Instance')
+		expect(text).not.toContain('Where do you want to apply this rule?')
+
+		await findButtonContainingText(wrapper, 'User')?.trigger('click')
+
+		const editorModal = wrapper.find('.policy-workbench__editor-modal-body')
+		expect(editorModal.exists()).toBe(true)
+		const editorText = editorModal.text()
+		expect(editorText).toContain('Priority: User > Group > Default')
+		expect(editorText).not.toContain('This rule overrides group and default settings for selected users.')
+		expect(editorText).toContain('Target users')
+		expect(editorText).toContain('Search users')
+		expect(editorText).toContain('Simultaneous (Parallel)')
+		expect(editorText).toContain('Sequential')
+		expect(editorText).toContain('User choice')
+		expect(wrapper.text()).toContain('← Back')
+		expect(wrapper.text()).toContain('Cancel')
+		expect(editorText).not.toContain('Instance default rule')
+		expect(wrapper.find('.policy-workbench__editor-aside').exists()).toBe(false)
+
+		await findButtonContainingText(wrapper, 'Back')?.trigger('click')
+		expect(wrapper.find('.policy-workbench__create-scope-dialog').exists()).toBe(true)
+	})
+
+	it('opens the editor directly in edit mode without the type selection step', async () => {
+		const wrapper = mountWorkbench()
+
+		const openPolicyButton = findConfigureButtonForSetting(wrapper, 'Signing order')
+		expect(openPolicyButton).toBeTruthy()
+		await openPolicyButton?.trigger('click')
+
+		const actionsTrigger = wrapper.find('button[aria-label="Rule actions"]')
+		expect(actionsTrigger.exists()).toBe(true)
+		await actionsTrigger.trigger('click')
+
+		const editButton = wrapper.findAll('.nc-actions-stub__menu button').find((button) => button.text() === 'Edit')
+		expect(editButton).toBeTruthy()
+		await editButton?.trigger('click')
+
+		expect(wrapper.find('.policy-workbench__create-scope-dialog').exists()).toBe(false)
+		expect(wrapper.find('.policy-workbench__editor-aside').exists()).toBe(false)
+
+		const editorText = wrapper.find('.policy-workbench__editor-modal-body').text()
+		expect(editorText).toContain('Priority: User > Group > Default')
+		expect(editorText).not.toContain('This sets the default signing order for everyone.')
+		expect(wrapper.text()).toContain('Save changes')
+		expect(wrapper.text()).toContain('Cancel')
+		expect(wrapper.text()).not.toContain('← Back')
+	})
+
+	it('shows remove action for instance default rules', async () => {
+		getPolicy.mockImplementation((key: string) => {
+			if (key === 'signature_flow') {
+				return { effectiveValue: 'ordered_numeric', sourceScope: 'global' }
+			}
+
+			return null
+		})
+
+		const wrapper = mountWorkbench()
+
+		const openPolicyButton = findConfigureButtonForSetting(wrapper, 'Signing order')
+		expect(openPolicyButton).toBeTruthy()
+		await openPolicyButton?.trigger('click')
+
+		const actionsTrigger = wrapper.find('button[aria-label="Rule actions"]')
+		expect(actionsTrigger.exists()).toBe(true)
+		await actionsTrigger.trigger('click')
+
+		const removeButton = wrapper.findAll('.nc-actions-stub__menu button').find((button) => button.text() === 'Remove')
+		expect(removeButton).toBeTruthy()
+	})
+
+	it('allows reopening create flow after canceling a draft', async () => {
+		const wrapper = mountWorkbench()
+
+		const openPolicyButton = findConfigureButtonForSetting(wrapper, 'Signing order')
+		expect(openPolicyButton).toBeTruthy()
+		await openPolicyButton?.trigger('click')
+
+		const toolbarCreateRuleButton = wrapper.find('button.policy-workbench__crud-create-cta')
+		expect(toolbarCreateRuleButton.exists()).toBe(true)
+		await toolbarCreateRuleButton.trigger('click')
+		expect(wrapper.find('.policy-workbench__create-scope-dialog').exists()).toBe(true)
+
+		await findButtonContainingText(wrapper, 'User')?.trigger('click')
+		expect(wrapper.find('.policy-workbench__editor-modal-body').exists()).toBe(true)
+
+		const dialogCancelButton = wrapper.findAll('.dialog-footer button').find((button) => button.text() === 'Cancel')
+		expect(dialogCancelButton).toBeTruthy()
+		await dialogCancelButton?.trigger('click')
+		await Promise.resolve()
+
+		expect(wrapper.find('.policy-workbench__create-scope-dialog').exists()).toBe(false)
+
+		const toolbarCreateRuleButtonAfterSave = wrapper.find('button.policy-workbench__crud-create-cta')
+		expect(toolbarCreateRuleButtonAfterSave.exists()).toBe(true)
+		expect(toolbarCreateRuleButtonAfterSave.attributes('disabled')).toBeUndefined()
+		await toolbarCreateRuleButtonAfterSave.trigger('click')
+		expect(wrapper.find('.policy-workbench__create-scope-dialog').exists()).toBe(true)
+	})
+
+	it('shows instance option in create rule when only system default is active', async () => {
+		getPolicy.mockImplementation((key: string) => {
+			if (key === 'signature_flow') {
+				return { effectiveValue: 'ordered_numeric', sourceScope: 'system' }
+			}
+
+			return null
+		})
+
+		const wrapper = mountWorkbench()
+
+		const openPolicyButton = findConfigureButtonForSetting(wrapper, 'Signing order')
+		expect(openPolicyButton).toBeTruthy()
+		await openPolicyButton?.trigger('click')
+
+		await wrapper.find('button.policy-workbench__crud-create-cta').trigger('click')
+
+		const createScopeDialog = wrapper.find('.policy-workbench__create-scope-dialog')
+		expect(createScopeDialog.exists()).toBe(true)
+		expect(createScopeDialog.text()).toContain('Everyone')
+	})
+
+	it('shows unified default summary in system default mode', async () => {
+		getPolicy.mockImplementation((key: string) => {
+			if (key === 'signature_flow') {
+				return { effectiveValue: 'none', sourceScope: 'system' }
+			}
+
+			return null
+		})
+
+		const wrapper = mountWorkbench()
+		const openPolicyButton = findConfigureButtonForSetting(wrapper, 'Signing order')
+		expect(openPolicyButton).toBeTruthy()
+		await openPolicyButton?.trigger('click')
+
+		const text = wrapper.text()
+		expect(text).toContain('Choose whether documents are signed in order or all at once.')
+		expect(text).toContain('Default:')
+		expect(text).toContain('User choice')
+		expect(text).toContain('(default)')
+		expect(text).toContain('Change')
+		expect(text).not.toContain('Effective result:')
+		expect(text).not.toContain('No instance default is configured. This setting currently uses the system default.')
+	})
+
+	it('shows signing order with sophisticated visual interface: filter, toggle, counts, and scopes', async () => {
+		const wrapper = mountWorkbench()
+		const openPolicyButton = findConfigureButtonForSetting(wrapper, 'Signing order')
+		expect(openPolicyButton).toBeTruthy()
+		await openPolicyButton?.trigger('click')
+
+		const text = wrapper.text()
+
+		// Validate scope filter action is available in search actions area
+		expect(wrapper.find('button[aria-label="Filter rules by scope"]').exists()).toBe(true)
+
+		// Validate search/filter UI exists
+		expect(wrapper.find('input[type="text"]').exists()).toBe(true)
+		expect(text).toContain('Find setting')
+
+		// Validate settings count display is hidden
+		expect(text).not.toContain('Showing 2 settings')
+
+		// Validate toggle button exists for card/list view
+		expect(wrapper.find('.policy-workbench__catalog-view-button').exists()).toBe(true)
+
+		// Validate signing order is displayed with compact header copy
+		expect(text).toContain('Signing order')
+		expect(text).toContain('Choose whether documents are signed in order or all at once.')
+
+		// Validate default summary block content for custom default mode
+		expect(text).toContain('Default:')
+		expect(text).toContain('Sequential')
+		expect(text).toContain('(custom)')
+		expect(text).toContain('Change')
+		expect(text).toContain('Priority: User > Group > Default')
+		expect(text).not.toContain('Effective result:')
+
+		const tableHeaders = wrapper.findAll('th').map((header) => header.text())
+		expect(tableHeaders).toContain('Type')
+		expect(tableHeaders).toContain('Target')
+		expect(tableHeaders).toContain('Value')
+		expect(tableHeaders).toContain('Actions')
+		expect(tableHeaders).not.toContain('Behavior')
+
+		// Validate noisy inheritance warning is not shown by default
+		expect(text).not.toContain('Some users may not allow user overrides because their group rule requires inheritance.')
+
+		// Validate counts shown
+		expect(text).toContain('Custom rules:none')
+		expect(text).not.toContain('Custom rules active')
+
+		// Validate POC settings are NOT present
+		expect(text).not.toContain('Confetti')
+		expect(text).not.toContain('Identification factors')
+	})
+
+	it('closes the rule actions menu after clicking edit', async () => {
+		const wrapper = mountWorkbench()
+
+		const openPolicyButton = findConfigureButtonForSetting(wrapper, 'Signing order')
+		expect(openPolicyButton).toBeTruthy()
+		await openPolicyButton?.trigger('click')
+
+		const actionsTrigger = wrapper.find('button[aria-label="Rule actions"]')
+		expect(actionsTrigger.exists()).toBe(true)
+		await actionsTrigger.trigger('click')
+
+		expect(wrapper.find('.nc-actions-stub__menu').exists()).toBe(true)
+
+		const editButton = wrapper.findAll('.nc-actions-stub__menu button').find((button) => button.text() === 'Edit')
+		expect(editButton).toBeTruthy()
+		await editButton?.trigger('click')
+
+		expect(wrapper.find('.nc-actions-stub__menu').exists()).toBe(false)
+		expect(wrapper.text()).toContain('Edit rule')
+	})
+
+})
+
diff --git a/src/tests/views/Settings/SignatureFlow.spec.ts b/src/tests/views/Settings/SignatureFlow.spec.ts
deleted file mode 100644
index afaec07028..0000000000
--- a/src/tests/views/Settings/SignatureFlow.spec.ts
+++ /dev/null
@@ -1,117 +0,0 @@
-/*
- * SPDX-FileCopyrightText: 2026 LibreSign contributors
- * SPDX-License-Identifier: AGPL-3.0-or-later
- */
-
-import { beforeAll, beforeEach, describe, expect, it, vi } from 'vitest'
-import { flushPromises, mount } from '@vue/test-utils'
-
-type SignatureFlowOption = {
-	value: string
-}
-
-type SignatureFlowVm = {
-	enabled: boolean
-	selectedFlow?: SignatureFlowOption
-	onToggleChange: () => void
-}
-
-const loadStateMock = vi.fn()
-const generateOcsUrlMock = vi.fn((path: string) => path)
-const axiosPostMock = vi.fn((..._args: unknown[]) => Promise.resolve({ data: { ocs: { data: {} } } }))
-
-vi.mock('@nextcloud/initial-state', () => ({
-	loadState: (...args: unknown[]) => loadStateMock(...args),
-}))
-
-vi.mock('@nextcloud/router', () => ({
-	generateOcsUrl: (...args: unknown[]) => generateOcsUrlMock(...(args as [string])),
-}))
-
-vi.mock('@nextcloud/axios', () => ({
-	default: {
-		post: axiosPostMock,
-	},
-}))
-
-vi.mock('@nextcloud/l10n', () => globalThis.mockNextcloudL10n())
-
-let SignatureFlow: unknown
-
-const NcCheckboxRadioSwitchStub = {
-	name: 'NcCheckboxRadioSwitch',
-	props: ['modelValue', 'value', 'type'],
-	emits: ['update:modelValue'],
-	template: '<button class="checkbox-radio-switch-stub" @click="$emit(\'update:modelValue\', type === \'radio\' ? value : !modelValue)"><slot /></button>',
-}
-
-beforeAll(async () => {
-	;({ default: SignatureFlow } = await import('../../../views/Settings/SignatureFlow.vue'))
-})
-
-describe('SignatureFlow', () => {
-	beforeEach(() => {
-		loadStateMock.mockReset()
-		generateOcsUrlMock.mockClear()
-		axiosPostMock.mockClear()
-	})
-
-	it('uses boolean switch payload before saving', async () => {
-		loadStateMock.mockImplementation((_app: string, key: string, fallback: unknown) => {
-			if (key === 'signature_flow') return 'parallel'
-			return fallback
-		})
-
-		const wrapper = mount(SignatureFlow as never, {
-			global: {
-				stubs: {
-					NcSettingsSection: { template: '<div><slot /></div>' },
-					NcCheckboxRadioSwitch: NcCheckboxRadioSwitchStub,
-					NcLoadingIcon: true,
-					NcNoteCard: true,
-					NcSavingIndicatorIcon: true,
-				},
-			},
-		})
-		const vm = wrapper.vm as unknown as SignatureFlowVm
-
-		vm.enabled = false
-		vm.onToggleChange()
-		await flushPromises()
-
-		expect(axiosPostMock).toHaveBeenCalled()
-		const lastCall = axiosPostMock.mock.calls[axiosPostMock.mock.calls.length - 1] as [string, { enabled: boolean }]
-		expect(lastCall[1].enabled).toBe(false)
-	})
-
-	it('loads backend mode and persists selected radio mode', async () => {
-		loadStateMock.mockImplementation((_app: string, key: string, fallback: unknown) => {
-			if (key === 'signature_flow') return 'ordered_numeric'
-			return fallback
-		})
-
-		const wrapper = mount(SignatureFlow as never, {
-			global: {
-				stubs: {
-					NcSettingsSection: { template: '<div><slot /></div>' },
-					NcCheckboxRadioSwitch: NcCheckboxRadioSwitchStub,
-					NcLoadingIcon: true,
-					NcNoteCard: true,
-					NcSavingIndicatorIcon: true,
-				},
-			},
-		})
-		const vm = wrapper.vm as unknown as SignatureFlowVm
-		await flushPromises()
-
-		expect(vm.selectedFlow?.value).toBe('ordered_numeric')
-
-		const radioAndSwitchButtons = wrapper.findAll('.checkbox-radio-switch-stub')
-		await radioAndSwitchButtons[1].trigger('click')
-		await flushPromises()
-
-		expect(vm.selectedFlow?.value).toBe('parallel')
-		const lastCall = axiosPostMock.mock.calls[axiosPostMock.mock.calls.length - 1] as [string, { mode: string }]
-		expect(lastCall[1].mode).toBe('parallel')
-	})
-})
diff --git a/src/tests/views/Settings/Validation.spec.ts b/src/tests/views/Settings/Validation.spec.ts
index 4dda74ddd9..5411698fa3 100644
--- a/src/tests/views/Settings/Validation.spec.ts
+++ b/src/tests/views/Settings/Validation.spec.ts
@@ -114,7 +114,8 @@ describe('Settings/Validation.vue', () => {
 	})
 
 	it('resets the footer template when customization is disabled', async () => {
-		axiosGetMock.mockResolvedValue({ data: { ocs: { data: { data: '1' } } } })
+		axiosGetMock
+			.mockResolvedValue({ data: { ocs: { data: { data: '1' } } } })
 
 		const wrapper = createWrapper()
 		await flushPromises()
diff --git a/src/tests/views/Settings/usePolicyWorkbench.spec.ts b/src/tests/views/Settings/usePolicyWorkbench.spec.ts
new file mode 100644
index 0000000000..9a586299ca
--- /dev/null
+++ b/src/tests/views/Settings/usePolicyWorkbench.spec.ts
@@ -0,0 +1,110 @@
+/*
+ * SPDX-FileCopyrightText: 2026 LibreSign contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+import { describe, expect, it, vi } from 'vitest'
+
+import { createL10nMock } from '../../testHelpers/l10n.js'
+
+vi.mock('@nextcloud/l10n', () => createL10nMock())
+
+import { createPolicyWorkbenchState } from '../../../views/Settings/PolicyWorkbench/usePolicyWorkbench'
+
+describe('usePolicyWorkbench', () => {
+	it('creates, edits and removes rules across settings without duplicating shell logic', () => {
+		const state = createPolicyWorkbenchState()
+
+		state.openSetting('confetti')
+		state.startEditor({ scope: 'user' })
+		expect(state.editorDraft.value?.targetId).toBe('maria')
+		state.saveDraft()
+		expect(state.settingsState.confetti.some((rule) => rule.scope === 'user' && rule.targetId === 'maria')).toBe(true)
+
+		state.openSetting('signature_flow')
+		state.startEditor({ scope: 'group', ruleId: 'signature-group-finance' })
+		state.updateDraftAllowOverride(false)
+		state.saveDraft()
+		expect(state.settingsState.signature_flow.find((rule) => rule.id === 'signature-group-finance')?.allowChildOverride).toBe(false)
+
+		state.removeRule('signature-user-maria')
+		expect(state.settingsState.signature_flow.some((rule) => rule.id === 'signature-user-maria')).toBe(false)
+
+		state.openSetting('signature_stamp')
+		state.startEditor({ scope: 'group', ruleId: 'stamp-group-legal' })
+		state.updateDraftValue({
+			enabled: true,
+			renderMode: 'GRAPHIC_ONLY',
+			template: '{{ signer_name }}',
+			templateFontSize: 12,
+			signatureFontSize: 18,
+			signatureWidth: 240,
+			signatureHeight: 90,
+			backgroundMode: 'custom',
+			showSigningDate: true,
+		})
+		state.saveDraft()
+		expect(state.settingsState.signature_stamp.find((rule) => rule.id === 'stamp-group-legal')?.value.renderMode).toBe('GRAPHIC_ONLY')
+
+		state.openSetting('identify_factors')
+		state.startEditor({ scope: 'user', ruleId: 'identify-user-maria' })
+		state.updateDraftValue({
+			enabled: true,
+			requireAnyTwo: true,
+			factors: [
+				{
+					key: 'email',
+					label: 'Email',
+					enabled: true,
+					required: true,
+					allowCreateAccount: true,
+					signatureMethod: 'email_token',
+				},
+				{
+					key: 'sms',
+					label: 'SMS',
+					enabled: true,
+					required: true,
+					allowCreateAccount: false,
+					signatureMethod: 'sms_token',
+				},
+				{
+					key: 'whatsapp',
+					label: 'WhatsApp',
+					enabled: false,
+					required: false,
+					allowCreateAccount: false,
+					signatureMethod: 'whatsapp_token',
+				},
+				{
+					key: 'document',
+					label: 'Document data',
+					enabled: true,
+					required: false,
+					allowCreateAccount: false,
+					signatureMethod: 'document_validation',
+				},
+			],
+		})
+		state.saveDraft()
+		expect(state.settingsState.identify_factors.find((rule) => rule.id === 'identify-user-maria')?.value.requireAnyTwo).toBe(true)
+	})
+
+	it('filters the workspace for group admins to the current group and its users', () => {
+		const state = createPolicyWorkbenchState()
+
+		state.setViewMode('group-admin')
+		state.openSetting('signature_flow')
+
+		expect(state.visibleGroupRules.value).toHaveLength(1)
+		expect(state.visibleGroupRules.value[0]?.targetId).toBe('finance')
+		expect(state.visibleUserRules.value.every((rule) => ['maria', 'joao'].includes(rule.targetId ?? ''))).toBe(true)
+
+		state.startEditor({ scope: 'user' })
+		expect(state.editorDraft.value?.targetId).toBe('joao')
+
+		const summaryKeys = state.visibleSettingSummaries.value.map((summary) => summary.key)
+		expect(summaryKeys).toContain('signature_stamp')
+		expect(summaryKeys).toContain('identify_factors')
+	})
+})
diff --git a/src/types/index.ts b/src/types/index.ts
index a12fa7f3d6..bdc490b191 100644
--- a/src/types/index.ts
+++ b/src/types/index.ts
@@ -6,6 +6,7 @@
 import type { components as ApiComponents } from './openapi/openapi'
 import type { operations as ApiOperations } from './openapi/openapi'
 import type { components as AdminComponents } from './openapi/openapi-administration'
+import type { operations as AdminOperations } from './openapi/openapi-administration'
 
 type ApiJsonBody<TRequestBody> = TRequestBody extends {
 	content: {
@@ -44,8 +45,43 @@ type ApiRequestJsonBody<TOperation> = ApiJsonBody<ApiOperationRequestBody<TOpera
 type ApiOcsResponseData<TOperation, TStatusCode extends keyof ApiOperationResponses<TOperation>>
 	= ApiOcsJsonData<ApiOperationResponses<TOperation>[TStatusCode]>
 
+type ApiRecordValue<TRecord> = TRecord extends Record<string, infer TValue>
+	? TValue
+	: never
+
 export type SignatureFlowMode = ApiComponents['schemas']['DetailedFileResponse']['signatureFlow']
 export type SignatureFlowValue = SignatureFlowMode | 0 | 1 | 2
+export type EffectivePoliciesResponse = ApiOcsResponseData<ApiOperations['policy-effective'], 200>
+export type EffectivePoliciesState = EffectivePoliciesResponse['policies']
+export type EffectivePolicyState = ApiRecordValue<EffectivePoliciesState>
+export type EffectivePolicyValue = Exclude<ApiRequestJsonBody<AdminOperations['policy-set-system']>['value'], undefined>
+export type GroupPolicyResponse = ApiOcsResponseData<ApiOperations['policy-get-group'], 200>
+export type GroupPolicyState = GroupPolicyResponse['policy']
+export type SystemPolicyState = {
+	policyKey: string
+	scope: 'system' | 'global'
+	value: EffectivePolicyValue | null
+	allowChildOverride: boolean
+	visibleToChild: boolean
+	allowedValues: EffectivePolicyValue[]
+}
+export type SystemPolicyResponse = {
+	policy: SystemPolicyState
+}
+export type UserPolicyState = {
+	policyKey: string
+	scope: 'user'
+	targetId: string
+	value: EffectivePolicyValue | null
+}
+export type UserPolicyResponse = {
+	policy: UserPolicyState
+}
+export type GroupPolicyWritePayload = ApiRequestJsonBody<ApiOperations['policy-set-group']>
+export type GroupPolicyWriteResponse = ApiOcsResponseData<ApiOperations['policy-set-group'], 200>
+export type SystemPolicyWritePayload = ApiRequestJsonBody<AdminOperations['policy-set-system']>
+export type SystemPolicyWriteResponse = ApiOcsResponseData<AdminOperations['policy-set-system'], 200>
+export type SystemPolicyWriteErrorResponse = ApiOcsResponseData<AdminOperations['policy-set-system'], 400>
 export type NewFilePayload = ApiComponents['schemas']['NewFile']
 export type IdentifyMethodRecord = ApiComponents['schemas']['IdentifyMethod']
 export type IdentifyAccountRecord = ApiComponents['schemas']['IdentifyAccount']
diff --git a/src/types/openapi/openapi-administration.ts b/src/types/openapi/openapi-administration.ts
index 1038d0e772..0299a403e7 100644
--- a/src/types/openapi/openapi-administration.ts
+++ b/src/types/openapi/openapi-administration.ts
@@ -365,26 +365,6 @@ export type paths = {
         patch?: never;
         trace?: never;
     };
-    "/ocs/v2.php/apps/libresign/api/{apiVersion}/admin/signature-flow/config": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        get?: never;
-        put?: never;
-        /**
-         * Set signature flow configuration
-         * @description This endpoint requires admin access
-         */
-        post: operations["admin-set-signature-flow-config"];
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
     "/ocs/v2.php/apps/libresign/api/{apiVersion}/admin/docmdp/config": {
         parameters: {
             query?: never;
@@ -465,6 +445,58 @@ export type paths = {
         patch?: never;
         trace?: never;
     };
+    "/ocs/v2.php/apps/libresign/api/{apiVersion}/policies/system/{policyKey}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Read explicit system policy configuration
+         * @description This endpoint requires admin access
+         */
+        get: operations["policy-get-system"];
+        put?: never;
+        /**
+         * Save a system-level policy value
+         * @description This endpoint requires admin access
+         */
+        post: operations["policy-set-system"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/ocs/v2.php/apps/libresign/api/{apiVersion}/policies/user/{userId}/{policyKey}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Read a user-level policy preference for a target user (admin scope)
+         * @description This endpoint requires admin access
+         */
+        get: operations["policy-get-user-policy-for-user"];
+        /**
+         * Save a user policy preference for a target user (admin scope)
+         * @description This endpoint requires admin access
+         */
+        put: operations["policy-set-user-policy-for-user"];
+        post?: never;
+        /**
+         * Clear a user policy preference for a target user (admin scope)
+         * @description This endpoint requires admin access
+         */
+        delete: operations["policy-clear-user-policy-for-user"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/ocs/v2.php/apps/libresign/api/{apiVersion}/setting/has-root-cert": {
         parameters: {
             query?: never;
@@ -583,6 +615,22 @@ export type components = {
             success: boolean;
             message: string;
         };
+        EffectivePolicyResponse: {
+            policy: components["schemas"]["EffectivePolicyState"];
+        };
+        EffectivePolicyState: {
+            policyKey: string;
+            effectiveValue: components["schemas"]["EffectivePolicyValue"];
+            sourceScope: string;
+            visible: boolean;
+            editableByCurrentActor: boolean;
+            allowedValues: components["schemas"]["EffectivePolicyValue"][];
+            canSaveAsUserDefault: boolean;
+            canUseAsRequestOverride: boolean;
+            preferenceWasCleared: boolean;
+            blockedBy: string | null;
+        };
+        EffectivePolicyValue: (boolean | number | string) | null;
         EngineHandler: {
             configPath: string;
             cfsslUri?: string;
@@ -705,6 +753,30 @@ export type components = {
             /** @enum {string} */
             status: "success";
         };
+        SystemPolicyResponse: {
+            policy: components["schemas"]["SystemPolicyState"];
+        };
+        SystemPolicyState: {
+            policyKey: string;
+            /** @enum {string} */
+            scope: "system" | "global";
+            value: components["schemas"]["EffectivePolicyValue"];
+            allowChildOverride: boolean;
+            visibleToChild: boolean;
+            allowedValues: components["schemas"]["EffectivePolicyValue"][];
+        };
+        SystemPolicyWriteResponse: components["schemas"]["MessageResponse"] & components["schemas"]["EffectivePolicyResponse"];
+        UserPolicyResponse: {
+            policy: components["schemas"]["UserPolicyState"];
+        };
+        UserPolicyState: {
+            policyKey: string;
+            /** @enum {string} */
+            scope: "user";
+            targetId: string;
+            value: components["schemas"]["EffectivePolicyValue"];
+        };
+        UserPolicyWriteResponse: components["schemas"]["MessageResponse"] & components["schemas"]["UserPolicyResponse"];
     };
     responses: never;
     parameters: never;
@@ -1781,73 +1853,6 @@ export interface operations {
             };
         };
     };
-    "admin-set-signature-flow-config": {
-        parameters: {
-            query?: never;
-            header: {
-                /** @description Required to be true for the API request to pass */
-                "OCS-APIRequest": boolean;
-            };
-            path: {
-                apiVersion: "v1";
-            };
-            cookie?: never;
-        };
-        requestBody: {
-            content: {
-                "application/json": {
-                    /** @description Whether to force a signature flow for all documents */
-                    enabled: boolean;
-                    /** @description Signature flow mode: 'parallel' or 'ordered_numeric' (only used when enabled is true) */
-                    mode?: string | null;
-                };
-            };
-        };
-        responses: {
-            /** @description Configuration saved successfully */
-            200: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": {
-                        ocs: {
-                            meta: components["schemas"]["OCSMeta"];
-                            data: components["schemas"]["MessageResponse"];
-                        };
-                    };
-                };
-            };
-            /** @description Invalid signature flow mode provided */
-            400: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": {
-                        ocs: {
-                            meta: components["schemas"]["OCSMeta"];
-                            data: components["schemas"]["ErrorResponse"];
-                        };
-                    };
-                };
-            };
-            /** @description Internal server error */
-            500: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": {
-                        ocs: {
-                            meta: components["schemas"]["OCSMeta"];
-                            data: components["schemas"]["ErrorResponse"];
-                        };
-                    };
-                };
-            };
-        };
-    };
     "admin-set-doc-mdp-config": {
         parameters: {
             query?: never;
@@ -2087,6 +2092,219 @@ export interface operations {
             };
         };
     };
+    "policy-get-system": {
+        parameters: {
+            query?: never;
+            header: {
+                /** @description Required to be true for the API request to pass */
+                "OCS-APIRequest": boolean;
+            };
+            path: {
+                apiVersion: "v1";
+                /** @description Policy identifier to read from the system layer. */
+                policyKey: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        ocs: {
+                            meta: components["schemas"]["OCSMeta"];
+                            data: components["schemas"]["SystemPolicyResponse"];
+                        };
+                    };
+                };
+            };
+        };
+    };
+    "policy-set-system": {
+        parameters: {
+            query?: never;
+            header: {
+                /** @description Required to be true for the API request to pass */
+                "OCS-APIRequest": boolean;
+            };
+            path: {
+                apiVersion: "v1";
+                /** @description Policy identifier to persist at the system layer. */
+                policyKey: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: {
+            content: {
+                "application/json": {
+                    /** @description Policy value to persist. Null resets the policy to its default system value. */
+                    value?: (boolean | number | string) | null;
+                    /**
+                     * @description Whether lower layers may override this system default.
+                     * @default false
+                     */
+                    allowChildOverride?: boolean;
+                };
+            };
+        };
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        ocs: {
+                            meta: components["schemas"]["OCSMeta"];
+                            data: components["schemas"]["SystemPolicyWriteResponse"];
+                        };
+                    };
+                };
+            };
+            /** @description Invalid policy value */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        ocs: {
+                            meta: components["schemas"]["OCSMeta"];
+                            data: components["schemas"]["ErrorResponse"];
+                        };
+                    };
+                };
+            };
+        };
+    };
+    "policy-get-user-policy-for-user": {
+        parameters: {
+            query?: never;
+            header: {
+                /** @description Required to be true for the API request to pass */
+                "OCS-APIRequest": boolean;
+            };
+            path: {
+                apiVersion: "v1";
+                /** @description Target user identifier that receives the policy preference. */
+                userId: string;
+                /** @description Policy identifier to read for the selected user. */
+                policyKey: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        ocs: {
+                            meta: components["schemas"]["OCSMeta"];
+                            data: components["schemas"]["UserPolicyResponse"];
+                        };
+                    };
+                };
+            };
+        };
+    };
+    "policy-set-user-policy-for-user": {
+        parameters: {
+            query?: never;
+            header: {
+                /** @description Required to be true for the API request to pass */
+                "OCS-APIRequest": boolean;
+            };
+            path: {
+                apiVersion: "v1";
+                /** @description Target user identifier that receives the policy preference. */
+                userId: string;
+                /** @description Policy identifier to persist for the target user. */
+                policyKey: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: {
+            content: {
+                "application/json": {
+                    /** @description Policy value to persist as target user preference. */
+                    value?: (boolean | number | string) | null;
+                };
+            };
+        };
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        ocs: {
+                            meta: components["schemas"]["OCSMeta"];
+                            data: components["schemas"]["UserPolicyWriteResponse"];
+                        };
+                    };
+                };
+            };
+            /** @description Invalid policy value */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        ocs: {
+                            meta: components["schemas"]["OCSMeta"];
+                            data: components["schemas"]["ErrorResponse"];
+                        };
+                    };
+                };
+            };
+        };
+    };
+    "policy-clear-user-policy-for-user": {
+        parameters: {
+            query?: never;
+            header: {
+                /** @description Required to be true for the API request to pass */
+                "OCS-APIRequest": boolean;
+            };
+            path: {
+                apiVersion: "v1";
+                /** @description Target user identifier that receives the policy preference removal. */
+                userId: string;
+                /** @description Policy identifier to clear for the target user. */
+                policyKey: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        ocs: {
+                            meta: components["schemas"]["OCSMeta"];
+                            data: components["schemas"]["UserPolicyWriteResponse"];
+                        };
+                    };
+                };
+            };
+        };
+    };
     "setting-has-root-cert": {
         parameters: {
             query?: never;
diff --git a/src/types/openapi/openapi-full.ts b/src/types/openapi/openapi-full.ts
index 772db24646..e84bb52867 100644
--- a/src/types/openapi/openapi-full.ts
+++ b/src/types/openapi/openapi-full.ts
@@ -852,6 +852,60 @@ export type paths = {
         patch?: never;
         trace?: never;
     };
+    "/ocs/v2.php/apps/libresign/api/{apiVersion}/policies/effective": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** Effective policies bootstrap */
+        get: operations["policy-effective"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/ocs/v2.php/apps/libresign/api/{apiVersion}/policies/group/{groupId}/{policyKey}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** Read a group-level policy value */
+        get: operations["policy-get-group"];
+        /** Save a group-level policy value */
+        put: operations["policy-set-group"];
+        post?: never;
+        /** Clear a group-level policy value */
+        delete: operations["policy-clear-group"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/ocs/v2.php/apps/libresign/api/{apiVersion}/policies/user/{policyKey}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        /** Save a user policy preference */
+        put: operations["policy-set-user-preference"];
+        post?: never;
+        /** Clear a user policy preference */
+        delete: operations["policy-clear-user-preference"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/ocs/v2.php/apps/libresign/api/{apiVersion}/request-signature": {
         parameters: {
             query?: never;
@@ -1400,26 +1454,6 @@ export type paths = {
         patch?: never;
         trace?: never;
     };
-    "/ocs/v2.php/apps/libresign/api/{apiVersion}/admin/signature-flow/config": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        get?: never;
-        put?: never;
-        /**
-         * Set signature flow configuration
-         * @description This endpoint requires admin access
-         */
-        post: operations["admin-set-signature-flow-config"];
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
     "/ocs/v2.php/apps/libresign/api/{apiVersion}/admin/docmdp/config": {
         parameters: {
             query?: never;
@@ -1500,6 +1534,58 @@ export type paths = {
         patch?: never;
         trace?: never;
     };
+    "/ocs/v2.php/apps/libresign/api/{apiVersion}/policies/system/{policyKey}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Read explicit system policy configuration
+         * @description This endpoint requires admin access
+         */
+        get: operations["policy-get-system"];
+        put?: never;
+        /**
+         * Save a system-level policy value
+         * @description This endpoint requires admin access
+         */
+        post: operations["policy-set-system"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/ocs/v2.php/apps/libresign/api/{apiVersion}/policies/user/{userId}/{policyKey}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Read a user-level policy preference for a target user (admin scope)
+         * @description This endpoint requires admin access
+         */
+        get: operations["policy-get-user-policy-for-user"];
+        /**
+         * Save a user policy preference for a target user (admin scope)
+         * @description This endpoint requires admin access
+         */
+        put: operations["policy-set-user-policy-for-user"];
+        post?: never;
+        /**
+         * Clear a user policy preference for a target user (admin scope)
+         * @description This endpoint requires admin access
+         */
+        delete: operations["policy-clear-user-policy-for-user"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/ocs/v2.php/apps/libresign/api/{apiVersion}/setting/has-root-cert": {
         parameters: {
             query?: never;
@@ -1782,6 +1868,27 @@ export type components = {
             label: string;
             description: string;
         };
+        EffectivePoliciesResponse: {
+            policies: {
+                [key: string]: components["schemas"]["EffectivePolicyState"];
+            };
+        };
+        EffectivePolicyResponse: {
+            policy: components["schemas"]["EffectivePolicyState"];
+        };
+        EffectivePolicyState: {
+            policyKey: string;
+            effectiveValue: components["schemas"]["EffectivePolicyValue"];
+            sourceScope: string;
+            visible: boolean;
+            editableByCurrentActor: boolean;
+            allowedValues: components["schemas"]["EffectivePolicyValue"][];
+            canSaveAsUserDefault: boolean;
+            canUseAsRequestOverride: boolean;
+            preferenceWasCleared: boolean;
+            blockedBy: string | null;
+        };
+        EffectivePolicyValue: (boolean | number | string) | null;
         EngineHandler: {
             configPath: string;
             cfsslUri?: string;
@@ -1922,6 +2029,24 @@ export type components = {
             /** Format: int64 */
             preview_height: number;
         };
+        GroupPolicyResponse: {
+            policy: components["schemas"]["GroupPolicyState"];
+        };
+        GroupPolicyState: {
+            policyKey: string;
+            /** @enum {string} */
+            scope: "group";
+            targetId: string;
+            value: components["schemas"]["EffectivePolicyValue"];
+            allowChildOverride: boolean;
+            visibleToChild: boolean;
+            allowedValues: components["schemas"]["EffectivePolicyValue"][];
+        };
+        GroupPolicyWriteRequest: {
+            value: components["schemas"]["EffectivePolicyValue"];
+            allowChildOverride: boolean;
+        };
+        GroupPolicyWriteResponse: components["schemas"]["MessageResponse"] & components["schemas"]["GroupPolicyResponse"];
         HasRootCertResponse: {
             hasRootCert: boolean;
         };
@@ -2034,6 +2159,15 @@ export type components = {
             OID: string;
             CPS: string;
         };
+        PolicySnapshotEntry: {
+            effectiveValue: string;
+            sourceScope: string;
+        };
+        PolicySnapshotNumericEntry: {
+            /** Format: int64 */
+            effectiveValue: number;
+            sourceScope: string;
+        };
         ProgressError: {
             message: string;
             /** Format: int64 */
@@ -2229,6 +2363,22 @@ export type components = {
             /** @enum {string} */
             status: "success";
         };
+        SystemPolicyResponse: {
+            policy: components["schemas"]["SystemPolicyState"];
+        };
+        SystemPolicyState: {
+            policyKey: string;
+            /** @enum {string} */
+            scope: "system" | "global";
+            value: components["schemas"]["EffectivePolicyValue"];
+            allowChildOverride: boolean;
+            visibleToChild: boolean;
+            allowedValues: components["schemas"]["EffectivePolicyValue"][];
+        };
+        SystemPolicyWriteRequest: {
+            value: components["schemas"]["EffectivePolicyValue"];
+        };
+        SystemPolicyWriteResponse: components["schemas"]["MessageResponse"] & components["schemas"]["EffectivePolicyResponse"];
         UserElement: {
             /** Format: int64 */
             id: number;
@@ -2253,6 +2403,17 @@ export type components = {
         UserElementsResponse: {
             elements: components["schemas"]["UserElement"][];
         };
+        UserPolicyResponse: {
+            policy: components["schemas"]["UserPolicyState"];
+        };
+        UserPolicyState: {
+            policyKey: string;
+            /** @enum {string} */
+            scope: "user";
+            targetId: string;
+            value: components["schemas"]["EffectivePolicyValue"];
+        };
+        UserPolicyWriteResponse: components["schemas"]["MessageResponse"] & components["schemas"]["UserPolicyResponse"];
         ValidateMetadata: {
             extension: string;
             /** Format: int64 */
@@ -2264,9 +2425,14 @@ export type components = {
                 h: number;
             }[];
             original_file_deleted?: boolean;
+            policy_snapshot?: components["schemas"]["ValidatePolicySnapshot"];
             pdfVersion?: string;
             status_changed_at?: string;
         };
+        ValidatePolicySnapshot: {
+            docmdp?: components["schemas"]["PolicySnapshotNumericEntry"];
+            signature_flow?: components["schemas"]["PolicySnapshotEntry"];
+        };
         ValidatedChildFile: {
             /** Format: int64 */
             id: number;
@@ -4577,7 +4743,7 @@ export interface operations {
             };
         };
     };
-    "request_signature-request": {
+    "policy-effective": {
         parameters: {
             query?: never;
             header: {
@@ -4589,47 +4755,7 @@ export interface operations {
             };
             cookie?: never;
         };
-        requestBody?: {
-            content: {
-                "application/json": {
-                    /**
-                     * @description Collection of signers who must sign the document. Use identifyMethods as the canonical format. Other supported fields: displayName, description, notify, signingOrder, status
-                     * @default []
-                     */
-                    signers?: components["schemas"]["NewSigner"][];
-                    /**
-                     * @description The name of file to sign
-                     * @default
-                     */
-                    name?: string;
-                    /**
-                     * @description Settings to define how and where the file should be stored
-                     * @default []
-                     */
-                    settings?: components["schemas"]["FolderSettings"];
-                    /**
-                     * @description File object. Supports nodeId, url, base64 or path.
-                     * @default []
-                     */
-                    file?: components["schemas"]["NewFile"];
-                    /**
-                     * @description Multiple files to create an envelope (optional, use either file or files). Each file supports nodeId, url, base64 or path.
-                     * @default []
-                     */
-                    files?: components["schemas"]["NewFile"][];
-                    /** @description URL that will receive a POST after the document is signed */
-                    callback?: string | null;
-                    /**
-                     * Format: int64
-                     * @description Numeric code of status * 0 - no signers * 1 - signed * 2 - pending
-                     * @default 1
-                     */
-                    status?: number | null;
-                    /** @description Signature flow mode: 'parallel' or 'ordered_numeric'. If not provided, uses global configuration */
-                    signatureFlow?: string | null;
-                };
-            };
-        };
+        requestBody?: never;
         responses: {
             /** @description OK */
             200: {
@@ -4640,28 +4766,14 @@ export interface operations {
                     "application/json": {
                         ocs: {
                             meta: components["schemas"]["OCSMeta"];
-                            data: components["schemas"]["DetailedFileResponse"];
-                        };
-                    };
-                };
-            };
-            /** @description Unauthorized */
-            422: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": {
-                        ocs: {
-                            meta: components["schemas"]["OCSMeta"];
-                            data: components["schemas"]["MessageResponse"] | components["schemas"]["ActionErrorResponse"];
+                            data: components["schemas"]["EffectivePoliciesResponse"];
                         };
                     };
                 };
             };
         };
     };
-    "request_signature-update-sign": {
+    "policy-get-group": {
         parameters: {
             query?: never;
             header: {
@@ -4670,48 +4782,14 @@ export interface operations {
             };
             path: {
                 apiVersion: "v1";
+                /** @description Group identifier that receives the policy binding. */
+                groupId: string;
+                /** @description Policy identifier to read for the selected group. */
+                policyKey: string;
             };
             cookie?: never;
         };
-        requestBody?: {
-            content: {
-                "application/json": {
-                    /**
-                     * @description Collection of signers who must sign the document. Use identifyMethods as the canonical format.
-                     * @default []
-                     */
-                    signers?: components["schemas"]["NewSigner"][] | null;
-                    /** @description UUID of sign request. The signer UUID is what the person receives via email when asked to sign. This is not the file UUID. */
-                    uuid?: string | null;
-                    /** @description Visible elements on document */
-                    visibleElements?: components["schemas"]["VisibleElement"][] | null;
-                    /**
-                     * @description File object. Supports nodeId, url, base64 or path when creating a new request.
-                     * @default []
-                     */
-                    file?: (components["schemas"]["NewFile"] | unknown[]) | null;
-                    /**
-                     * Format: int64
-                     * @description Numeric code of status * 0 - no signers * 1 - signed * 2 - pending
-                     */
-                    status?: number | null;
-                    /** @description Signature flow mode: 'parallel' or 'ordered_numeric'. If not provided, uses global configuration */
-                    signatureFlow?: string | null;
-                    /** @description The name of file to sign */
-                    name?: string | null;
-                    /**
-                     * @description Settings to define how and where the file should be stored
-                     * @default []
-                     */
-                    settings?: components["schemas"]["FolderSettings"];
-                    /**
-                     * @description Multiple files to create an envelope (optional, use either file or files). Each file supports nodeId, url, base64 or path.
-                     * @default []
-                     */
-                    files?: components["schemas"]["NewFile"][];
-                };
-            };
-        };
+        requestBody?: never;
         responses: {
             /** @description OK */
             200: {
@@ -4722,13 +4800,13 @@ export interface operations {
                     "application/json": {
                         ocs: {
                             meta: components["schemas"]["OCSMeta"];
-                            data: components["schemas"]["DetailedFileResponse"];
+                            data: components["schemas"]["GroupPolicyResponse"];
                         };
                     };
                 };
             };
-            /** @description Unauthorized */
-            422: {
+            /** @description Forbidden */
+            403: {
                 headers: {
                     [name: string]: unknown;
                 };
@@ -4736,14 +4814,14 @@ export interface operations {
                     "application/json": {
                         ocs: {
                             meta: components["schemas"]["OCSMeta"];
-                            data: components["schemas"]["MessageResponse"] | components["schemas"]["ActionErrorResponse"];
+                            data: components["schemas"]["ErrorResponse"];
                         };
                     };
                 };
             };
         };
     };
-    "request_signature-delete-one-request-signature-using-file-id": {
+    "policy-set-group": {
         parameters: {
             query?: never;
             header: {
@@ -4752,14 +4830,26 @@ export interface operations {
             };
             path: {
                 apiVersion: "v1";
-                /** @description LibreSign file ID */
-                fileId: number;
-                /** @description The sign request id */
-                signRequestId: number;
+                /** @description Group identifier that receives the policy binding. */
+                groupId: string;
+                /** @description Policy identifier to persist at the group layer. */
+                policyKey: string;
             };
             cookie?: never;
         };
-        requestBody?: never;
+        requestBody?: {
+            content: {
+                "application/json": {
+                    /** @description Policy value to persist for the group. */
+                    value?: (boolean | number | string) | null;
+                    /**
+                     * @description Whether users and requests below this group may override the group default.
+                     * @default false
+                     */
+                    allowChildOverride?: boolean;
+                };
+            };
+        };
         responses: {
             /** @description OK */
             200: {
@@ -4770,13 +4860,13 @@ export interface operations {
                     "application/json": {
                         ocs: {
                             meta: components["schemas"]["OCSMeta"];
-                            data: components["schemas"]["MessageResponse"];
+                            data: components["schemas"]["GroupPolicyWriteResponse"];
                         };
                     };
                 };
             };
-            /** @description Failed */
-            401: {
+            /** @description Invalid policy value */
+            400: {
                 headers: {
                     [name: string]: unknown;
                 };
@@ -4784,13 +4874,13 @@ export interface operations {
                     "application/json": {
                         ocs: {
                             meta: components["schemas"]["OCSMeta"];
-                            data: components["schemas"]["MessageResponse"];
+                            data: components["schemas"]["ErrorResponse"];
                         };
                     };
                 };
             };
-            /** @description Failed */
-            422: {
+            /** @description Forbidden */
+            403: {
                 headers: {
                     [name: string]: unknown;
                 };
@@ -4798,14 +4888,14 @@ export interface operations {
                     "application/json": {
                         ocs: {
                             meta: components["schemas"]["OCSMeta"];
-                            data: components["schemas"]["ActionErrorResponse"];
+                            data: components["schemas"]["ErrorResponse"];
                         };
                     };
                 };
             };
         };
     };
-    "sign_file-sign-using-file-id": {
+    "policy-clear-group": {
         parameters: {
             query?: never;
             header: {
@@ -4814,20 +4904,381 @@ export interface operations {
             };
             path: {
                 apiVersion: "v1";
-                /** @description Id of LibreSign file */
-                fileId: number;
+                /** @description Group identifier that receives the policy binding. */
+                groupId: string;
+                /** @description Policy identifier to clear for the selected group. */
+                policyKey: string;
             };
             cookie?: never;
         };
-        requestBody: {
-            content: {
-                "application/json": {
-                    /** @description Signature method */
-                    method: string;
-                    /**
-                     * @description List of visible elements
-                     * @default {}
-                     */
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        ocs: {
+                            meta: components["schemas"]["OCSMeta"];
+                            data: components["schemas"]["GroupPolicyWriteResponse"];
+                        };
+                    };
+                };
+            };
+            /** @description Forbidden */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        ocs: {
+                            meta: components["schemas"]["OCSMeta"];
+                            data: components["schemas"]["ErrorResponse"];
+                        };
+                    };
+                };
+            };
+        };
+    };
+    "policy-set-user-preference": {
+        parameters: {
+            query?: never;
+            header: {
+                /** @description Required to be true for the API request to pass */
+                "OCS-APIRequest": boolean;
+            };
+            path: {
+                apiVersion: "v1";
+                /** @description Policy identifier to persist for the current user. */
+                policyKey: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: {
+            content: {
+                "application/json": {
+                    /** @description Policy value to persist as the current user's default. */
+                    value?: (boolean | number | string) | null;
+                };
+            };
+        };
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        ocs: {
+                            meta: components["schemas"]["OCSMeta"];
+                            data: components["schemas"]["SystemPolicyWriteResponse"];
+                        };
+                    };
+                };
+            };
+            /** @description Invalid policy value */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        ocs: {
+                            meta: components["schemas"]["OCSMeta"];
+                            data: components["schemas"]["ErrorResponse"];
+                        };
+                    };
+                };
+            };
+        };
+    };
+    "policy-clear-user-preference": {
+        parameters: {
+            query?: never;
+            header: {
+                /** @description Required to be true for the API request to pass */
+                "OCS-APIRequest": boolean;
+            };
+            path: {
+                apiVersion: "v1";
+                /** @description Policy identifier to clear for the current user. */
+                policyKey: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        ocs: {
+                            meta: components["schemas"]["OCSMeta"];
+                            data: components["schemas"]["SystemPolicyWriteResponse"];
+                        };
+                    };
+                };
+            };
+        };
+    };
+    "request_signature-request": {
+        parameters: {
+            query?: never;
+            header: {
+                /** @description Required to be true for the API request to pass */
+                "OCS-APIRequest": boolean;
+            };
+            path: {
+                apiVersion: "v1";
+            };
+            cookie?: never;
+        };
+        requestBody?: {
+            content: {
+                "application/json": {
+                    /**
+                     * @description Collection of signers who must sign the document. Use identifyMethods as the canonical format. Other supported fields: displayName, description, notify, signingOrder, status
+                     * @default []
+                     */
+                    signers?: components["schemas"]["NewSigner"][];
+                    /**
+                     * @description The name of file to sign
+                     * @default
+                     */
+                    name?: string;
+                    /**
+                     * @description Settings to define how and where the file should be stored
+                     * @default []
+                     */
+                    settings?: components["schemas"]["FolderSettings"];
+                    /**
+                     * @description File object. Supports nodeId, url, base64 or path.
+                     * @default []
+                     */
+                    file?: components["schemas"]["NewFile"];
+                    /**
+                     * @description Multiple files to create an envelope (optional, use either file or files). Each file supports nodeId, url, base64 or path.
+                     * @default []
+                     */
+                    files?: components["schemas"]["NewFile"][];
+                    /** @description URL that will receive a POST after the document is signed */
+                    callback?: string | null;
+                    /**
+                     * Format: int64
+                     * @description Numeric code of status * 0 - no signers * 1 - signed * 2 - pending
+                     * @default 1
+                     */
+                    status?: number | null;
+                    /** @description Signature flow mode: 'parallel' or 'ordered_numeric'. If not provided, uses the effective policy resolution. */
+                    signatureFlow?: string | null;
+                };
+            };
+        };
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        ocs: {
+                            meta: components["schemas"]["OCSMeta"];
+                            data: components["schemas"]["DetailedFileResponse"];
+                        };
+                    };
+                };
+            };
+            /** @description Unauthorized */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        ocs: {
+                            meta: components["schemas"]["OCSMeta"];
+                            data: components["schemas"]["MessageResponse"] | components["schemas"]["ActionErrorResponse"];
+                        };
+                    };
+                };
+            };
+        };
+    };
+    "request_signature-update-sign": {
+        parameters: {
+            query?: never;
+            header: {
+                /** @description Required to be true for the API request to pass */
+                "OCS-APIRequest": boolean;
+            };
+            path: {
+                apiVersion: "v1";
+            };
+            cookie?: never;
+        };
+        requestBody?: {
+            content: {
+                "application/json": {
+                    /**
+                     * @description Collection of signers who must sign the document. Use identifyMethods as the canonical format.
+                     * @default []
+                     */
+                    signers?: components["schemas"]["NewSigner"][] | null;
+                    /** @description UUID of sign request. The signer UUID is what the person receives via email when asked to sign. This is not the file UUID. */
+                    uuid?: string | null;
+                    /** @description Visible elements on document */
+                    visibleElements?: components["schemas"]["VisibleElement"][] | null;
+                    /**
+                     * @description File object. Supports nodeId, url, base64 or path when creating a new request.
+                     * @default []
+                     */
+                    file?: (components["schemas"]["NewFile"] | unknown[]) | null;
+                    /**
+                     * Format: int64
+                     * @description Numeric code of status * 0 - no signers * 1 - signed * 2 - pending
+                     */
+                    status?: number | null;
+                    /** @description Signature flow mode: 'parallel' or 'ordered_numeric'. If not provided, uses the effective policy resolution. */
+                    signatureFlow?: string | null;
+                    /** @description The name of file to sign */
+                    name?: string | null;
+                    /**
+                     * @description Settings to define how and where the file should be stored
+                     * @default []
+                     */
+                    settings?: components["schemas"]["FolderSettings"];
+                    /**
+                     * @description Multiple files to create an envelope (optional, use either file or files). Each file supports nodeId, url, base64 or path.
+                     * @default []
+                     */
+                    files?: components["schemas"]["NewFile"][];
+                };
+            };
+        };
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        ocs: {
+                            meta: components["schemas"]["OCSMeta"];
+                            data: components["schemas"]["DetailedFileResponse"];
+                        };
+                    };
+                };
+            };
+            /** @description Unauthorized */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        ocs: {
+                            meta: components["schemas"]["OCSMeta"];
+                            data: components["schemas"]["MessageResponse"] | components["schemas"]["ActionErrorResponse"];
+                        };
+                    };
+                };
+            };
+        };
+    };
+    "request_signature-delete-one-request-signature-using-file-id": {
+        parameters: {
+            query?: never;
+            header: {
+                /** @description Required to be true for the API request to pass */
+                "OCS-APIRequest": boolean;
+            };
+            path: {
+                apiVersion: "v1";
+                /** @description LibreSign file ID */
+                fileId: number;
+                /** @description The sign request id */
+                signRequestId: number;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        ocs: {
+                            meta: components["schemas"]["OCSMeta"];
+                            data: components["schemas"]["MessageResponse"];
+                        };
+                    };
+                };
+            };
+            /** @description Failed */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        ocs: {
+                            meta: components["schemas"]["OCSMeta"];
+                            data: components["schemas"]["MessageResponse"];
+                        };
+                    };
+                };
+            };
+            /** @description Failed */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        ocs: {
+                            meta: components["schemas"]["OCSMeta"];
+                            data: components["schemas"]["ActionErrorResponse"];
+                        };
+                    };
+                };
+            };
+        };
+    };
+    "sign_file-sign-using-file-id": {
+        parameters: {
+            query?: never;
+            header: {
+                /** @description Required to be true for the API request to pass */
+                "OCS-APIRequest": boolean;
+            };
+            path: {
+                apiVersion: "v1";
+                /** @description Id of LibreSign file */
+                fileId: number;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description Signature method */
+                    method: string;
+                    /**
+                     * @description List of visible elements
+                     * @default {}
+                     */
                     elements?: {
                         [key: string]: Record<string, never>;
                     };
@@ -6528,73 +6979,6 @@ export interface operations {
             };
         };
     };
-    "admin-set-signature-flow-config": {
-        parameters: {
-            query?: never;
-            header: {
-                /** @description Required to be true for the API request to pass */
-                "OCS-APIRequest": boolean;
-            };
-            path: {
-                apiVersion: "v1";
-            };
-            cookie?: never;
-        };
-        requestBody: {
-            content: {
-                "application/json": {
-                    /** @description Whether to force a signature flow for all documents */
-                    enabled: boolean;
-                    /** @description Signature flow mode: 'parallel' or 'ordered_numeric' (only used when enabled is true) */
-                    mode?: string | null;
-                };
-            };
-        };
-        responses: {
-            /** @description Configuration saved successfully */
-            200: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": {
-                        ocs: {
-                            meta: components["schemas"]["OCSMeta"];
-                            data: components["schemas"]["MessageResponse"];
-                        };
-                    };
-                };
-            };
-            /** @description Invalid signature flow mode provided */
-            400: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": {
-                        ocs: {
-                            meta: components["schemas"]["OCSMeta"];
-                            data: components["schemas"]["ErrorResponse"];
-                        };
-                    };
-                };
-            };
-            /** @description Internal server error */
-            500: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": {
-                        ocs: {
-                            meta: components["schemas"]["OCSMeta"];
-                            data: components["schemas"]["ErrorResponse"];
-                        };
-                    };
-                };
-            };
-        };
-    };
     "admin-set-doc-mdp-config": {
         parameters: {
             query?: never;
@@ -6834,6 +7218,219 @@ export interface operations {
             };
         };
     };
+    "policy-get-system": {
+        parameters: {
+            query?: never;
+            header: {
+                /** @description Required to be true for the API request to pass */
+                "OCS-APIRequest": boolean;
+            };
+            path: {
+                apiVersion: "v1";
+                /** @description Policy identifier to read from the system layer. */
+                policyKey: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        ocs: {
+                            meta: components["schemas"]["OCSMeta"];
+                            data: components["schemas"]["SystemPolicyResponse"];
+                        };
+                    };
+                };
+            };
+        };
+    };
+    "policy-set-system": {
+        parameters: {
+            query?: never;
+            header: {
+                /** @description Required to be true for the API request to pass */
+                "OCS-APIRequest": boolean;
+            };
+            path: {
+                apiVersion: "v1";
+                /** @description Policy identifier to persist at the system layer. */
+                policyKey: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: {
+            content: {
+                "application/json": {
+                    /** @description Policy value to persist. Null resets the policy to its default system value. */
+                    value?: (boolean | number | string) | null;
+                    /**
+                     * @description Whether lower layers may override this system default.
+                     * @default false
+                     */
+                    allowChildOverride?: boolean;
+                };
+            };
+        };
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        ocs: {
+                            meta: components["schemas"]["OCSMeta"];
+                            data: components["schemas"]["SystemPolicyWriteResponse"];
+                        };
+                    };
+                };
+            };
+            /** @description Invalid policy value */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        ocs: {
+                            meta: components["schemas"]["OCSMeta"];
+                            data: components["schemas"]["ErrorResponse"];
+                        };
+                    };
+                };
+            };
+        };
+    };
+    "policy-get-user-policy-for-user": {
+        parameters: {
+            query?: never;
+            header: {
+                /** @description Required to be true for the API request to pass */
+                "OCS-APIRequest": boolean;
+            };
+            path: {
+                apiVersion: "v1";
+                /** @description Target user identifier that receives the policy preference. */
+                userId: string;
+                /** @description Policy identifier to read for the selected user. */
+                policyKey: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        ocs: {
+                            meta: components["schemas"]["OCSMeta"];
+                            data: components["schemas"]["UserPolicyResponse"];
+                        };
+                    };
+                };
+            };
+        };
+    };
+    "policy-set-user-policy-for-user": {
+        parameters: {
+            query?: never;
+            header: {
+                /** @description Required to be true for the API request to pass */
+                "OCS-APIRequest": boolean;
+            };
+            path: {
+                apiVersion: "v1";
+                /** @description Target user identifier that receives the policy preference. */
+                userId: string;
+                /** @description Policy identifier to persist for the target user. */
+                policyKey: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: {
+            content: {
+                "application/json": {
+                    /** @description Policy value to persist as target user preference. */
+                    value?: (boolean | number | string) | null;
+                };
+            };
+        };
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        ocs: {
+                            meta: components["schemas"]["OCSMeta"];
+                            data: components["schemas"]["UserPolicyWriteResponse"];
+                        };
+                    };
+                };
+            };
+            /** @description Invalid policy value */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        ocs: {
+                            meta: components["schemas"]["OCSMeta"];
+                            data: components["schemas"]["ErrorResponse"];
+                        };
+                    };
+                };
+            };
+        };
+    };
+    "policy-clear-user-policy-for-user": {
+        parameters: {
+            query?: never;
+            header: {
+                /** @description Required to be true for the API request to pass */
+                "OCS-APIRequest": boolean;
+            };
+            path: {
+                apiVersion: "v1";
+                /** @description Target user identifier that receives the policy preference removal. */
+                userId: string;
+                /** @description Policy identifier to clear for the target user. */
+                policyKey: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        ocs: {
+                            meta: components["schemas"]["OCSMeta"];
+                            data: components["schemas"]["UserPolicyWriteResponse"];
+                        };
+                    };
+                };
+            };
+        };
+    };
     "setting-has-root-cert": {
         parameters: {
             query?: never;
diff --git a/src/types/openapi/openapi.ts b/src/types/openapi/openapi.ts
index 83f883b799..deb1b0900a 100644
--- a/src/types/openapi/openapi.ts
+++ b/src/types/openapi/openapi.ts
@@ -852,6 +852,60 @@ export type paths = {
         patch?: never;
         trace?: never;
     };
+    "/ocs/v2.php/apps/libresign/api/{apiVersion}/policies/effective": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** Effective policies bootstrap */
+        get: operations["policy-effective"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/ocs/v2.php/apps/libresign/api/{apiVersion}/policies/group/{groupId}/{policyKey}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** Read a group-level policy value */
+        get: operations["policy-get-group"];
+        /** Save a group-level policy value */
+        put: operations["policy-set-group"];
+        post?: never;
+        /** Clear a group-level policy value */
+        delete: operations["policy-clear-group"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/ocs/v2.php/apps/libresign/api/{apiVersion}/policies/user/{policyKey}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        /** Save a user policy preference */
+        put: operations["policy-set-user-preference"];
+        post?: never;
+        /** Clear a user policy preference */
+        delete: operations["policy-clear-user-preference"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/ocs/v2.php/apps/libresign/api/{apiVersion}/request-signature": {
         parameters: {
             query?: never;
@@ -1215,6 +1269,27 @@ export type components = {
             /** @enum {string} */
             signatureFlow: "none" | "parallel" | "ordered_numeric";
         };
+        EffectivePoliciesResponse: {
+            policies: {
+                [key: string]: components["schemas"]["EffectivePolicyState"];
+            };
+        };
+        EffectivePolicyResponse: {
+            policy: components["schemas"]["EffectivePolicyState"];
+        };
+        EffectivePolicyState: {
+            policyKey: string;
+            effectiveValue: components["schemas"]["EffectivePolicyValue"];
+            sourceScope: string;
+            visible: boolean;
+            editableByCurrentActor: boolean;
+            allowedValues: components["schemas"]["EffectivePolicyValue"][];
+            canSaveAsUserDefault: boolean;
+            canUseAsRequestOverride: boolean;
+            preferenceWasCleared: boolean;
+            blockedBy: string | null;
+        };
+        EffectivePolicyValue: (boolean | number | string) | null;
         ErrorItem: {
             message: string;
             title?: string;
@@ -1328,6 +1403,20 @@ export type components = {
             /** Format: int64 */
             envelopeFolderId?: number;
         };
+        GroupPolicyResponse: {
+            policy: components["schemas"]["GroupPolicyState"];
+        };
+        GroupPolicyState: {
+            policyKey: string;
+            /** @enum {string} */
+            scope: "group";
+            targetId: string;
+            value: components["schemas"]["EffectivePolicyValue"];
+            allowChildOverride: boolean;
+            visibleToChild: boolean;
+            allowedValues: components["schemas"]["EffectivePolicyValue"][];
+        };
+        GroupPolicyWriteResponse: components["schemas"]["MessageResponse"] & components["schemas"]["GroupPolicyResponse"];
         IdDocs: {
             file: components["schemas"]["NewFile"];
             name?: string;
@@ -1426,6 +1515,15 @@ export type components = {
             last: string | null;
             first: string | null;
         };
+        PolicySnapshotEntry: {
+            effectiveValue: string;
+            sourceScope: string;
+        };
+        PolicySnapshotNumericEntry: {
+            /** Format: int64 */
+            effectiveValue: number;
+            sourceScope: string;
+        };
         ProgressError: {
             message: string;
             /** Format: int64 */
@@ -1580,6 +1678,7 @@ export type components = {
             message: string;
             status: string;
         };
+        SystemPolicyWriteResponse: components["schemas"]["MessageResponse"] & components["schemas"]["EffectivePolicyResponse"];
         UserElement: {
             /** Format: int64 */
             id: number;
@@ -1615,9 +1714,14 @@ export type components = {
                 h: number;
             }[];
             original_file_deleted?: boolean;
+            policy_snapshot?: components["schemas"]["ValidatePolicySnapshot"];
             pdfVersion?: string;
             status_changed_at?: string;
         };
+        ValidatePolicySnapshot: {
+            docmdp?: components["schemas"]["PolicySnapshotNumericEntry"];
+            signature_flow?: components["schemas"]["PolicySnapshotEntry"];
+        };
         ValidatedChildFile: {
             /** Format: int64 */
             id: number;
@@ -3928,6 +4032,291 @@ export interface operations {
             };
         };
     };
+    "policy-effective": {
+        parameters: {
+            query?: never;
+            header: {
+                /** @description Required to be true for the API request to pass */
+                "OCS-APIRequest": boolean;
+            };
+            path: {
+                apiVersion: "v1";
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        ocs: {
+                            meta: components["schemas"]["OCSMeta"];
+                            data: components["schemas"]["EffectivePoliciesResponse"];
+                        };
+                    };
+                };
+            };
+        };
+    };
+    "policy-get-group": {
+        parameters: {
+            query?: never;
+            header: {
+                /** @description Required to be true for the API request to pass */
+                "OCS-APIRequest": boolean;
+            };
+            path: {
+                apiVersion: "v1";
+                /** @description Group identifier that receives the policy binding. */
+                groupId: string;
+                /** @description Policy identifier to read for the selected group. */
+                policyKey: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        ocs: {
+                            meta: components["schemas"]["OCSMeta"];
+                            data: components["schemas"]["GroupPolicyResponse"];
+                        };
+                    };
+                };
+            };
+            /** @description Forbidden */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        ocs: {
+                            meta: components["schemas"]["OCSMeta"];
+                            data: components["schemas"]["ErrorResponse"];
+                        };
+                    };
+                };
+            };
+        };
+    };
+    "policy-set-group": {
+        parameters: {
+            query?: never;
+            header: {
+                /** @description Required to be true for the API request to pass */
+                "OCS-APIRequest": boolean;
+            };
+            path: {
+                apiVersion: "v1";
+                /** @description Group identifier that receives the policy binding. */
+                groupId: string;
+                /** @description Policy identifier to persist at the group layer. */
+                policyKey: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: {
+            content: {
+                "application/json": {
+                    /** @description Policy value to persist for the group. */
+                    value?: (boolean | number | string) | null;
+                    /**
+                     * @description Whether users and requests below this group may override the group default.
+                     * @default false
+                     */
+                    allowChildOverride?: boolean;
+                };
+            };
+        };
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        ocs: {
+                            meta: components["schemas"]["OCSMeta"];
+                            data: components["schemas"]["GroupPolicyWriteResponse"];
+                        };
+                    };
+                };
+            };
+            /** @description Invalid policy value */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        ocs: {
+                            meta: components["schemas"]["OCSMeta"];
+                            data: components["schemas"]["ErrorResponse"];
+                        };
+                    };
+                };
+            };
+            /** @description Forbidden */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        ocs: {
+                            meta: components["schemas"]["OCSMeta"];
+                            data: components["schemas"]["ErrorResponse"];
+                        };
+                    };
+                };
+            };
+        };
+    };
+    "policy-clear-group": {
+        parameters: {
+            query?: never;
+            header: {
+                /** @description Required to be true for the API request to pass */
+                "OCS-APIRequest": boolean;
+            };
+            path: {
+                apiVersion: "v1";
+                /** @description Group identifier that receives the policy binding. */
+                groupId: string;
+                /** @description Policy identifier to clear for the selected group. */
+                policyKey: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        ocs: {
+                            meta: components["schemas"]["OCSMeta"];
+                            data: components["schemas"]["GroupPolicyWriteResponse"];
+                        };
+                    };
+                };
+            };
+            /** @description Forbidden */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        ocs: {
+                            meta: components["schemas"]["OCSMeta"];
+                            data: components["schemas"]["ErrorResponse"];
+                        };
+                    };
+                };
+            };
+        };
+    };
+    "policy-set-user-preference": {
+        parameters: {
+            query?: never;
+            header: {
+                /** @description Required to be true for the API request to pass */
+                "OCS-APIRequest": boolean;
+            };
+            path: {
+                apiVersion: "v1";
+                /** @description Policy identifier to persist for the current user. */
+                policyKey: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: {
+            content: {
+                "application/json": {
+                    /** @description Policy value to persist as the current user's default. */
+                    value?: (boolean | number | string) | null;
+                };
+            };
+        };
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        ocs: {
+                            meta: components["schemas"]["OCSMeta"];
+                            data: components["schemas"]["SystemPolicyWriteResponse"];
+                        };
+                    };
+                };
+            };
+            /** @description Invalid policy value */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        ocs: {
+                            meta: components["schemas"]["OCSMeta"];
+                            data: components["schemas"]["ErrorResponse"];
+                        };
+                    };
+                };
+            };
+        };
+    };
+    "policy-clear-user-preference": {
+        parameters: {
+            query?: never;
+            header: {
+                /** @description Required to be true for the API request to pass */
+                "OCS-APIRequest": boolean;
+            };
+            path: {
+                apiVersion: "v1";
+                /** @description Policy identifier to clear for the current user. */
+                policyKey: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        ocs: {
+                            meta: components["schemas"]["OCSMeta"];
+                            data: components["schemas"]["SystemPolicyWriteResponse"];
+                        };
+                    };
+                };
+            };
+        };
+    };
     "request_signature-request": {
         parameters: {
             query?: never;
@@ -3976,7 +4365,7 @@ export interface operations {
                      * @default 1
                      */
                     status?: number | null;
-                    /** @description Signature flow mode: 'parallel' or 'ordered_numeric'. If not provided, uses global configuration */
+                    /** @description Signature flow mode: 'parallel' or 'ordered_numeric'. If not provided, uses the effective policy resolution. */
                     signatureFlow?: string | null;
                 };
             };
@@ -4046,7 +4435,7 @@ export interface operations {
                      * @description Numeric code of status * 0 - no signers * 1 - signed * 2 - pending
                      */
                     status?: number | null;
-                    /** @description Signature flow mode: 'parallel' or 'ordered_numeric'. If not provided, uses global configuration */
+                    /** @description Signature flow mode: 'parallel' or 'ordered_numeric'. If not provided, uses the effective policy resolution. */
                     signatureFlow?: string | null;
                     /** @description The name of file to sign */
                     name?: string | null;
diff --git a/src/views/FilesList/VirtualList.vue b/src/views/FilesList/VirtualList.vue
index 68d94fb6ac..9d9be1eb9d 100644
--- a/src/views/FilesList/VirtualList.vue
+++ b/src/views/FilesList/VirtualList.vue
@@ -4,7 +4,7 @@
 -->
 <template>
 	<div class="files-list"
-		:class="{ 'files-list--grid': !!userConfigStore.files_list_grid_view }"
+		:class="{ 'files-list--grid': userConfigStore.files_list_grid_view }"
 		data-cy-files-list>
 		<div class="files-list__filters">
 			<slot name="filters" />
@@ -55,9 +55,8 @@
 	</div>
 </template>
 
-<script setup lang="ts">
+<script>
 import { t } from '@nextcloud/l10n'
-import { onBeforeUnmount, onMounted, ref, useTemplateRef } from 'vue'
 
 import debounce from 'debounce'
 
@@ -66,78 +65,67 @@ import { subscribe, unsubscribe } from '@nextcloud/event-bus'
 import { useFilesStore } from '../../store/files.js'
 import { useUserConfigStore } from '../../store/userconfig.js'
 
-defineOptions({
+export default {
 	name: 'VirtualList',
-})
-
-type FileItem = {
-	id: string | number
-}
-
-type FilesStore = {
-	loading: boolean
-	filesSorted: () => FileItem[]
-	getAllFiles: () => void
-}
-
-const props = withDefaults(defineProps<{
-	dataComponent: object | (() => unknown)
-	loading: boolean
-	caption?: string
-}>(), {
-	caption: '',
-})
-
-const filesStore = useFilesStore() as FilesStore
-const userConfigStore = useUserConfigStore()
-const endOfList = useTemplateRef<HTMLElement>('endOfList')
-const observer = ref<IntersectionObserver | null>(null)
-
-const handleFilesUpdated = () => {
-	updateObserver()
-}
-
-function getFilesIfNotLoading() {
-	if (filesStore.loading) {
-		setTimeout(getFilesIfNotLoading, 100)
-	} else {
-		filesStore.getAllFiles()
-	}
-}
-
-function updateObserver() {
-	const endOfListElement = endOfList.value
-	if (!endOfListElement || !observer.value) {
-		return
-	}
-	observer.value.disconnect()
-	observer.value.observe(endOfListElement)
-}
-
-onMounted(() => {
-	observer.value = new IntersectionObserver(debounce(([entry]) => {
-		if (entry && entry.isIntersecting) {
-			getFilesIfNotLoading()
+	props: {
+		dataComponent: {
+			type: [Object, Function],
+			required: true,
+		},
+		loading: {
+			type: Boolean,
+			required: true,
+		},
+		/**
+		 * Visually hidden caption for the table accessibility
+		 */
+		caption: {
+			type: String,
+			default: '',
+		},
+	},
+	setup() {
+		const filesStore = useFilesStore()
+		const userConfigStore = useUserConfigStore()
+		return {
+			t,
+			filesStore,
+			userConfigStore,
 		}
-	}, 100))
-	subscribe('libresign:files:updated', handleFilesUpdated)
-})
-
-onBeforeUnmount(() => {
-	observer.value?.disconnect()
-	unsubscribe('libresign:files:updated', handleFilesUpdated)
-})
-
-defineExpose({
-	filesStore,
-	userConfigStore,
-	observer,
-	endOfList,
-	getFilesIfNotLoading,
-	updateObserver,
-	props,
-	t,
-})
+	},
+	data() {
+		return {
+			observer: null,
+		}
+	},
+	mounted() {
+		this.observer = new IntersectionObserver(debounce(([entry]) => {
+			if (entry && entry.isIntersecting) {
+				this.getFilesIfNotLoading()
+			}
+		}, 100))
+		subscribe('libresign:files:updated', this.updateObserver)
+	},
+	beforeUnmount() {
+		this.observer.disconnect()
+		unsubscribe('libresign:files:updated')
+	},
+	methods: {
+		getFilesIfNotLoading() {
+			if (this.filesStore.loading) {
+				setTimeout(this.getFilesIfNotLoading, 100)
+			} else {
+				this.filesStore.getAllFiles()
+			}
+		},
+		updateObserver() {
+			const endOfListElement = this.$refs?.endOfList
+			if (!endOfListElement) return
+			this.observer.disconnect()
+			this.observer.observe(endOfListElement)
+		},
+	},
+}
 </script>
 
 <style scoped lang="scss">
diff --git a/src/views/Policies/Policies.vue b/src/views/Policies/Policies.vue
new file mode 100644
index 0000000000..856820ccbc
--- /dev/null
+++ b/src/views/Policies/Policies.vue
@@ -0,0 +1,24 @@
+<!--
+  - SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
+  - SPDX-License-Identifier: AGPL-3.0-or-later
+-->
+
+<template>
+	<div class="policies-view">
+		<RealPolicyWorkbench />
+	</div>
+</template>
+
+<script setup lang="ts">
+import RealPolicyWorkbench from '../Settings/PolicyWorkbench/RealPolicyWorkbench.vue'
+
+defineOptions({
+	name: 'Policies',
+})
+</script>
+
+<style scoped lang="scss">
+.policies-view {
+	padding: 24px;
+}
+</style>
diff --git a/src/views/Preferences/Preferences.vue b/src/views/Preferences/Preferences.vue
new file mode 100644
index 0000000000..9718c5c7cf
--- /dev/null
+++ b/src/views/Preferences/Preferences.vue
@@ -0,0 +1,234 @@
+<!--
+  - SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
+  - SPDX-License-Identifier: AGPL-3.0-or-later
+-->
+
+<template>
+	<div class="preferences-view">
+		<NcSettingsSection
+			:name="t('libresign', 'Preferences')"
+			:description="t('libresign', 'Save your default signing order for new signature requests when higher-level policies allow it.')">
+			<NcNoteCard v-if="preferenceCleared" type="info">
+				{{ t('libresign', 'A previously saved signing order preference was cleared because it is no longer compatible with a higher-level policy.') }}
+			</NcNoteCard>
+
+			<NcNoteCard v-if="errorMessage" type="error">
+				{{ errorMessage }}
+			</NcNoteCard>
+
+			<div class="preferences-view__summary">
+				<div>
+					<strong>{{ t('libresign', 'Effective signing order') }}</strong>
+					<p>{{ effectiveLabel }}</p>
+				</div>
+				<div>
+					<strong>{{ t('libresign', 'Source') }}</strong>
+					<p>{{ sourceLabel }}</p>
+				</div>
+			</div>
+
+			<NcNoteCard v-if="!canSavePreference" type="info">
+				{{ t('libresign', 'Your current context does not allow saving a personal default for signing order. The effective value above is still applied when you create requests.') }}
+			</NcNoteCard>
+
+			<div v-else class="preferences-view__options">
+				<NcCheckboxRadioSwitch
+					v-for="flow in availableFlows"
+					:key="flow.value"
+					type="radio"
+					:model-value="selectedValue"
+					:value="flow.value"
+					:disabled="saving"
+					name="signature_flow_preference"
+					@update:modelValue="onPreferenceChange(flow.value)">
+					<div class="preferences-view__option-copy">
+						<strong>{{ flow.label }}</strong>
+						<p>{{ flow.description }}</p>
+					</div>
+				</NcCheckboxRadioSwitch>
+
+				<div class="preferences-view__actions">
+					<NcButton
+						:variant="hasSavedPreference ? 'secondary' : 'primary'"
+						:disabled="saving"
+						@click="savePreference(selectedValue)">
+						{{ hasSavedPreference ? t('libresign', 'Update saved preference') : t('libresign', 'Save as my default') }}
+					</NcButton>
+					<NcButton
+						v-if="hasSavedPreference"
+						variant="secondary"
+						:disabled="saving"
+						@click="clearPreference">
+						{{ t('libresign', 'Clear saved preference') }}
+					</NcButton>
+				</div>
+			</div>
+		</NcSettingsSection>
+	</div>
+</template>
+
+<script setup lang="ts">
+import { computed, onMounted, ref } from 'vue'
+
+import { t } from '@nextcloud/l10n'
+
+import NcButton from '@nextcloud/vue/components/NcButton'
+import NcCheckboxRadioSwitch from '@nextcloud/vue/components/NcCheckboxRadioSwitch'
+import NcNoteCard from '@nextcloud/vue/components/NcNoteCard'
+import NcSettingsSection from '@nextcloud/vue/components/NcSettingsSection'
+
+import { usePoliciesStore } from '../../store/policies'
+import type { EffectivePolicyState, SignatureFlowMode } from '../../types/index'
+
+defineOptions({
+	name: 'Preferences',
+})
+
+type FlowOption = {
+	value: SignatureFlowMode
+	label: string
+	description: string
+}
+
+const policiesStore = usePoliciesStore()
+const saving = ref(false)
+const errorMessage = ref('')
+
+const availableFlows: FlowOption[] = [
+	{
+		value: 'parallel',
+		label: t('libresign', 'Simultaneous (Parallel)'),
+		description: t('libresign', 'All signers receive the document at the same time and can sign in any order.'),
+	},
+	{
+		value: 'ordered_numeric',
+		label: t('libresign', 'Sequential'),
+		description: t('libresign', 'Signers are organized by signing order number. Only those with the lowest pending order number can sign.'),
+	},
+]
+
+const signatureFlowPolicy = computed<EffectivePolicyState | null>(() => policiesStore.getPolicy('signature_flow'))
+const canSavePreference = computed(() => signatureFlowPolicy.value?.canSaveAsUserDefault ?? false)
+const hasSavedPreference = computed(() => signatureFlowPolicy.value?.sourceScope === 'user')
+const preferenceCleared = computed(() => signatureFlowPolicy.value?.preferenceWasCleared ?? false)
+
+const selectedValue = ref<SignatureFlowMode>('parallel')
+
+const effectiveLabel = computed(() => {
+	if (signatureFlowPolicy.value?.effectiveValue === 'ordered_numeric') {
+		return t('libresign', 'Sequential')
+	}
+	return t('libresign', 'Simultaneous (Parallel)')
+})
+
+const sourceLabel = computed(() => {
+	switch (signatureFlowPolicy.value?.sourceScope) {
+	case 'user':
+		return t('libresign', 'Your saved preference')
+	case 'group':
+		return t('libresign', 'Group policy')
+	case 'request':
+		return t('libresign', 'Request override')
+	case 'system':
+	default:
+		return t('libresign', 'Global default')
+	}
+})
+
+function syncSelectedValue(): void {
+	selectedValue.value = signatureFlowPolicy.value?.effectiveValue === 'ordered_numeric'
+		? 'ordered_numeric'
+		: 'parallel'
+}
+
+async function savePreference(flow: SignatureFlowMode): Promise<void> {
+	if (!canSavePreference.value) {
+		return
+	}
+
+	saving.value = true
+	errorMessage.value = ''
+	try {
+		await policiesStore.saveUserPreference('signature_flow', flow)
+		syncSelectedValue()
+	} catch (error) {
+		console.error('Failed to save signing order preference', error)
+		errorMessage.value = t('libresign', 'Could not save your signing order preference. Try again.')
+	} finally {
+		saving.value = false
+	}
+}
+
+async function clearPreference(): Promise<void> {
+	saving.value = true
+	errorMessage.value = ''
+	try {
+		await policiesStore.clearUserPreference('signature_flow')
+		syncSelectedValue()
+	} catch (error) {
+		console.error('Failed to clear signing order preference', error)
+		errorMessage.value = t('libresign', 'Could not clear your signing order preference. Try again.')
+	} finally {
+		saving.value = false
+	}
+}
+
+function onPreferenceChange(flow: SignatureFlowMode): void {
+	selectedValue.value = flow
+	if (hasSavedPreference.value) {
+		void savePreference(flow)
+	}
+}
+
+onMounted(async () => {
+	await policiesStore.fetchEffectivePolicies()
+	syncSelectedValue()
+})
+
+defineExpose({
+	availableFlows,
+	canSavePreference,
+	clearPreference,
+	effectiveLabel,
+	errorMessage,
+	hasSavedPreference,
+	onPreferenceChange,
+	preferenceCleared,
+	savePreference,
+	selectedValue,
+	signatureFlowPolicy,
+	sourceLabel,
+	syncSelectedValue,
+})
+</script>
+
+<style scoped lang="scss">
+.preferences-view {
+	padding: 24px;
+
+	&__summary {
+		display: grid;
+		gap: 16px;
+		grid-template-columns: repeat(auto-fit, minmax(220px, 1fr));
+		margin-bottom: 20px;
+	}
+
+	&__options {
+		display: flex;
+		flex-direction: column;
+		gap: 12px;
+	}
+
+	&__option-copy p {
+		margin: 4px 0 0;
+		color: var(--color-text-maxcontrast);
+	}
+
+	&__actions {
+		display: flex;
+		flex-wrap: wrap;
+		gap: 12px;
+		margin-top: 8px;
+	}
+}
+</style>
diff --git a/src/views/Settings/DocMDP.vue b/src/views/Settings/DocMDP.vue
deleted file mode 100644
index 1f6416cdd7..0000000000
--- a/src/views/Settings/DocMDP.vue
+++ /dev/null
@@ -1,237 +0,0 @@
-<!--
-  - SPDX-FileCopyrightText: 2025 LibreCode coop and LibreCode contributors
-  - SPDX-License-Identifier: AGPL-3.0-or-later
--->
-<template>
-	<NcSettingsSection
-		:name="name"
-		:description="t('libresign', 'DocMDP defines what types of changes are allowed in a PDF after it is signed, ensuring viewers can detect unauthorized modifications.')"
-	>
-		<div>
-			<NcCheckboxRadioSwitch type="switch"
-				v-model="enabled"
-				:disabled="loading"
-				@update:modelValue="onEnabledChange">
-				<!-- TRANSLATORS: Label for enabling DocMDP certification -->
-				{{ t('libresign', 'Enable DocMDP') }}
-			</NcCheckboxRadioSwitch>
-		</div>
-		<NcNoteCard v-if="errorMessage" type="error">
-			{{ errorMessage }}
-		</NcNoteCard>
-		<div v-if="enabled">
-			<label>
-				<!-- TRANSLATORS: Label asking to select default certification level -->
-				{{ t('libresign', 'Default certification level for new signatures:') }}
-			</label>
-			<div class="docmdp-select-wrapper">
-				<NcCheckboxRadioSwitch v-for="level in availableLevels"
-					:key="level.value"
-					type="radio"
-					v-model="selectedLevelValue"
-					:value="String(level.value)"
-					:disabled="loading"
-					name="docmdp_level"
-					@update:modelValue="onLevelChange">
-					<div class="docmdp-option">
-						<div class="docmdp-option-content">
-							<strong>{{ level.label }}</strong>
-							<p class="docmdp-option-description">
-								{{ level.description }}
-							</p>
-						</div>
-						<div v-if="selectedLevel?.value === level.value" class="docmdp-option-status">
-							<NcLoadingIcon v-if="loading" :size="20" />
-							<NcSavingIndicatorIcon v-else-if="saved" :size="20" />
-							<NcSavingIndicatorIcon v-else-if="showErrorIcon" :size="20" error />
-						</div>
-					</div>
-				</NcCheckboxRadioSwitch>
-			</div>
-		</div>
-	</NcSettingsSection>
-</template>
-
-<script setup lang="ts">
-import axios from '@nextcloud/axios'
-import { loadState } from '@nextcloud/initial-state'
-import { generateOcsUrl } from '@nextcloud/router'
-import { t } from '@nextcloud/l10n'
-import { computed, onMounted, ref } from 'vue'
-
-import NcCheckboxRadioSwitch from '@nextcloud/vue/components/NcCheckboxRadioSwitch'
-import NcLoadingIcon from '@nextcloud/vue/components/NcLoadingIcon'
-import NcNoteCard from '@nextcloud/vue/components/NcNoteCard'
-import NcSavingIndicatorIcon from '@nextcloud/vue/components/NcSavingIndicatorIcon'
-import NcSettingsSection from '@nextcloud/vue/components/NcSettingsSection'
-import type { AdminDocMdpConfigState, AdminDocMdpLevelOption } from '../../types'
-import type { operations } from '../../types/openapi/openapi-administration'
-
-defineOptions({
-	name: 'DocMDP',
-})
-
-type DocMdpRequestBody = operations['admin-set-doc-mdp-config']['requestBody']['content']['application/json']
-type DocMdpErrorResponse =
-	| operations['admin-set-doc-mdp-config']['responses'][400]['content']['application/json']
-	| operations['admin-set-doc-mdp-config']['responses'][500]['content']['application/json']
-
-type DocMdpRequestError = {
-	response?: {
-		data?: DocMdpErrorResponse
-	}
-}
-
-const PREFERRED_DEFAULT_LEVEL = 2
-
-const enabled = ref(false)
-const selectedLevel = ref<AdminDocMdpLevelOption | null>(null)
-const availableLevels = ref<AdminDocMdpLevelOption[]>([])
-const loading = ref(false)
-const errorMessage = ref('')
-const saved = ref(false)
-const showErrorIcon = ref(false)
-
-const name = computed(() => {
-	return t('libresign', 'PDF certification (DocMDP)')
-})
-
-const selectedLevelValue = computed({
-	get() {
-		return String(selectedLevel.value?.value ?? 0)
-	},
-	set(value: string) {
-		const numericValue = Number(value)
-		selectedLevel.value = availableLevels.value.find(level => level.value === numericValue) ?? availableLevels.value[0] ?? null
-	},
-})
-
-function getPreferredDefaultLevel() {
-	return availableLevels.value.find(level => level.value === PREFERRED_DEFAULT_LEVEL)
-		?? availableLevels.value[0]
-		?? null
-}
-
-function loadConfig() {
-	try {
-		const config = loadState<AdminDocMdpConfigState>('libresign', 'docmdp_config', {
-			enabled: false,
-			defaultLevel: PREFERRED_DEFAULT_LEVEL,
-			availableLevels: [],
-		})
-
-		enabled.value = config.enabled
-		availableLevels.value = config.availableLevels
-		selectedLevel.value = availableLevels.value.find(level => level.value === config.defaultLevel) ?? null
-
-		if (!selectedLevel.value) {
-			selectedLevel.value = getPreferredDefaultLevel()
-		}
-	} catch (error) {
-		console.error('Error loading DocMDP configuration:', error)
-		errorMessage.value = t('libresign', 'Could not load configuration.')
-	}
-}
-
-function onEnabledChange() {
-	saved.value = false
-	errorMessage.value = ''
-	showErrorIcon.value = false
-
-	if (!selectedLevel.value || !enabled.value) {
-		selectedLevel.value = getPreferredDefaultLevel()
-	}
-
-	void saveConfig()
-}
-
-function onLevelChange() {
-	errorMessage.value = ''
-	showErrorIcon.value = false
-	void saveConfig()
-}
-
-function getErrorMessage(error: unknown): string | null {
-	const requestError = error as DocMdpRequestError
-	return requestError.response?.data?.ocs?.data?.error ?? null
-}
-
-async function saveConfig() {
-	loading.value = true
-	errorMessage.value = ''
-	saved.value = false
-	showErrorIcon.value = false
-
-	try {
-		const url = generateOcsUrl('apps/libresign/api/v1/admin/docmdp/config')
-		const payload: DocMdpRequestBody = {
-			enabled: enabled.value,
-			defaultLevel: enabled.value ? (selectedLevel.value?.value ?? 0) : 0,
-		}
-		await axios.post(url, payload)
-
-		saved.value = true
-		setTimeout(() => {
-			saved.value = false
-		}, 3000)
-	} catch (error: unknown) {
-		console.error('Error saving DocMDP configuration:', error)
-		errorMessage.value = getErrorMessage(error) ?? t('libresign', 'Could not save configuration.')
-		showErrorIcon.value = true
-		setTimeout(() => {
-			showErrorIcon.value = false
-		}, 3000)
-	} finally {
-		loading.value = false
-	}
-}
-
-onMounted(() => {
-	loadConfig()
-})
-
-defineExpose({
-	enabled,
-	selectedLevel,
-	onEnabledChange,
-})
-</script>
-
-<style lang="scss" scoped>
-.docmdp {
-	&-info {
-		color: var(--color-text-maxcontrast);
-		margin-top: 0.5rem;
-	}
-
-	&-option {
-		display: flex;
-		justify-content: space-between;
-		align-items: flex-start;
-		gap: 1rem;
-		width: 100%;
-
-		&-content {
-			flex: 1;
-		}
-
-		&-status {
-			flex-shrink: 0;
-			display: flex;
-			align-items: center;
-		}
-
-		&-description {
-			margin: 0.25rem 0 0 0;
-			color: var(--color-text-maxcontrast);
-			font-size: 90%;
-		}
-	}
-
-	&-select-wrapper {
-		display: flex;
-		flex-direction: column;
-		gap: 0.5rem;
-	}
-}
-</style>
diff --git a/src/views/Settings/PolicyWorkbench/PolicyRuleCard.vue b/src/views/Settings/PolicyWorkbench/PolicyRuleCard.vue
new file mode 100644
index 0000000000..4ec5fac2c4
--- /dev/null
+++ b/src/views/Settings/PolicyWorkbench/PolicyRuleCard.vue
@@ -0,0 +1,252 @@
+<!--
+  - SPDX-FileCopyrightText: 2026 LibreCode coop and LibreCode contributors
+  - SPDX-License-Identifier: AGPL-3.0-or-later
+-->
+
+<template>
+	<article
+		class="policy-rule-card"
+		:class="{ 'policy-rule-card--highlighted': highlighted, 'policy-rule-card--editable': showEditAction }"
+		:aria-label="cardAriaLabel || `${eyebrow}: ${title}`"
+		@pointerdown="trackPress"
+		@mouseup="markSelectionGesture"
+		@click="handleCardClick">
+		<div class="policy-rule-card__header">
+			<div>
+				<p class="policy-rule-card__eyebrow">{{ eyebrow }}</p>
+				<h4>{{ title }}</h4>
+			</div>
+			<span class="policy-rule-card__summary" :title="summary">{{ summary }}</span>
+		</div>
+
+		<p v-if="description" class="policy-rule-card__description">
+			{{ description }}
+		</p>
+
+		<ul v-if="badges.length > 0" class="policy-rule-card__badges">
+			<li v-for="badge in badges" :key="badge">
+				{{ badge }}
+			</li>
+		</ul>
+
+		<div class="policy-rule-card__actions">
+			<NcButton v-if="showEditAction" variant="tertiary" class="policy-rule-card__action policy-rule-card__action--edit" :aria-label="editLabel" @click.stop="$emit('edit')">
+				{{ editText || editLabel }}
+			</NcButton>
+			<NcButton v-if="showRemoveAction" variant="error" class="policy-rule-card__action policy-rule-card__action--remove" :aria-label="removeLabel" @click.stop="$emit('remove')">
+				{{ removeText || removeLabel }}
+			</NcButton>
+		</div>
+	</article>
+</template>
+
+<script setup lang="ts">
+import NcButton from '@nextcloud/vue/components/NcButton'
+import { ref } from 'vue'
+
+const DRAG_EDIT_THRESHOLD_PX = 6
+const SELECTION_GUARD_WINDOW_MS = 250
+
+defineOptions({
+	name: 'PolicyRuleCard',
+})
+
+const emit = defineEmits<{
+	edit: []
+	remove: []
+}>()
+
+const props = withDefaults(defineProps<{
+	eyebrow: string
+	title: string
+	summary: string
+	description?: string
+	badges?: string[]
+	highlighted?: boolean
+	cardAriaLabel?: string
+	editLabel: string
+	removeLabel: string
+	editText?: string
+	removeText?: string
+	showEditAction?: boolean
+	showRemoveAction?: boolean
+}>(), {
+	description: '',
+	badges: () => [],
+	highlighted: false,
+	cardAriaLabel: '',
+	editText: '',
+	removeText: '',
+	showEditAction: true,
+	showRemoveAction: true,
+})
+
+const lastPress = ref<{ x: number, y: number } | null>(null)
+const recentSelectionAt = ref(0)
+
+function hasActiveTextSelection() {
+	const selection = window.getSelection()
+	return !!selection && selection.type === 'Range' && selection.toString().trim().length > 0
+}
+
+function markSelectionGesture() {
+	if (hasActiveTextSelection()) {
+		recentSelectionAt.value = Date.now()
+	}
+}
+
+function trackPress(event: PointerEvent) {
+	if (event.button !== 0) {
+		lastPress.value = null
+		return
+	}
+
+	lastPress.value = {
+		x: event.clientX,
+		y: event.clientY,
+	}
+}
+
+function movedBeyondThreshold(event: MouseEvent, press: { x: number, y: number }) {
+	const deltaX = Math.abs(event.clientX - press.x)
+	const deltaY = Math.abs(event.clientY - press.y)
+	return deltaX > DRAG_EDIT_THRESHOLD_PX || deltaY > DRAG_EDIT_THRESHOLD_PX
+}
+
+function shouldIgnoreDueToRecentSelection() {
+	return (Date.now() - recentSelectionAt.value) <= SELECTION_GUARD_WINDOW_MS
+}
+
+function handleCardClick(event: MouseEvent) {
+	if (!props.showEditAction) {
+		return
+	}
+
+	const target = event.target as HTMLElement | null
+	if (target?.closest('button, a, input, textarea, select, [role="button"]')) {
+		return
+	}
+
+	if (hasActiveTextSelection() || shouldIgnoreDueToRecentSelection()) {
+		return
+	}
+
+	const press = lastPress.value
+	if (press && movedBeyondThreshold(event, press)) {
+		return
+	}
+
+	emit('edit')
+}
+</script>
+
+<style scoped lang="scss">
+.policy-rule-card {
+	display: flex;
+	flex-direction: column;
+	gap: 0.75rem;
+	padding: 1rem;
+	border-radius: 18px;
+	border: 1px solid color-mix(in srgb, var(--color-border-maxcontrast) 82%, transparent);
+	background: var(--color-main-background);
+
+	&--editable {
+		cursor: pointer;
+	}
+
+	&--highlighted {
+		border-color: var(--color-primary-element);
+		box-shadow: 0 0 0 2px color-mix(in srgb, var(--color-primary-element) 18%, transparent);
+	}
+
+	&__header {
+		display: flex;
+		justify-content: space-between;
+		align-items: flex-start;
+		gap: 1rem;
+
+		h4 {
+			margin: 0;
+		}
+	}
+
+	&__eyebrow {
+		margin: 0 0 0.25rem;
+		font-size: 0.72rem;
+		text-transform: uppercase;
+		letter-spacing: 0.04em;
+		color: var(--color-text-maxcontrast);
+	}
+
+	&__summary {
+		font-weight: 700;
+		max-width: min(64%, 26rem);
+		text-align: right;
+		white-space: nowrap;
+		overflow: hidden;
+		text-overflow: ellipsis;
+	}
+
+	&__description {
+		margin: 0;
+		color: var(--color-text-maxcontrast);
+		word-break: break-word;
+	}
+
+	&__badges {
+		margin: 0;
+		padding: 0;
+		list-style: none;
+		display: flex;
+		flex-wrap: wrap;
+		gap: 0.5rem;
+
+		li {
+			padding: 0.25rem 0.6rem;
+			border-radius: 999px;
+			background: color-mix(in srgb, var(--color-primary-element) 12%, var(--color-main-background));
+			font-size: 0.8rem;
+		}
+	}
+
+	&__actions {
+		display: flex;
+		flex-wrap: wrap;
+		gap: 0.75rem;
+		align-items: center;
+		margin-top: 0.25rem;
+	}
+
+	&__action {
+		min-width: 0;
+		font-weight: 600;
+	}
+
+	&__action--remove {
+		margin-left: auto;
+	}
+}
+
+@media (max-width: 640px) {
+	.policy-rule-card {
+		padding: 0.85rem;
+
+		&__header {
+			flex-direction: column;
+			align-items: flex-start;
+		}
+
+		&__summary {
+			max-width: 100%;
+			text-align: left;
+		}
+
+		&__actions {
+			:deep(.button-vue) {
+				width: 100%;
+				justify-content: center;
+			}
+		}
+	}
+}
+</style>
diff --git a/src/views/Settings/PolicyWorkbench/PolicyRuleEditorPanel.vue b/src/views/Settings/PolicyWorkbench/PolicyRuleEditorPanel.vue
new file mode 100644
index 0000000000..028b9f7e0a
--- /dev/null
+++ b/src/views/Settings/PolicyWorkbench/PolicyRuleEditorPanel.vue
@@ -0,0 +1,219 @@
+<!--
+  - SPDX-FileCopyrightText: 2026 LibreCode coop and LibreCode contributors
+  - SPDX-License-Identifier: AGPL-3.0-or-later
+-->
+
+<template>
+	<section class="policy-workbench__editor-panel">
+		<div class="policy-workbench__editor-panel-content" :class="{ 'policy-workbench__editor-panel-content--saving': saveStatus === 'saving' }">
+			<div class="policy-workbench__editor-header">
+				<p v-if="editorHelp">{{ editorHelp }}</p>
+				<p class="policy-workbench__precedence-hint">{{ t('libresign', 'Priority: User > Group > Default') }}</p>
+			</div>
+
+			<div v-if="editorDraft.scope !== 'system'" class="policy-workbench__field">
+				<label class="policy-workbench__label">
+					{{ editorDraft.scope === 'group' ? t('libresign', 'Target groups') : t('libresign', 'Target users') }}
+				</label>
+				<NcSelectUsers
+					:model-value="selectedTargetOptions"
+					:options="availableTargets"
+					:aria-label="editorDraft.scope === 'group' ? t('libresign', 'Target groups') : t('libresign', 'Target users')"
+					:placeholder="editorDraft.scope === 'group' ? t('libresign', 'Search groups') : t('libresign', 'Search users')"
+					:loading="loadingTargets"
+					:multiple="true"
+					:keep-open="true"
+					:disabled="saveStatus === 'saving'"
+					@search="$emit('search-targets', $event)"
+					@update:modelValue="$emit('update-targets', $event)" />
+			</div>
+
+			<div v-if="activeEditor" class="policy-workbench__setting-surface">
+				<component
+					:is="activeEditor"
+					:model-value="editorDraft.value"
+					:editor-scope="editorDraft.scope"
+					:editor-mode="editorMode"
+					@update:modelValue="$emit('update-value', $event)" />
+			</div>
+
+			<NcCheckboxRadioSwitch
+				v-if="editorDraft.scope !== 'user' && showAllowOverrideSwitch"
+				type="switch"
+				:model-value="editorDraft.allowChildOverride"
+				:disabled="saveStatus === 'saving'"
+				@update:modelValue="$emit('update-allow-override', $event)">
+				<div class="policy-workbench__switch-copy">
+					<span>{{ t('libresign', 'Allow lower-level overrides') }}</span>
+					<p>
+						{{ editorDraft.allowChildOverride ? t('libresign', 'Groups and users can define a more specific value.') : t('libresign', 'Groups and users must inherit this value.') }}
+					</p>
+				</div>
+			</NcCheckboxRadioSwitch>
+
+			<NcNoteCard v-if="duplicateMessage" type="error">
+				{{ duplicateMessage }}
+			</NcNoteCard>
+
+			<div v-if="showInlineActions" class="policy-workbench__editor-actions" :class="{ 'policy-workbench__editor-actions--sticky-mobile': stickyActions }">
+				<NcButton v-if="showBackButton" variant="tertiary" :aria-label="t('libresign', 'Go back to rule type selection')" :disabled="saveStatus === 'saving'" @click="$emit('back')">
+					{{ t('libresign', '← Back') }}
+				</NcButton>
+				<NcButton variant="primary" :aria-label="editorMode === 'edit' ? t('libresign', 'Save policy rule changes') : t('libresign', 'Create policy rule')" :loading="saveStatus === 'saving'" :disabled="!canSaveDraft" @click="$emit('save')">
+					{{ editorMode === 'edit' ? t('libresign', 'Save changes') : t('libresign', 'Create rule') }}
+				</NcButton>
+				<NcButton variant="secondary" :aria-label="t('libresign', 'Cancel editing')" :disabled="saveStatus === 'saving'" @click="$emit('cancel')">
+					{{ t('libresign', 'Cancel') }}
+				</NcButton>
+			</div>
+		</div>
+
+		<div v-if="saveStatus === 'saving'" class="policy-workbench__saving-overlay" aria-live="polite" aria-busy="true">
+			<div class="policy-workbench__saving-spinner" aria-hidden="true"></div>
+		</div>
+	</section>
+</template>
+
+<script setup lang="ts">
+import { t } from '@nextcloud/l10n'
+import type { EffectivePolicyValue } from '../../../types/index'
+
+import NcButton from '@nextcloud/vue/components/NcButton'
+import NcCheckboxRadioSwitch from '@nextcloud/vue/components/NcCheckboxRadioSwitch'
+import NcNoteCard from '@nextcloud/vue/components/NcNoteCard'
+import NcSelectUsers from '@nextcloud/vue/components/NcSelectUsers'
+
+interface EditorDraft {
+	scope: 'system' | 'group' | 'user'
+	value: EffectivePolicyValue
+	allowChildOverride: boolean
+}
+
+interface TargetOption {
+	id: string
+	displayName: string
+	subname?: string
+	user?: string
+	isNoUser?: boolean
+}
+
+withDefaults(defineProps<{
+	editorDraft: EditorDraft
+	editorMode: 'create' | 'edit' | null
+	editorTitle: string
+	editorHelp: string
+	activeEditor: unknown
+	selectedTargetOptions: TargetOption[]
+	availableTargets: TargetOption[]
+	loadingTargets: boolean
+	duplicateMessage: string | null
+	canSaveDraft: boolean
+	saveStatus: 'idle' | 'saving' | 'saved'
+	showInlineActions?: boolean
+	stickyActions?: boolean
+	showBackButton?: boolean
+	showAllowOverrideSwitch?: boolean
+}>(), {
+	showInlineActions: true,
+	stickyActions: false,
+	showBackButton: false,
+	showAllowOverrideSwitch: true,
+})
+
+defineEmits<{
+	(e: 'search-targets', value: string): void
+	(e: 'update-targets', value: { id: string } | Array<{ id: string }> | null): void
+	(e: 'update-value', value: EffectivePolicyValue): void
+	(e: 'update-allow-override', value: boolean): void
+	(e: 'back'): void
+	(e: 'save'): void
+	(e: 'cancel'): void
+}>()
+</script>
+
+<style scoped lang="scss">
+.policy-workbench__editor-panel {
+	padding: 0 !important;
+	border: none !important;
+	border-radius: 0 !important;
+	background: transparent !important;
+	box-shadow: none !important;
+}
+
+.policy-workbench__editor-panel-content {
+	display: flex;
+	flex-direction: column;
+	gap: 0.85rem;
+}
+
+.policy-workbench__editor-header {
+	display: flex;
+	flex-direction: column;
+	gap: 0.4rem;
+
+	p {
+		margin: 0;
+	}
+}
+
+.policy-workbench__label {
+	font-size: 0.78rem;
+	text-transform: uppercase;
+	letter-spacing: 0.04em;
+	color: var(--color-text-maxcontrast);
+}
+
+.policy-workbench__field {
+	display: flex;
+	flex-direction: column;
+	gap: 0.45rem;
+}
+
+.policy-workbench__setting-surface {
+	padding: 0;
+	border: none;
+	border-radius: 0;
+	background: transparent;
+	box-shadow: none;
+}
+
+.policy-workbench__editor-actions {
+	display: flex;
+	flex-direction: row;
+	justify-content: flex-end;
+	align-items: center;
+	gap: 0.75rem;
+	flex-wrap: wrap;
+
+	:deep(.button-vue) {
+		width: auto;
+		justify-content: center;
+		flex-shrink: 0;
+	}
+}
+
+.policy-workbench__switch-copy {
+	display: flex;
+	flex-direction: column;
+	gap: 0.25rem;
+
+	p {
+		margin: 0;
+		font-size: 0.84rem;
+		color: var(--color-text-maxcontrast);
+	}
+}
+
+.policy-workbench__precedence-hint {
+	margin: 0.2rem 0 0;
+	font-size: 0.82rem;
+	font-weight: 600;
+	color: var(--color-main-text);
+}
+
+@media (max-width: 640px) {
+	.policy-workbench__editor-actions {
+		justify-content: flex-start;
+	}
+}
+</style>
diff --git a/src/views/Settings/PolicyWorkbench/RealPolicyWorkbench.vue b/src/views/Settings/PolicyWorkbench/RealPolicyWorkbench.vue
new file mode 100644
index 0000000000..47472c5810
--- /dev/null
+++ b/src/views/Settings/PolicyWorkbench/RealPolicyWorkbench.vue
@@ -0,0 +1,3101 @@
+<!--
+  - SPDX-FileCopyrightText: 2026 LibreCode coop and LibreCode contributors
+  - SPDX-License-Identifier: AGPL-3.0-or-later
+-->
+
+<template>
+	<NcSettingsSection
+		:name="t('libresign', 'Document signing settings')"
+		:description="t('libresign', 'Configure how signing works.')">
+
+		<div class="policy-workbench__catalog-toolbar">
+			<div class="policy-workbench__catalog-search">
+				<NcTextField
+					:model-value="settingsFilter"
+					:label="t('libresign', 'Search settings')"
+					:placeholder="t('libresign', 'Search by setting name, summary, description, or context')"
+					@keydown.esc.prevent="clearSettingsFilter"
+					@update:modelValue="onSettingsFilterChange" />
+				<div class="policy-workbench__catalog-foot">
+					<NcButton
+						variant="tertiary"
+						class="policy-workbench__clear-filter-button"
+						:class="{ 'policy-workbench__clear-filter-button--hidden': !hasActiveFilter }"
+						:aria-label="t('libresign', 'Clear settings filter')"
+						:disabled="!hasActiveFilter"
+						:tabindex="hasActiveFilter ? undefined : -1"
+						@click="clearSettingsFilter">
+						{{ t('libresign', 'Clear filter') }}
+					</NcButton>
+				</div>
+			</div>
+
+			<div class="policy-workbench__catalog-view-switch" role="group" :aria-label="t('libresign', 'Select settings layout')">
+				<NcButton
+					:aria-label="catalogViewButtonLabel"
+					:title="catalogViewButtonLabel"
+					:disabled="isSmallViewport"
+					class="policy-workbench__catalog-view-button"
+					@click="toggleCatalogLayout">
+					<template #icon>
+						<NcIconSvgWrapper v-if="effectiveCatalogLayout === 'cards'" :path="mdiFormatListBulletedSquare" />
+						<NcIconSvgWrapper v-else :path="mdiViewGridOutline" />
+					</template>
+				</NcButton>
+			</div>
+		</div>
+
+		<div v-if="effectiveCatalogLayout === 'cards'" class="policy-workbench__settings-grid">
+			<article
+				v-for="summary in filteredSettingSummaries"
+				:key="summary.key"
+				class="policy-workbench__setting-tile"
+				tabindex="0"
+				role="button"
+				@pointerdown="trackPress('cards', summary.key, $event)"
+				@mouseup="markSelectionGesture('cards', summary.key)"
+				@click="openSettingFromPointer('cards', summary.key, $event)"
+				@keydown.enter.prevent="openSettingFromKeyboard(summary.key)"
+				@keydown.space.prevent="openSettingFromKeyboard(summary.key)">
+				<div class="policy-workbench__setting-body">
+					<div class="policy-workbench__setting-header">
+						<div>
+							<h3 class="policy-workbench__setting-title">
+								<span v-html="highlightText(summary.title)"></span>
+								<span v-if="summary.context" class="policy-workbench__setting-context">(<span v-html="highlightText(summary.context)"></span>)</span>
+							</h3>
+							<p class="policy-workbench__setting-description" v-html="highlightText(summary.description)"></p>
+						</div>
+					</div>
+
+					<p v-if="hasActiveOverrides(summary.groupCount, summary.userCount)" class="policy-workbench__origin-badge">
+						{{ t('libresign', 'Custom rules active') }}
+					</p>
+
+					<ul class="policy-workbench__setting-stats">
+						<li>
+							<strong>{{ t('libresign', 'Default') }}:</strong>
+							<span :title="summary.defaultSummary" v-html="highlightText(summary.defaultSummary)"></span>
+						</li>
+						<li>
+							<strong>{{ t('libresign', 'Custom rules') }}:</strong>
+							<span>{{ formatOverrideSummary(summary.groupCount, summary.userCount) }}</span>
+						</li>
+					</ul>
+				</div>
+
+				<div class="policy-workbench__setting-footer">
+					<NcButton variant="secondary" class="policy-workbench__manage-button" :aria-label="t('libresign', 'Configure setting')" @click.stop="openSettingFromAction(summary.key, $event)">
+						{{ t('libresign', 'Configure') }}
+					</NcButton>
+				</div>
+			</article>
+		</div>
+
+		<div v-else class="policy-workbench__settings-list" role="list">
+			<article
+				v-for="summary in filteredSettingSummaries"
+				:key="summary.key"
+				class="policy-workbench__settings-row"
+				role="button"
+				tabindex="0"
+				@pointerdown="trackPress('list', summary.key, $event)"
+				@mouseup="markSelectionGesture('list', summary.key)"
+				@click="openSettingFromPointer('list', summary.key, $event)"
+				@keydown.enter.prevent="openSettingFromKeyboard(summary.key)"
+				@keydown.space.prevent="openSettingFromKeyboard(summary.key)">
+				<div class="policy-workbench__settings-row-main">
+					<h3 class="policy-workbench__setting-title">
+						<span v-html="highlightText(summary.title)"></span>
+						<span v-if="summary.context" class="policy-workbench__setting-context">(<span v-html="highlightText(summary.context)"></span>)</span>
+					</h3>
+					<p v-html="highlightText(summary.description)"></p>
+					<p v-if="hasActiveOverrides(summary.groupCount, summary.userCount)" class="policy-workbench__origin-badge policy-workbench__origin-badge--inline">
+						{{ t('libresign', 'Custom rules active') }}
+					</p>
+				</div>
+
+				<div class="policy-workbench__settings-row-stats">
+					<span class="policy-workbench__settings-row-stat policy-workbench__settings-row-stat--default" :title="summary.defaultSummary">
+						<strong>{{ t('libresign', 'Default') }}:</strong>
+						<span v-html="highlightText(summary.defaultSummary)"></span>
+					</span>
+					<span class="policy-workbench__settings-row-stat policy-workbench__settings-row-stat--count"><strong>{{ t('libresign', 'Custom rules') }}:</strong> {{ formatOverrideSummary(summary.groupCount, summary.userCount) }}</span>
+				</div>
+
+				<NcButton variant="secondary" class="policy-workbench__manage-button" :aria-label="t('libresign', 'Configure setting')" @click.stop="openSettingFromAction(summary.key, $event)">
+					{{ t('libresign', 'Configure') }}
+				</NcButton>
+			</article>
+		</div>
+
+		<NcNoteCard v-if="filteredSettingSummaries.length === 0" type="info">
+			<div class="policy-workbench__empty-state">
+				<p>{{ t('libresign', 'No settings match this search. Try fewer keywords or clear the filter.') }}</p>
+				<div class="policy-workbench__empty-state-actions">
+					<NcButton variant="secondary" :aria-label="t('libresign', 'Clear settings filter')" :disabled="!hasActiveFilter" @click="clearSettingsFilter">
+						{{ t('libresign', 'Clear filter') }}
+					</NcButton>
+					<NcButton variant="tertiary" :aria-label="t('libresign', 'Show all settings')" @click="clearSettingsFilter">
+						{{ t('libresign', 'Show all settings') }}
+					</NcButton>
+				</div>
+			</div>
+		</NcNoteCard>
+
+		<NcDialog
+			v-if="state.activeDefinition"
+			:name="state.activeDefinition.title"
+			size="full"
+			:can-close="true"
+			@closing="requestCloseSetting()">
+			<div class="policy-workbench__dialog">
+				<div class="policy-workbench__main">
+					<header class="policy-workbench__dialog-header">
+						<p class="policy-workbench__dialog-description">{{ dialogDescription }}</p>
+						<div class="policy-workbench__table-priority-note" role="note" aria-live="polite">
+							<NcIconSvgWrapper :path="mdiInformationOutline" :size="16" />
+							<span>{{ t('libresign', 'Priority: User > Group > Default') }}</span>
+						</div>
+					</header>
+
+					<NcNoteCard
+						v-if="removalFeedback"
+						type="success"
+						class="policy-workbench__removal-feedback"
+						aria-live="polite">
+						{{ removalFeedback }}
+					</NcNoteCard>
+
+					<div v-if="state.summary" class="policy-workbench__default-inline">
+						<span class="policy-workbench__default-inline-label">{{ t('libresign', 'Default:') }}</span>
+						<strong class="policy-workbench__default-inline-value">{{ state.summary.currentBaseValue }}</strong>
+						<span class="policy-workbench__default-inline-source">({{ defaultSourceLabel }})</span>
+						<span v-if="state.viewMode === 'system-admin'" class="policy-workbench__default-inline-separator" aria-hidden="true">&middot;</span>
+						<NcButton
+							v-if="state.viewMode === 'system-admin'"
+							variant="tertiary"
+							size="small"
+							class="policy-workbench__default-inline-action"
+							@click="openRuleEditor('system')">
+							{{ t('libresign', 'Change') }}
+						</NcButton>
+					</div>
+
+					<div class="policy-workbench__table-toolbar-row policy-workbench__table-toolbar-row--crud">
+						<div class="policy-workbench__search-with-chips">
+							<NcAppNavigationSearch
+								:model-value="crudSearch"
+								:label="t('libresign', 'Search rules')"
+								:placeholder="t('libresign', 'Search rules')"
+								@update:modelValue="onCrudSearchChange">
+								<template #actions>
+									<NcActions
+										:open="scopeFilterOpen"
+										:aria-label="t('libresign', 'Filter rules by scope')"
+										:title="t('libresign', 'Filter by scope')"
+										@update:open="scopeFilterOpen = $event">
+										<template #icon>
+											<NcIconSvgWrapper :path="mdiFilterVariant" :size="20" :title="t('libresign', 'Filter by scope')" />
+										</template>
+										<NcActionButton :model-value="crudScopeFilter === 'all'" @click="setCrudScopeFilter('all', true)">
+											<template #icon>
+												<NcIconSvgWrapper :path="mdiFilterVariant" :size="16" />
+											</template>
+											{{ t('libresign', 'All scopes') }}
+										</NcActionButton>
+										<NcActionButton :model-value="crudScopeFilter === 'system'" @click="setCrudScopeFilter('system', true)">
+											<template #icon>
+												<NcIconSvgWrapper :path="mdiOfficeBuildingOutline" :size="16" />
+											</template>
+												{{ t('libresign', 'Everyone') }}
+										</NcActionButton>
+										<NcActionButton :model-value="crudScopeFilter === 'group'" @click="setCrudScopeFilter('group', true)">
+											<template #icon>
+												<NcIconSvgWrapper :path="mdiAccountMultipleOutline" :size="16" />
+											</template>
+											{{ t('libresign', 'Group') }}
+										</NcActionButton>
+										<NcActionButton :model-value="crudScopeFilter === 'user'" @click="setCrudScopeFilter('user', true)">
+											<template #icon>
+												<NcIconSvgWrapper :path="mdiAccountOutline" :size="16" />
+											</template>
+											{{ t('libresign', 'User') }}
+										</NcActionButton>
+									</NcActions>
+								</template>
+							</NcAppNavigationSearch>
+
+							<div v-if="activeScopeFilterChip" class="policy-workbench__crud-filter-chips">
+								<NcChip :aria-label-close="t('libresign', 'Remove filter')" :text="activeScopeFilterChip" @close="setCrudScopeFilter('all', true)" />
+							</div>
+						</div>
+
+						<NcButton
+							v-if="state.viewMode === 'system-admin'"
+							variant="primary"
+							size="small"
+							:disabled="!hasCreatableScope"
+							:title="createRuleDisabledReason || undefined"
+							:aria-label="t('libresign', 'Create rule')"
+							class="policy-workbench__crud-create-cta"
+							@click="requestCreateRule()">
+							<template #icon>
+								<NcIconSvgWrapper :path="mdiPlus" :size="20" />
+							</template>
+							{{ t('libresign', 'Create rule') }}
+						</NcButton>
+					</div>
+
+					<p v-if="createRuleDisabledReason && state.viewMode === 'system-admin'" class="policy-workbench__table-note policy-workbench__table-note--align-right">
+						{{ createRuleDisabledReason }}
+					</p>
+
+					<p v-if="state.createUserOverrideDisabledReason && crudScopeFilter === 'user'" class="policy-workbench__table-note">
+						{{ t('libresign', 'Some users may not allow personal rules because their group rule requires inheritance.') }}
+					</p>
+
+					<div class="policy-workbench__table-scroll">
+						<table class="policy-workbench__table">
+							<thead>
+								<tr>
+									<th>{{ t('libresign', 'Type') }}</th>
+									<th>{{ t('libresign', 'Target') }}</th>
+									<th>{{ t('libresign', 'Value') }}</th>
+									<th>{{ t('libresign', 'Actions') }}</th>
+								</tr>
+							</thead>
+							<tbody>
+								<tr v-for="row in pagedCrudRows" :key="row.key">
+									<td>{{ crudScopeLabel(row.scope) }}</td>
+									<td>{{ row.targetLabel }}</td>
+									<td>{{ row.valueLabel }}</td>
+									<td class="policy-workbench__table-actions">
+										<template v-if="row.ruleId">
+											<NcActions
+												:aria-label="t('libresign', 'Rule actions')"
+												:open="openRuleActionsKey === row.key"
+												@update:open="updateRuleActionsOpen(row.key, $event)">
+												<NcActionButton @click="handleEditRule(row.scope, row.ruleId)">
+													<template #icon>
+														<NcIconSvgWrapper :path="mdiPencil" :size="16" />
+													</template>
+													{{ t('libresign', 'Edit') }}
+												</NcActionButton>
+												<NcActionButton v-if="row.canRemove" @click="handlePromptRuleRemoval(row.ruleId, row.scope, row.targetLabel)">
+													<template #icon>
+														<NcIconSvgWrapper :path="mdiDelete" :size="16" />
+													</template>
+													{{ t('libresign', 'Remove') }}
+												</NcActionButton>
+											</NcActions>
+										</template>
+										<span v-else class="policy-workbench__table-note">{{ t('libresign', 'Read only') }}</span>
+									</td>
+								</tr>
+								<tr v-if="pagedCrudRows.length === 0">
+									<td colspan="4" class="policy-workbench__table-empty">{{ t('libresign', 'No rules match the current filters.') }}</td>
+								</tr>
+							</tbody>
+						</table>
+					</div>
+
+					<div v-if="crudPageCount > 1" class="policy-workbench__pagination">
+						<NcButton variant="tertiary" size="small" :disabled="crudPage <= 1" @click="crudPage -= 1">{{ t('libresign', 'Previous') }}</NcButton>
+						<span>{{ t('libresign', 'Page {current} of {total}', { current: String(crudPage), total: String(crudPageCount) }) }}</span>
+						<NcButton variant="tertiary" size="small" :disabled="crudPage >= crudPageCount" @click="crudPage += 1">{{ t('libresign', 'Next') }}</NcButton>
+					</div>
+				</div>
+
+				</div>
+			</NcDialog>
+
+			<NcDialog
+				v-if="showCreateScopeDialog || state.editorDraft"
+				:name="ruleDialogTitle"
+				size="normal"
+				:class="ruleEditorDialogClass"
+				:buttons="ruleDialogButtons"
+				:can-close="true"
+				@closing="requestCloseRuleDialog()">
+				<div
+					v-if="state.editorDraft"
+					class="policy-workbench__editor-modal-body"
+					:class="ruleEditorDialogBodyClass">
+				<PolicyRuleEditorPanel
+					v-if="state.editorDraft"
+					:editor-draft="state.editorDraft"
+					:editor-mode="state.editorMode"
+					:editor-title="editorTitle"
+					:editor-help="editorHelp"
+					:active-editor="activeEditor"
+					:selected-target-options="selectedTargetOptions"
+					:available-targets="state.availableTargets"
+					:loading-targets="state.loadingTargets"
+					:duplicate-message="state.duplicateMessage"
+					:can-save-draft="state.canSaveDraft"
+					:save-status="saveStatus"
+					:show-inline-actions="false"
+					:show-back-button="showCreateRuleBackAction"
+					:show-allow-override-switch="state.activeDefinition?.key !== 'signature_flow'"
+					@search-targets="state.searchAvailableTargets"
+					@update-targets="onTargetChange"
+					@update-value="state.updateDraftValue"
+					@update-allow-override="state.updateDraftAllowOverride"
+					@back="requestBackToCreateScope()"
+					@save="handleSaveDraft()"
+					@cancel="requestCloseRuleDialog()" />
+			</div>
+			<div v-else class="policy-workbench__create-scope-dialog">
+				<p class="policy-workbench__create-scope-hint">{{ t('libresign', 'Choose the rule type to continue.') }}</p>
+				<div class="policy-workbench__create-scope-grid" role="listbox" :aria-label="t('libresign', 'Rule type')">
+					<button
+						v-for="option in createScopeOptions"
+						:key="option.scope"
+						type="button"
+						role="option"
+						class="policy-workbench__create-scope-option"
+						:class="{
+							'policy-workbench__create-scope-option--disabled': option.disabled,
+							'policy-workbench__create-scope-option--selected': selectedCreateScope === option.scope,
+						}"
+						:disabled="option.disabled"
+						:aria-selected="selectedCreateScope === option.scope"
+						@click="selectCreateScope(option.scope)">
+						<span class="policy-workbench__create-scope-option-icon" aria-hidden="true">
+							<NcIconSvgWrapper :path="mdiCheckCircleOutline" :size="16" />
+						</span>
+						<span class="policy-workbench__create-scope-option-title">{{ option.label }}</span>
+						<span class="policy-workbench__create-scope-option-description">{{ option.description }}</span>
+					</button>
+				</div>
+				<ul class="policy-workbench__create-scope-notes">
+					<li v-if="scopeCreateDisabledReason('group')">{{ t('libresign', 'Group') }}: {{ scopeCreateDisabledReason('group') }}</li>
+					<li v-if="scopeCreateDisabledReason('user') && state.viewMode === 'system-admin'">{{ t('libresign', 'User') }}: {{ scopeCreateDisabledReason('user') }}</li>
+				</ul>
+			</div>
+		</NcDialog>
+
+		<NcDialog
+			v-if="pendingDiscardAction"
+			:name="t('libresign', 'Discard unsaved changes?')"
+			:message="t('libresign', 'You have unsaved changes in this editor. If you continue, your changes will be lost.')"
+			:buttons="discardDialogButtons"
+			size="normal"
+			:can-close="true"
+			@closing="cancelDiscardDialog" />
+
+		<NcDialog
+			v-if="pendingRemoval"
+			:name="t('libresign', 'Confirm rule removal')"
+			:message="pendingRemovalMessage"
+			:buttons="removalDialogButtons"
+			size="normal"
+			:can-close="!isRemovingRule"
+			@closing="cancelRuleRemoval" />
+	</NcSettingsSection>
+</template>
+
+<script setup lang="ts">
+import {
+	mdiAccountMultipleOutline,
+	mdiAccountOutline,
+	mdiCheckCircleOutline,
+	mdiDelete,
+	mdiFilterVariant,
+	mdiFormatListBulletedSquare,
+	mdiInformationOutline,
+	mdiOfficeBuildingOutline,
+	mdiPencil,
+	mdiPlus,
+	mdiViewGridOutline,
+} from '@mdi/js'
+import { computed, nextTick, onBeforeUnmount, onMounted, reactive, ref } from 'vue'
+import { t } from '@nextcloud/l10n'
+
+import NcActionButton from '@nextcloud/vue/components/NcActionButton'
+import NcActions from '@nextcloud/vue/components/NcActions'
+import NcAppNavigationSearch from '@nextcloud/vue/components/NcAppNavigationSearch'
+import NcButton from '@nextcloud/vue/components/NcButton'
+import NcChip from '@nextcloud/vue/components/NcChip'
+import NcDialog from '@nextcloud/vue/components/NcDialog'
+import NcIconSvgWrapper from '@nextcloud/vue/components/NcIconSvgWrapper'
+import NcNoteCard from '@nextcloud/vue/components/NcNoteCard'
+import NcSettingsSection from '@nextcloud/vue/components/NcSettingsSection'
+import NcTextField from '@nextcloud/vue/components/NcTextField'
+
+import { usePoliciesStore } from '../../../store/policies'
+import { useUserConfigStore } from '../../../store/userconfig.js'
+import PolicyRuleEditorPanel from './PolicyRuleEditorPanel.vue'
+import { createRealPolicyWorkbenchState } from './useRealPolicyWorkbench'
+
+defineOptions({
+	name: 'RealPolicyWorkbench',
+})
+
+const policiesStore = usePoliciesStore()
+const userConfigStore = useUserConfigStore()
+const state = reactive(createRealPolicyWorkbenchState())
+const settingsFilter = ref('')
+const isSmallViewport = ref(false)
+const catalogLayout = ref<'cards' | 'compact'>('cards')
+const saveStatus = ref<'idle' | 'saving' | 'saved'>('idle')
+const saveFeedbackTimeout = ref<number | null>(null)
+const pendingRemoval = ref<{ ruleId: string, scope: 'system' | 'group' | 'user', targetLabel: string, help: string } | null>(null)
+const pendingDiscardAction = ref<'back-create-rule' | 'cancel-create-rule' | 'cancel-editor' | 'close-setting' | null>(null)
+const showCreateScopeDialog = ref(false)
+const selectedCreateScope = ref<'system' | 'group' | 'user' | null>(null)
+const isRemovingRule = ref(false)
+const removalFeedback = ref<string | null>(null)
+const removalFeedbackTimeout = ref<number | null>(null)
+const lastPress = ref<{ surface: 'cards' | 'list', key: string, x: number, y: number } | null>(null)
+const recentSelectionGesture = ref<{ surface: 'cards' | 'list', key: string, at: number } | null>(null)
+const clearCatalogFocusOnClose = ref(false)
+const openRuleActionsKey = ref<string | null>(null)
+const crudSearch = ref('')
+const crudScopeFilter = ref<'all' | 'system' | 'group' | 'user'>('all')
+const crudPage = ref(1)
+const scopeFilterOpen = ref(false)
+const CRUD_PAGE_SIZE = 20
+
+const DRAG_OPEN_THRESHOLD_PX = 6
+const SELECTION_GUARD_WINDOW_MS = 400
+const CATALOG_LAYOUT_CONFIG_KEY = 'policy_workbench_catalog_compact_view'
+const REMOVAL_FEEDBACK_DURATION_MS = 6000
+
+const filteredSettingSummaries = computed(() => {
+	const normalized = settingsFilter.value.trim().toLowerCase()
+	if (!normalized) {
+		return state.visibleSettingSummaries
+	}
+
+	return state.visibleSettingSummaries.filter((summary) => {
+		return [summary.title, summary.context ?? '', summary.description, summary.defaultSummary]
+			.some((value) => value.toLowerCase().includes(normalized))
+	})
+})
+
+const activeEditor = computed(() => state.activeDefinition?.editor ?? null)
+const effectiveCatalogLayout = computed(() => isSmallViewport.value ? 'cards' : catalogLayout.value)
+const hasActiveFilter = computed(() => settingsFilter.value.trim().length > 0)
+const catalogViewButtonLabel = computed(() => {
+	return effectiveCatalogLayout.value === 'cards'
+		? t('libresign', 'Switch to compact view')
+		: t('libresign', 'Switch to card view')
+})
+
+const selectedTargetOptions = computed(() => {
+	if (!state.editorDraft) {
+		return []
+	}
+
+	return state.availableTargets.filter((option) => state.editorDraft?.targetIds.includes(option.id))
+})
+
+type CrudScope = 'system' | 'group' | 'user'
+type CrudRow = {
+	key: string,
+	ruleId: string | null,
+	scope: CrudScope,
+	targetLabel: string,
+	valueLabel: string,
+	canRemove: boolean,
+}
+
+const filteredCrudRows = computed<CrudRow[]>(() => {
+	const rows: CrudRow[] = []
+	const systemRule = state.inheritedSystemRule
+	if (systemRule && state.hasGlobalDefault) {
+		rows.push({
+			key: systemRule.id,
+			ruleId: systemRule.id,
+			scope: 'system',
+			targetLabel: t('libresign', 'Default (everyone)'),
+			valueLabel: state.summary?.currentBaseValue ?? t('libresign', 'Not configured'),
+			canRemove: Boolean(systemRule.id),
+		})
+	}
+
+	for (const rule of state.visibleGroupRules) {
+		rows.push({
+			key: rule.id,
+			ruleId: rule.id,
+			scope: 'group',
+			targetLabel: state.resolveTargetLabel('group', rule.targetId || ''),
+			valueLabel: summarizeRuleValue(rule.value),
+			canRemove: true,
+		})
+	}
+
+	for (const rule of state.visibleUserRules) {
+		rows.push({
+			key: rule.id,
+			ruleId: rule.id,
+			scope: 'user',
+			targetLabel: state.resolveTargetLabel('user', rule.targetId || ''),
+			valueLabel: summarizeRuleValue(rule.value),
+			canRemove: true,
+		})
+	}
+
+	const scopePriority: Record<CrudScope, number> = {
+		user: 0,
+		group: 1,
+		system: 2,
+	}
+
+	rows.sort((left, right) => {
+		const priorityDiff = scopePriority[left.scope] - scopePriority[right.scope]
+		if (priorityDiff !== 0) {
+			return priorityDiff
+		}
+
+		return left.targetLabel.localeCompare(right.targetLabel)
+	})
+
+	const normalized = crudSearch.value.trim().toLowerCase()
+
+	return rows.filter((row) => {
+		if (crudScopeFilter.value !== 'all' && row.scope !== crudScopeFilter.value) {
+			return false
+		}
+
+		if (!normalized) {
+			return true
+		}
+
+		const scope = crudScopeLabel(row.scope).toLowerCase()
+		return [scope, row.targetLabel.toLowerCase(), row.valueLabel.toLowerCase()]
+			.some((value) => value.includes(normalized))
+	})
+})
+
+const crudPageCount = computed(() => Math.max(1, Math.ceil(filteredCrudRows.value.length / CRUD_PAGE_SIZE)))
+const pagedCrudRows = computed(() => {
+	if (crudPage.value > crudPageCount.value) {
+		crudPage.value = crudPageCount.value
+	}
+
+	const start = (crudPage.value - 1) * CRUD_PAGE_SIZE
+	return filteredCrudRows.value.slice(start, start + CRUD_PAGE_SIZE)
+})
+
+const ruleDialogTitle = computed(() => {
+	if (!state.editorDraft) {
+		return t('libresign', 'What do you want to create?')
+	}
+
+	return state.editorMode === 'edit'
+		? t('libresign', 'Edit rule')
+		: t('libresign', 'Create rule')
+})
+
+const editorTitle = computed(() => {
+	if (!state.editorDraft) {
+		return ''
+	}
+
+	return state.editorMode === 'edit'
+		? t('libresign', 'Edit rule')
+		: t('libresign', 'Create rule')
+})
+
+const editorHelp = computed(() => {
+	if (!state.editorDraft) {
+		return ''
+	}
+
+	return ''
+})
+
+const showCreateRuleBackAction = computed(() => {
+	return showCreateScopeDialog.value && state.editorMode === 'create'
+})
+
+const dialogDescription = computed(() => state.activeDefinition?.description || '')
+
+const ruleEditorDialogClass = computed(() => {
+	return state.activeDefinition?.editorDialogLayout === 'wide'
+		? 'policy-workbench__rule-dialog policy-workbench__rule-dialog--wide'
+		: 'policy-workbench__rule-dialog'
+})
+
+const ruleEditorDialogBodyClass = computed(() => {
+	return state.activeDefinition?.editorDialogLayout === 'wide'
+		? 'policy-workbench__editor-modal-body--wide'
+		: ''
+})
+
+function scopeCreateDisabledReason(scope: 'system' | 'group' | 'user') {
+	if (scope === 'group') {
+		return state.createGroupOverrideDisabledReason || ''
+	}
+
+	if (scope === 'user') {
+		return state.createUserOverrideDisabledReason || ''
+	}
+
+	if (state.hasGlobalDefault) {
+		return t('libresign', 'A default for everyone already exists. Use Change to update it.')
+	}
+
+	return ''
+}
+
+const hasCreatableScope = computed(() => {
+	return ['system', 'group', 'user']
+		.some((scope) => scopeCreateDisabledReason(scope as 'system' | 'group' | 'user').length === 0)
+})
+
+const createRuleDisabledReason = computed(() => {
+	if (!hasCreatableScope.value) {
+		return t('libresign', 'A higher-level rule is blocking new exceptions in all scopes.')
+	}
+
+	return ''
+})
+
+const createScopeOptions = computed<Array<{
+	scope: 'system' | 'group' | 'user',
+	label: string,
+	description: string,
+	disabled: boolean,
+}>>(() => {
+	const options = [
+		{
+			scope: 'user' as const,
+			label: t('libresign', 'User'),
+			description: t('libresign', 'Affects a specific user'),
+			disabled: scopeCreateDisabledReason('user').length > 0,
+		},
+		{
+			scope: 'group' as const,
+			label: t('libresign', 'Group'),
+			description: t('libresign', 'Affects all users in a group'),
+			disabled: scopeCreateDisabledReason('group').length > 0,
+		},
+		{
+			scope: 'system' as const,
+			label: t('libresign', 'Everyone'),
+			description: t('libresign', 'Affects all users'),
+			disabled: scopeCreateDisabledReason('system').length > 0,
+		},
+	]
+
+	return options.filter((option) => {
+		if (option.scope === 'system') {
+			return !option.disabled
+		}
+
+		if (option.scope !== 'user') {
+			return true
+		}
+
+		return state.viewMode === 'system-admin' || !option.disabled
+	})
+})
+
+const activeScopeFilterChip = computed(() => {
+	if (crudScopeFilter.value === 'all') {
+		return ''
+	}
+
+	return t('libresign', 'Scope: {scope}', {
+		scope: crudScopeLabel(crudScopeFilter.value),
+	})
+})
+
+const defaultSourceLabel = computed(() => {
+	return state.hasGlobalDefault
+		? t('libresign', 'custom')
+		: t('libresign', 'default')
+})
+
+const pendingRemovalMessage = computed(() => {
+	if (!pendingRemoval.value) {
+		return ''
+	}
+
+	return t('libresign', 'You are about to remove the rule for {target}. {help}', {
+		target: pendingRemoval.value.targetLabel,
+		help: pendingRemoval.value.help,
+	})
+})
+
+const ruleDialogButtons = computed(() => {
+	if (!state.editorDraft) {
+		return undefined
+	}
+
+	const buttons: Array<{
+		label: string,
+		variant: 'primary' | 'secondary' | 'tertiary',
+		disabled?: boolean,
+		callback: () => false | Promise<false>,
+	}> = []
+
+	if (showCreateRuleBackAction.value) {
+		buttons.push({
+			label: t('libresign', '← Back'),
+			variant: 'tertiary',
+			disabled: saveStatus.value === 'saving',
+			callback: () => {
+				requestBackToCreateScope()
+				return false
+			},
+		})
+	}
+
+	buttons.push({
+		label: state.editorMode === 'edit' ? t('libresign', 'Save changes') : t('libresign', 'Create rule'),
+		variant: 'primary',
+		disabled: !state.canSaveDraft,
+		callback: async () => {
+			await handleSaveDraft()
+			return false as const
+		},
+	})
+
+	buttons.push({
+		label: t('libresign', 'Cancel'),
+		variant: 'secondary',
+		disabled: saveStatus.value === 'saving',
+		callback: () => {
+			requestCloseRuleDialog()
+			return false
+		},
+	})
+
+	return buttons
+})
+
+const discardDialogButtons = computed(() => {
+	return [
+		{
+			label: t('libresign', 'Keep editing'),
+			variant: 'secondary' as const,
+			callback: () => cancelDiscardDialog(),
+		},
+		{
+			label: t('libresign', 'Discard changes'),
+			variant: 'error' as const,
+			callback: () => confirmDiscardDialog(),
+		},
+	]
+})
+
+const removalDialogButtons = computed(() => {
+	return [
+		{
+			label: t('libresign', 'Cancel'),
+			variant: 'secondary' as const,
+			disabled: isRemovingRule.value,
+			callback: () => cancelRuleRemoval(),
+		},
+		{
+			label: isRemovingRule.value ? t('libresign', 'Removing exception...') : t('libresign', 'Remove exception'),
+			variant: 'error' as const,
+			disabled: isRemovingRule.value,
+			callback: () => {
+				void confirmRuleRemoval()
+			},
+		},
+	]
+})
+
+function onTargetChange(option: { id: string } | Array<{ id: string }> | null) {
+	if (Array.isArray(option)) {
+		state.updateDraftTargets(option.map(({ id }) => id))
+		return
+	}
+
+	state.updateDraftTargets(option?.id ? [option.id] : [])
+}
+
+function summarizeRuleValue(value: unknown) {
+	if (!state.activeDefinition) {
+		return ''
+	}
+
+	return state.activeDefinition.summarizeValue(value as never)
+}
+
+function resolveSignatureFlowMode(value: unknown): 'parallel' | 'ordered_numeric' | 'none' | null {
+	if (value === 0 || value === 'none') {
+		return 'none'
+	}
+
+	if (value === 1 || value === 'parallel') {
+		return 'parallel'
+	}
+
+	if (value === 2 || value === 'ordered_numeric') {
+		return 'ordered_numeric'
+	}
+
+	if (value && typeof value === 'object' && 'flow' in (value as Record<string, unknown>)) {
+		const candidate = (value as { flow?: unknown }).flow
+		if (candidate === 'parallel' || candidate === 'ordered_numeric' || candidate === 'none') {
+			return candidate
+		}
+	}
+
+	return null
+}
+
+function crudScopeLabel(scope: CrudScope) {
+	if (scope === 'system') {
+		return t('libresign', 'Everyone')
+	}
+
+	if (scope === 'group') {
+		return t('libresign', 'Group')
+	}
+
+	return t('libresign', 'User')
+}
+
+function onCrudSearchChange(value: string | number) {
+	crudSearch.value = String(value ?? '')
+	crudPage.value = 1
+}
+
+function setCrudScopeFilter(value: 'all' | 'system' | 'group' | 'user', selected: boolean) {
+	if (!selected) {
+		return
+	}
+
+	crudScopeFilter.value = value
+	crudPage.value = 1
+	scopeFilterOpen.value = false
+}
+
+function requestCreateRule() {
+	if (!hasCreatableScope.value || saveStatus.value === 'saving') {
+		return
+	}
+
+	if (state.editorDraft) {
+		if (state.isDraftDirty) {
+			pendingDiscardAction.value = 'cancel-create-rule'
+			return
+		}
+
+		state.cancelEditor()
+	}
+
+	selectedCreateScope.value = null
+	showCreateScopeDialog.value = true
+}
+
+function cancelCreateScopeDialog() {
+	state.cancelEditor()
+	showCreateScopeDialog.value = false
+	selectedCreateScope.value = null
+}
+
+function selectCreateScope(scope: 'system' | 'group' | 'user') {
+	if (scopeCreateDisabledReason(scope).length > 0) {
+		return
+	}
+
+	selectedCreateScope.value = scope
+	startCreateRuleForScope(scope)
+}
+
+function shouldLockSignatureFlowOverride(scope: 'system' | 'group' | 'user') {
+	return state.activeDefinition?.key === 'signature_flow' && scope !== 'user'
+}
+
+function normalizeEditorDraftSignatureFlowOverride() {
+	if (!state.editorDraft || !shouldLockSignatureFlowOverride(state.editorDraft.scope)) {
+		return
+	}
+
+	state.editorDraft.allowChildOverride = false
+}
+
+function openRuleEditor(scope: 'system' | 'group' | 'user', ruleId?: string) {
+	state.startEditor(ruleId ? { scope, ruleId } : { scope })
+	normalizeEditorDraftSignatureFlowOverride()
+}
+
+function startCreateRuleForScope(scope: 'system' | 'group' | 'user') {
+	if (scopeCreateDisabledReason(scope).length > 0) {
+		return
+	}
+
+	openRuleEditor(scope)
+}
+
+function requestBackToCreateScope() {
+	if (saveStatus.value === 'saving') {
+		return
+	}
+
+	if (state.isDraftDirty) {
+		pendingDiscardAction.value = 'back-create-rule'
+		return
+	}
+
+	state.cancelEditor()
+	selectedCreateScope.value = null
+}
+
+function onSettingsFilterChange(value: string | number) {
+	settingsFilter.value = String(value ?? '')
+}
+
+function hasActiveTextSelection() {
+	const selection = window.getSelection()
+	return !!selection && selection.type === 'Range' && selection.toString().trim().length > 0
+}
+
+function markSelectionGesture(surface: 'cards' | 'list', key: string) {
+	if (!hasActiveTextSelection()) {
+		return
+	}
+
+	recentSelectionGesture.value = {
+		surface,
+		key,
+		at: Date.now(),
+	}
+}
+
+function shouldIgnoreDueToRecentSelection(surface: 'cards' | 'list', key: string) {
+	const gesture = recentSelectionGesture.value
+	if (!gesture) {
+		return false
+	}
+
+	const expired = (Date.now() - gesture.at) > SELECTION_GUARD_WINDOW_MS
+	const matchesTarget = gesture.surface === surface && gesture.key === key
+	if (expired || !matchesTarget) {
+		return false
+	}
+
+	recentSelectionGesture.value = null
+	return true
+}
+
+function isPlainPrimaryClick(event: MouseEvent) {
+	const button = typeof event.button === 'number' ? event.button : 0
+	const hasModifier = Boolean(event.metaKey || event.ctrlKey || event.shiftKey || event.altKey)
+	return button === 0 && !hasModifier
+}
+
+function trackPress(surface: 'cards' | 'list', key: string, event: PointerEvent) {
+	if (event.button !== 0) {
+		lastPress.value = null
+		return
+	}
+
+	lastPress.value = {
+		surface,
+		key,
+		x: event.clientX,
+		y: event.clientY,
+	}
+}
+
+function movedBeyondThreshold(event: MouseEvent, press: { x: number, y: number }) {
+	const deltaX = Math.abs(event.clientX - press.x)
+	const deltaY = Math.abs(event.clientY - press.y)
+	return deltaX > DRAG_OPEN_THRESHOLD_PX || deltaY > DRAG_OPEN_THRESHOLD_PX
+}
+
+function openSettingFromPointer(surface: 'cards' | 'list', key: string, event: MouseEvent) {
+	if (!isPlainPrimaryClick(event)) {
+		return
+	}
+
+	if (shouldIgnoreDueToRecentSelection(surface, key)) {
+		return
+	}
+
+	if (hasActiveTextSelection()) {
+		return
+	}
+
+	const press = lastPress.value
+	if (press && press.surface === surface && press.key === key && movedBeyondThreshold(event, press)) {
+		return
+	}
+
+	clearCatalogFocusOnClose.value = true
+	state.openSetting(key as never)
+}
+
+function openSettingFromAction(key: string, event: MouseEvent) {
+	clearCatalogFocusOnClose.value = event.detail > 0
+	state.openSetting(key as never)
+}
+
+function openSettingFromKeyboard(key: string) {
+	clearCatalogFocusOnClose.value = false
+	state.openSetting(key as never)
+}
+
+function clearSettingsFilter() {
+	settingsFilter.value = ''
+}
+
+function escapeRegExp(value: string) {
+	return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+}
+
+function escapeHtml(value: string) {
+	return value
+		.replaceAll('&', '&amp;')
+		.replaceAll('<', '&lt;')
+		.replaceAll('>', '&gt;')
+		.replaceAll('"', '&quot;')
+		.replaceAll("'", '&#39;')
+}
+
+function highlightText(value: string) {
+	const query = settingsFilter.value.trim()
+	const safeValue = escapeHtml(value)
+	if (!query) {
+		return safeValue
+	}
+
+	const matcher = new RegExp(`(${escapeRegExp(query)})`, 'ig')
+	return safeValue.replace(matcher, '<mark>$1</mark>')
+}
+
+function hasActiveOverrides(groupCount: number, userCount: number) {
+	return groupCount > 0 || userCount > 0
+}
+
+function formatOverrideSummary(groupCount: number, userCount: number) {
+	if (groupCount === 0 && userCount === 0) {
+		return t('libresign', 'none')
+	}
+
+	return t('libresign', '{groupCount} groups · {userCount} users', {
+		groupCount: String(groupCount),
+		userCount: String(userCount),
+	})
+}
+
+function toggleCatalogLayout() {
+	if (isSmallViewport.value) {
+		catalogLayout.value = 'cards'
+		return
+	}
+
+	const nextLayout = effectiveCatalogLayout.value === 'cards' ? 'compact' : 'cards'
+	catalogLayout.value = nextLayout
+	void userConfigStore.update(CATALOG_LAYOUT_CONFIG_KEY, nextLayout === 'compact')
+}
+
+function updateViewportMode() {
+	isSmallViewport.value = window.innerWidth <= 960
+}
+
+async function handleSaveDraft() {
+	if (!state.canSaveDraft || saveStatus.value === 'saving') {
+		return
+	}
+
+	normalizeEditorDraftSignatureFlowOverride()
+	saveStatus.value = 'saving'
+	await nextTick()
+	await state.saveDraft()
+
+	// When save succeeds, the editor draft is cleared by state.saveDraft().
+	// Ensure the scope chooser does not remain visible behind the saved flow.
+	if (!state.editorDraft) {
+		showCreateScopeDialog.value = false
+		selectedCreateScope.value = null
+	}
+
+	saveStatus.value = 'saved'
+
+	if (saveFeedbackTimeout.value !== null) {
+		window.clearTimeout(saveFeedbackTimeout.value)
+	}
+
+	saveFeedbackTimeout.value = window.setTimeout(() => {
+		saveStatus.value = 'idle'
+		saveFeedbackTimeout.value = null
+	}, 1300)
+}
+
+function promptRuleRemoval(ruleId: string, scope: 'system' | 'group' | 'user', targetLabel: string) {
+	const help = scope === 'system'
+		? t('libresign', 'Removing this custom default restores the default behavior for everyone.')
+		: scope === 'group'
+			? t('libresign', 'Removing this rule restores inherited behavior for this group.')
+			: t('libresign', 'Removing this rule will restore inherited behavior for this user.')
+
+	pendingRemoval.value = { ruleId, scope, targetLabel, help }
+}
+
+function updateRuleActionsOpen(ruleKey: string, open: boolean) {
+	openRuleActionsKey.value = open ? ruleKey : (openRuleActionsKey.value === ruleKey ? null : openRuleActionsKey.value)
+}
+
+function closeOpenActionsMenu() {
+	openRuleActionsKey.value = null
+	const activeElement = document.activeElement
+	if (activeElement instanceof HTMLElement) {
+		activeElement.blur()
+	}
+}
+
+function handleEditRule(scope: 'system' | 'group' | 'user', ruleId: string) {
+	closeOpenActionsMenu()
+	openRuleEditor(scope, ruleId)
+}
+
+function handlePromptRuleRemoval(ruleId: string, scope: 'system' | 'group' | 'user', targetLabel: string) {
+	closeOpenActionsMenu()
+	promptRuleRemoval(ruleId, scope, targetLabel)
+}
+
+function cancelRuleRemoval() {
+	pendingRemoval.value = null
+}
+
+function cancelDiscardDialog() {
+	pendingDiscardAction.value = null
+}
+
+function confirmDiscardDialog() {
+	const action = pendingDiscardAction.value
+	pendingDiscardAction.value = null
+
+	if (action === 'back-create-rule') {
+		state.cancelEditor()
+		selectedCreateScope.value = null
+		return
+	}
+
+	if (action === 'cancel-create-rule') {
+		cancelCreateScopeDialog()
+		return
+	}
+
+	if (action === 'cancel-editor') {
+		state.cancelEditor()
+		return
+	}
+
+	if (action === 'close-setting') {
+		state.closeSetting()
+		if (clearCatalogFocusOnClose.value) {
+			void nextTick().then(() => {
+				const activeElement = document.activeElement
+				if (activeElement instanceof HTMLElement) {
+					activeElement.blur()
+				}
+			})
+		}
+		clearCatalogFocusOnClose.value = false
+	}
+
+	openRuleActionsKey.value = null
+}
+
+async function confirmRuleRemoval() {
+	if (!pendingRemoval.value) {
+		return
+	}
+
+	isRemovingRule.value = true
+	try {
+		const scope = pendingRemoval.value.scope
+		await state.removeRule(pendingRemoval.value.ruleId)
+		removalFeedback.value = scope === 'system'
+			? t('libresign', 'Custom default removed. The default behavior for everyone is active again.')
+			: scope === 'group'
+				? t('libresign', 'Group custom rule removed. Inherited behavior is now active.')
+				: t('libresign', 'User custom rule removed. Inherited behavior is now active.')
+
+		if (removalFeedbackTimeout.value !== null) {
+			window.clearTimeout(removalFeedbackTimeout.value)
+		}
+
+		removalFeedbackTimeout.value = window.setTimeout(() => {
+			removalFeedback.value = null
+			removalFeedbackTimeout.value = null
+		}, REMOVAL_FEEDBACK_DURATION_MS)
+
+		pendingRemoval.value = null
+	} finally {
+		isRemovingRule.value = false
+	}
+}
+
+function requestCancelEditor() {
+	if (saveStatus.value === 'saving') {
+		return
+	}
+
+	if (state.isDraftDirty) {
+		pendingDiscardAction.value = 'cancel-editor'
+		return
+	}
+
+	state.cancelEditor()
+}
+
+function requestCloseRuleDialog() {
+	if (saveStatus.value === 'saving') {
+		return
+	}
+
+	if (!state.editorDraft) {
+		cancelCreateScopeDialog()
+		return
+	}
+
+	if (showCreateScopeDialog.value && state.editorMode === 'create') {
+		if (state.isDraftDirty) {
+			pendingDiscardAction.value = 'cancel-create-rule'
+			return
+		}
+
+		cancelCreateScopeDialog()
+		return
+	}
+
+	requestCancelEditor()
+}
+
+function requestCloseSetting() {
+	if (saveStatus.value === 'saving' || isRemovingRule.value) {
+		return
+	}
+
+	if (state.isDraftDirty) {
+		pendingDiscardAction.value = 'close-setting'
+		return
+	}
+
+	state.closeSetting()
+	if (clearCatalogFocusOnClose.value) {
+		void nextTick().then(() => {
+			const activeElement = document.activeElement
+			if (activeElement instanceof HTMLElement) {
+				activeElement.blur()
+			}
+		})
+	}
+	clearCatalogFocusOnClose.value = false
+}
+
+onMounted(async () => {
+	updateViewportMode()
+	catalogLayout.value = userConfigStore.policy_workbench_catalog_compact_view ? 'compact' : 'cards'
+	window.addEventListener('resize', updateViewportMode, { passive: true })
+	await policiesStore.fetchEffectivePolicies()
+})
+
+onBeforeUnmount(() => {
+	window.removeEventListener('resize', updateViewportMode)
+	if (saveFeedbackTimeout.value !== null) {
+		window.clearTimeout(saveFeedbackTimeout.value)
+	}
+
+	if (removalFeedbackTimeout.value !== null) {
+		window.clearTimeout(removalFeedbackTimeout.value)
+	}
+
+	pendingDiscardAction.value = null
+	openRuleActionsKey.value = null
+	showCreateScopeDialog.value = false
+	selectedCreateScope.value = null
+})
+</script>
+
+<style scoped lang="scss">
+.policy-workbench {
+	&__catalog-toolbar {
+		margin-top: 1.1rem;
+		display: grid;
+		grid-template-columns: minmax(0, 1fr) auto;
+		gap: 0.75rem;
+		align-items: start;
+	}
+
+	&__catalog-search {
+		display: flex;
+		flex-direction: column;
+		gap: 0.4rem;
+	}
+
+	&__catalog-foot {
+		display: flex;
+		justify-content: space-between;
+		align-items: center;
+		gap: 0.75rem;
+
+		:deep(.button-vue) {
+			white-space: nowrap;
+		}
+	}
+
+	&__clear-filter-button {
+		&--hidden {
+			visibility: hidden;
+			pointer-events: none;
+		}
+	}
+
+	&__catalog-view-switch {
+		display: flex;
+		gap: 0.6rem;
+		flex-wrap: wrap;
+		justify-content: flex-end;
+
+		:deep(.button-vue) {
+			min-width: var(--clickable-area-small);
+		}
+	}
+
+	&__catalog-view-button {
+		:deep(.button-vue__text) {
+			display: none;
+		}
+	}
+
+	&__catalog-meta {
+		margin: 0;
+		font-size: 0.86rem;
+		color: var(--color-text-maxcontrast);
+	}
+
+	&__crud-filter-chips {
+		display: flex;
+		align-items: center;
+		gap: 0.35rem;
+		flex-wrap: wrap;
+	}
+
+	&__settings-grid {
+		margin-top: 1rem;
+		display: grid;
+		grid-template-columns: repeat(2, minmax(0, 1fr));
+		gap: 1rem;
+	}
+
+	&__settings-list {
+		margin-top: 1rem;
+		display: flex;
+		flex-direction: column;
+		gap: 0.75rem;
+	}
+
+	&__settings-row {
+		display: grid;
+		grid-template-columns: minmax(220px, 1.2fr) minmax(0, 1fr) auto;
+		gap: 1rem;
+		align-items: center;
+		padding: 0.9rem 1rem;
+		border-radius: 14px;
+		border: 1px solid color-mix(in srgb, var(--color-primary-element) 12%, var(--color-border-maxcontrast));
+		background: color-mix(in srgb, var(--color-main-background) 94%, white);
+		transition: border-color 0.15s ease, box-shadow 0.15s ease;
+
+		&:hover,
+		&:focus-within {
+			border-color: color-mix(in srgb, var(--color-primary-element) 40%, var(--color-border-maxcontrast));
+			box-shadow: 0 0 0 2px color-mix(in srgb, var(--color-primary-element) 12%, transparent);
+		}
+
+		:deep(.button-vue) {
+			flex-shrink: 0;
+		}
+	}
+
+	&__settings-row-main {
+		min-width: 0;
+
+		h3,
+		p {
+			margin: 0;
+		}
+
+		h3 {
+			overflow-wrap: anywhere;
+		}
+
+		p:not(.policy-workbench__origin-badge) {
+			margin-top: 0.25rem;
+			color: var(--color-text-maxcontrast);
+			display: -webkit-box;
+			-webkit-box-orient: vertical;
+			-webkit-line-clamp: 2;
+			overflow: hidden;
+		}
+	}
+
+	&__origin-badge {
+		margin: 0;
+		display: inline-flex;
+		align-self: flex-start;
+		padding: 0.2rem 0.55rem;
+		border-radius: 999px;
+		font-size: 0.76rem;
+		font-weight: 600;
+		color: var(--color-primary-element);
+		border: 1px solid color-mix(in srgb, var(--color-primary-element) 28%, var(--color-border-maxcontrast));
+		background: color-mix(in srgb, var(--color-primary-element) 16%, var(--color-main-background));
+
+		&--inline {
+			margin-top: 0.5rem;
+		}
+	}
+
+	&__settings-row-stats {
+		display: flex;
+		flex-wrap: wrap;
+		gap: 0.55rem 0.8rem;
+		align-items: baseline;
+		font-size: 0.9rem;
+		color: var(--color-text-maxcontrast);
+		min-width: 0;
+	}
+
+	&__settings-row-stat {
+		min-width: 0;
+		white-space: normal;
+		overflow-wrap: anywhere;
+
+		&--default {
+			display: flex;
+			align-items: baseline;
+			gap: 0.25rem;
+			flex: 1 1 260px;
+			min-width: 0;
+
+			strong {
+				white-space: nowrap;
+				flex-shrink: 0;
+			}
+
+			span {
+				display: block;
+				min-width: 0;
+				white-space: nowrap;
+				overflow: hidden;
+				text-overflow: ellipsis;
+			}
+		}
+
+		&--count {
+			white-space: nowrap;
+			flex: 0 0 auto;
+		}
+	}
+
+	&__setting-tile {
+		text-align: left;
+		padding: 1.25rem;
+		border-radius: 20px;
+		border: 1px solid color-mix(in srgb, var(--color-primary-element) 14%, var(--color-border-maxcontrast));
+		background:
+			radial-gradient(circle at top right, color-mix(in srgb, var(--color-primary-element) 14%, transparent), transparent 45%),
+			linear-gradient(180deg, color-mix(in srgb, var(--color-main-background) 92%, white), var(--color-main-background));
+		display: flex;
+		flex-direction: column;
+		justify-content: space-between;
+		gap: 1rem;
+		min-height: 240px;
+		height: 100%;
+		cursor: pointer;
+		transition: border-color 0.15s ease, box-shadow 0.15s ease;
+
+		&:hover,
+		&:focus-visible,
+		&:focus-within {
+			border-color: color-mix(in srgb, var(--color-primary-element) 46%, var(--color-border-maxcontrast));
+			box-shadow: 0 0 0 2px color-mix(in srgb, var(--color-primary-element) 14%, transparent);
+		}
+
+		h3,
+		p {
+			margin: 0;
+		}
+
+		:deep(.button-vue) {
+			flex-shrink: 0;
+		}
+	}
+
+	&__setting-header {
+		display: block;
+
+		> div {
+			min-width: 0;
+		}
+
+		h3 {
+			overflow-wrap: anywhere;
+			word-break: break-word;
+		}
+	}
+
+	&__setting-title {
+		display: inline-flex;
+		align-items: baseline;
+		gap: 0.35rem;
+	}
+
+	&__setting-context {
+		font-size: 0.88em;
+		font-weight: 500;
+		color: var(--color-text-maxcontrast);
+	}
+
+	&__setting-body {
+		display: flex;
+		flex-direction: column;
+		gap: 0.85rem;
+		min-height: 0;
+	}
+
+	&__setting-description {
+		margin: 0;
+		color: var(--color-text-maxcontrast);
+		display: -webkit-box;
+		-webkit-box-orient: vertical;
+		-webkit-line-clamp: 2;
+		overflow: hidden;
+		min-height: calc(1.4em * 2);
+	}
+
+	&__setting-footer {
+		margin-top: auto;
+		display: flex;
+		justify-content: flex-start;
+	}
+
+	&__setting-stats {
+		margin: 0;
+		padding: 0;
+		list-style: none;
+		display: flex;
+		flex-direction: column;
+		gap: 0.5rem;
+
+		li {
+			display: flex;
+			gap: 0.3rem;
+			align-items: baseline;
+			min-width: 0;
+
+			strong {
+				white-space: nowrap;
+				flex-shrink: 0;
+			}
+
+			span {
+				min-width: 0;
+				overflow-wrap: anywhere;
+			}
+		}
+	}
+
+	@media (max-width: 960px) {
+		&__settings-grid {
+			grid-template-columns: minmax(0, 1fr);
+		}
+
+		&__settings-row {
+			grid-template-columns: minmax(0, 1fr);
+		}
+	}
+
+	&__manage-button {
+		:deep(.button-vue) {
+			transition: transform 0.12s ease;
+		}
+	}
+
+	&__setting-tile:hover &__manage-button,
+	&__setting-tile:focus-within &__manage-button,
+	&__settings-row:hover &__manage-button,
+	&__settings-row:focus-within &__manage-button {
+		:deep(.button-vue) {
+			transform: translateY(-1px);
+		}
+	}
+
+	&__empty-state {
+		display: flex;
+		flex-direction: column;
+		gap: 0.65rem;
+
+		p {
+			margin: 0;
+		}
+
+		&--compact {
+			gap: 0.5rem;
+		}
+	}
+
+	&__empty-state-actions {
+		display: flex;
+		gap: 0.6rem;
+		flex-wrap: wrap;
+	}
+
+	&__dialog {
+		width: min(1480px, 100%);
+		min-height: min(820px, calc(100vh - 7rem));
+		margin: 0 auto;
+		display: flex;
+		flex-direction: column;
+		gap: 0;
+	}
+
+	&__dialog-header {
+		display: flex;
+		justify-content: flex-start;
+		flex-direction: column;
+		gap: 1rem;
+		align-items: flex-start;
+
+		h2,
+		p {
+			margin: 0;
+		}
+
+		h2 {
+			word-break: break-word;
+		}
+	}
+
+	&__dialog-description {
+		max-width: 72ch;
+		color: var(--color-text-maxcontrast);
+	}
+
+	&__dialog-actions {
+		display: flex;
+		flex-wrap: wrap;
+		gap: 0.75rem;
+
+		:deep(.button-vue) {
+			max-width: 100%;
+		}
+	}
+
+	&__main {
+		flex: 1;
+		min-width: 0;
+		display: flex;
+		flex-direction: column;
+	}
+
+	&__tier {
+		padding: 1.25rem 0;
+		border-bottom: 1px solid color-mix(in srgb, var(--color-border) 50%, transparent);
+
+		&:last-child {
+			border-bottom: none;
+		}
+	}
+
+	&__tier-head {
+		display: flex;
+		align-items: flex-start;
+		gap: 1rem;
+		margin-bottom: 0.75rem;
+
+		:deep(.button-vue) {
+			flex-shrink: 0;
+		}
+	}
+
+	&__tier-info {
+		flex: 1;
+		min-width: 0;
+	}
+
+	&__tier-title {
+		margin: 0;
+		font-size: 0.95rem;
+		font-weight: 600;
+	}
+
+	&__tier-desc {
+		margin: 0.25rem 0 0;
+		font-size: 0.85rem;
+		color: var(--color-text-maxcontrast);
+		max-width: 72ch;
+	}
+
+	&__tier-actions {
+		display: flex;
+		align-items: center;
+		gap: 0.5rem;
+		flex-shrink: 0;
+	}
+
+	&__tier-value {
+		display: flex;
+		align-items: center;
+		gap: 0.75rem;
+		margin-bottom: 0.5rem;
+	}
+
+	&__current-value {
+		font-size: 1.1rem;
+		font-weight: 700;
+		color: var(--color-main-text);
+	}
+
+	&__value-source {
+		font-size: 0.82rem;
+		color: var(--color-text-maxcontrast);
+		padding: 0.1rem 0.45rem;
+		border-radius: 9px;
+		background: color-mix(in srgb, var(--color-background-dark) 60%, transparent);
+	}
+
+	&__tier-empty {
+		margin: 0.5rem 0 0;
+		font-size: 0.88rem;
+		color: var(--color-text-maxcontrast);
+		font-style: italic;
+	}
+
+	&__table-toolbar-row {
+		display: flex;
+		align-items: center;
+		gap: 0.65rem;
+		flex-wrap: wrap;
+		margin-bottom: 0.75rem;
+
+		&--crud {
+			align-items: flex-start;
+			gap: 0.85rem;
+
+			.policy-workbench__search-with-chips {
+				flex: 1 1 360px;
+				min-width: min(100%, 420px);
+				display: flex;
+				flex-direction: column;
+				gap: 0.35rem;
+
+				:deep(.app-navigation-search) {
+					width: 100%;
+				}
+			}
+
+			:deep(.app-navigation-search__actions) {
+				display: inline-flex;
+				align-items: center;
+				gap: 0.25rem;
+			}
+
+			:deep(.app-navigation-search__actions--hidden) {
+				margin-inline-start: 0;
+			}
+
+			:deep(.app-navigation-search__actions.hidden-visually) {
+				position: static;
+				width: auto;
+				height: auto;
+				margin: 0;
+				overflow: visible;
+				clip: auto;
+				clip-path: none;
+				white-space: normal;
+			}
+		}
+	}
+
+	&__crud-create-cta {
+		:deep(.button-vue) {
+			white-space: nowrap;
+			font-weight: 600;
+		}
+	}
+
+
+	&__workspace {
+		display: grid;
+		grid-template-columns: minmax(300px, 0.82fr) minmax(560px, 1.18fr);
+		gap: 1.25rem;
+		align-items: start;
+		flex: 1;
+	}
+
+	&__rules-column,
+	&__editor-column {
+		display: flex;
+		flex-direction: column;
+		gap: 1rem;
+		min-width: 0;
+	}
+
+	&__group,
+	&__editor-panel,
+	&__editor-mobile-hint,
+	&__editor-empty {
+		display: flex;
+		flex-direction: column;
+		gap: 0.85rem;
+		overflow: hidden;
+	}
+
+	&__editor-panel-content {
+		display: flex;
+		flex-direction: column;
+		gap: 0.85rem;
+
+		&--saving {
+			opacity: 0.5;
+			pointer-events: none;
+			user-select: none;
+		}
+	}
+
+	&__editor-panel,
+	&__editor-mobile-hint,
+	&__editor-empty {
+		position: sticky;
+		top: 0;
+	}
+
+	&__editor-mobile-hint {
+		p,
+		h3 {
+			margin: 0;
+		}
+
+		p:last-of-type {
+			margin-top: 0.25rem;
+			color: var(--color-text-maxcontrast);
+		}
+
+		:deep(.button-vue) {
+			margin-top: 0.65rem;
+			width: 100%;
+			justify-content: center;
+		}
+	}
+
+	// Editor aside panel (desktop)
+	&__editor-aside {
+		display: none;
+	}
+
+	@media (max-width: 720px) {
+		&__table-toolbar-row--crud {
+			align-items: stretch;
+		}
+
+		&__crud-create-cta {
+			width: 100%;
+
+			:deep(.button-vue) {
+				width: 100%;
+				justify-content: center;
+			}
+		}
+
+		&__crud-filter-chips {
+			justify-content: flex-start;
+		}
+
+		&__table-note--align-right {
+			text-align: left;
+		}
+	}
+
+	@media (min-width: 961px) {
+		&__dialog {
+			flex-direction: row;
+			align-items: flex-start;
+		}
+
+		&__main {
+			flex: 1;
+			min-width: 0;
+			overflow-y: auto;
+			max-height: calc(min(820px, 100vh - 7rem) - 2rem);
+		}
+
+		&__editor-aside {
+			display: flex;
+			flex-direction: column;
+			gap: 0.75rem;
+			position: sticky;
+			top: 0;
+			width: 380px;
+			flex-shrink: 0;
+			max-height: 90vh;
+			overflow-y: auto;
+			padding-left: 1.5rem;
+			border-left: 1px solid color-mix(in srgb, var(--color-border-maxcontrast) 50%, transparent);
+		}
+
+		&__editor-mobile-hint {
+			display: none;
+		}
+	}
+
+	&__editor-panel {
+		position: relative;
+		display: flex;
+		flex-direction: column;
+		gap: 0.75rem;
+	}
+
+	&__editor-panel-content {
+		display: flex;
+		flex-direction: column;
+		gap: 0.75rem;
+		position: relative;
+
+		&--saving {
+			opacity: 0.6;
+			pointer-events: none;
+		}
+	}
+
+	&__editor-header {
+		display: flex;
+		flex-direction: column;
+		gap: 0.4rem;
+
+		h3,
+		p {
+			margin: 0;
+		}
+
+		p:last-child {
+			margin-top: 0.35rem;
+			color: var(--color-text-maxcontrast);
+		}
+	}
+
+	&__eyebrow {
+		font-size: 0.78rem;
+		text-transform: uppercase;
+		letter-spacing: 0.04em;
+		color: var(--color-text-maxcontrast);
+	}
+
+	&__label {
+		font-size: 0.78rem;
+		text-transform: uppercase;
+		letter-spacing: 0.04em;
+		color: var(--color-text-maxcontrast);
+	}
+
+	// New compact summary line
+	&__summary-line {
+		display: flex;
+		align-items: center;
+		flex-wrap: wrap;
+		gap: 0.45rem;
+		padding: 0.15rem 0;
+		color: var(--color-main-text);
+
+		&--crud {
+			margin: 0.35rem 0 0.6rem;
+		}
+	}
+
+	&__summary-caption {
+		font-size: 0.86rem;
+		font-weight: 600;
+		color: var(--color-text-maxcontrast);
+	}
+
+	&__summary-value-compact {
+		font-size: 1rem;
+		font-weight: 700;
+		line-height: 1.2;
+	}
+
+	&__summary-source-inline {
+		font-size: 0.84rem;
+		color: var(--color-text-maxcontrast);
+	}
+
+	&__default-inline {
+		display: inline-flex;
+		align-items: center;
+		gap: 0.35rem;
+		flex-wrap: wrap;
+		margin: 0.05rem 0 0.55rem;
+		font-size: 0.9rem;
+		line-height: 1.3;
+	}
+
+	&__default-inline-label {
+		font-weight: 600;
+		color: var(--color-main-text);
+	}
+
+	&__default-inline-value {
+		font-weight: 700;
+		color: var(--color-main-text);
+	}
+
+	&__default-inline-source {
+		color: var(--color-text-maxcontrast);
+	}
+
+	&__default-inline-separator {
+		color: var(--color-text-maxcontrast);
+	}
+
+	&__default-inline-action {
+		margin-inline-start: 0.35rem;
+
+		:deep(.button-vue) {
+			min-height: auto;
+			padding: 0.05rem 0.35rem;
+			font-size: 0.84rem;
+			font-weight: 600;
+		}
+	}
+
+	&__summary-wrap {
+		:deep(.notecard) {
+			margin: 0;
+		}
+	}
+
+	&__summary-header {
+		margin-bottom: 1.5rem;
+	}
+
+	&__summary-top {
+		display: flex;
+		align-items: baseline;
+		gap: 0.8rem;
+		margin-bottom: 0.4rem;
+	}
+
+	&__summary-value {
+		margin: 0;
+		font-size: 1.8rem;
+		font-weight: 700;
+	}
+
+	&__summary-meta {
+		display: flex;
+		align-items: center;
+		gap: 0.5rem;
+		font-size: 0.88rem;
+		color: var(--color-text-maxcontrast);
+	}
+
+	&__summary-source {
+		margin: 0;
+	}
+
+	&__summary-counts {
+		margin: 0;
+	}
+
+	&__summary-divider {
+		opacity: 0.5;
+	}
+
+	&__learn-link {
+		background: none;
+		border: none;
+		color: var(--color-text-maxcontrast);
+		cursor: pointer;
+		font-size: 0.8rem;
+		font-weight: 500;
+		padding: 0;
+		text-decoration: underline;
+
+		&:hover {
+			opacity: 0.8;
+		}
+
+		&:focus {
+			outline: 2px solid var(--color-primary-element);
+			outline-offset: 2px;
+		}
+	}
+
+	&__summary-learn-link {
+		margin-left: auto;
+		white-space: nowrap;
+		:deep(.button-vue__text) {
+			font-size: 0.88rem;
+		}
+	}
+
+	// Collapsible inheritance help section
+	&__inheritance-help {
+		padding: 0.9rem;
+		border-radius: 12px;
+		border: 1px solid color-mix(in srgb, var(--color-primary-element) 18%, var(--color-border-maxcontrast));
+		background: color-mix(in srgb, var(--color-primary-element) 8%, var(--color-main-background));
+		margin-bottom: 0.5rem;
+
+		ul {
+			margin: 0;
+			padding-left: 1.2rem;
+			display: flex;
+			flex-direction: column;
+			gap: 0.3rem;
+			font-size: 0.86rem;
+			color: var(--color-text-maxcontrast);
+
+			li {
+				line-height: 1.4;
+			}
+		}
+	}
+
+	&__help-toggle {
+		background: none;
+		border: none;
+		color: var(--color-text-maxcontrast);
+		cursor: pointer;
+		font-size: 0.85rem;
+		font-weight: 400;
+		padding: 0;
+		text-decoration: underline;
+		transition: color 0.15s ease;
+
+		&:hover {
+			color: var(--color-main-text);
+		}
+
+		&:focus {
+			outline: 2px solid var(--color-primary-element);
+			outline-offset: 2px;
+		}
+	}
+
+	&__inheritance-note {
+		margin-top: 0.6rem;
+		padding: 0.6rem 0;
+		font-size: 0.85rem;
+		color: var(--color-text-maxcontrast);
+
+		ul {
+			margin: 0;
+			padding-left: 1.2rem;
+			display: flex;
+			flex-direction: column;
+			gap: 0.25rem;
+		}
+
+		li {
+			line-height: 1.4;
+		}
+	}
+
+	// Single-column content wrapper
+	&__content {
+		display: flex;
+		flex-direction: column;
+		gap: 1rem;
+	}
+
+	// Main sections (Default for this instance, Exceptions)
+	&__section {
+		display: flex;
+		flex-direction: column;
+		gap: 0.75rem;
+	}
+
+	&__section-title {
+		margin: 0;
+		font-size: 0.92rem;
+		font-weight: 600;
+		color: var(--color-main-text);
+	}
+
+	// Nested subsections (Groups, Users under Exceptions)
+	&__subsection {
+		display: flex;
+		flex-direction: column;
+		gap: 0.6rem;
+	}
+
+	&__subsection-title {
+		margin: 0;
+		margin-top: 0.5rem;
+		font-size: 0.84rem;
+		font-weight: 600;
+		color: var(--color-text-maxcontrast);
+		text-transform: uppercase;
+		letter-spacing: 0.02em;
+	}
+
+	// Default for instance section styling
+	&__default-value {
+		margin: 0;
+		font-size: 1.2rem;
+		font-weight: 700;
+		color: var(--color-main-text);
+		line-height: 1.3;
+	}
+
+	&__default-reason {
+		margin: 0;
+		font-size: 0.88rem;
+		color: var(--color-text-maxcontrast);
+		line-height: 1.5;
+	}
+
+	&__default-actions {
+		display: flex;
+		flex-wrap: wrap;
+		gap: 0.6rem;
+
+		:deep(.button-vue) {
+			max-width: 100%;
+		}
+	}
+
+	// Exception list styling
+	&__exception-list {
+		display: flex;
+		flex-direction: column;
+		gap: 0.65rem;
+	}
+
+	&__tabs {
+		display: flex;
+		flex-wrap: wrap;
+		gap: 0.5rem;
+	}
+
+	&__tab-link {
+		background: none;
+		border: none;
+		color: var(--color-text-maxcontrast);
+		cursor: pointer;
+		font-size: 0.9rem;
+		font-weight: 400;
+		padding: 0.4rem 0;
+		text-decoration: none;
+		border-bottom: 2px solid transparent;
+		transition: all 0.15s ease;
+
+		&:hover {
+			color: var(--color-main-text);
+			border-bottom-color: var(--color-border);
+		}
+
+		&--active {
+			color: var(--color-main-text);
+			font-weight: 600;
+			border-bottom-color: var(--color-primary-element);
+		}
+	}
+
+	&__table-section {
+		display: flex;
+		flex-direction: column;
+		gap: 0.75rem;
+	}
+
+	&__table-heading {
+		margin: 0;
+		font-size: 0.9rem;
+		font-weight: 600;
+		color: var(--color-main-text);
+	}
+
+	&__table-toolbar {
+		display: grid;
+		grid-template-columns: minmax(220px, 1fr) auto auto;
+		gap: 0.65rem;
+		align-items: center;
+	}
+
+	&__table-toolbar-action {
+		display: flex;
+		justify-content: flex-end;
+		align-items: center;
+	}
+
+	&__filter-inline {
+		display: flex;
+		align-items: center;
+		gap: 0.6rem;
+		font-size: 0.85rem;
+	}
+
+	&__filter-option {
+		display: flex;
+		align-items: center;
+		gap: 0.35rem;
+		cursor: pointer;
+		white-space: nowrap;
+
+		input[type='radio'] {
+			cursor: pointer;
+		}
+
+		span {
+			color: var(--color-main-text);
+		}
+	}
+
+	&__table-scroll {
+		overflow-x: auto;
+		border: none;
+		border-radius: 0;
+	}
+
+	&__table {
+		width: 100%;
+		border-collapse: collapse;
+		font-size: 0.87rem;
+
+		th,
+		td {
+			text-align: left;
+			padding: 0.48rem 0.72rem;
+			vertical-align: middle;
+		}
+
+		th {
+			font-size: 0.78rem;
+			font-weight: 600;
+			color: var(--color-text-maxcontrast);
+			border-bottom: 1px solid color-mix(in srgb, var(--color-border) 50%, transparent);
+			background: transparent;
+		}
+
+		tbody td {
+			border-bottom: 1px solid color-mix(in srgb, var(--color-border) 40%, transparent);
+		}
+
+		tr:last-child td {
+			border-bottom: none;
+		}
+
+		tbody tr:hover td {
+			background: color-mix(in srgb, var(--color-main-text) 1%, transparent);
+		}
+	}
+
+	&__table-priority-note {
+		display: inline-flex;
+		align-items: center;
+		gap: 0.4rem;
+		margin: 0 0 0.6rem;
+		padding: 0.32rem 0.55rem;
+		border-radius: 8px;
+		font-size: 0.84rem;
+		font-weight: 600;
+		color: var(--color-main-text);
+		border: 1px solid color-mix(in srgb, var(--color-primary-element) 22%, var(--color-border-maxcontrast));
+		background: color-mix(in srgb, var(--color-primary-element) 8%, var(--color-main-background));
+
+		:deep(svg) {
+			color: var(--color-primary-element);
+		}
+	}
+
+	&__table-actions {
+		white-space: nowrap;
+
+		:deep(.actions) {
+			justify-content: flex-start;
+		}
+
+		:deep(.actions__primary) {
+			opacity: 0.8;
+		}
+
+		:deep(.actions__primary:hover),
+		:deep(.actions__primary:focus-visible) {
+			opacity: 1;
+		}
+
+		:deep(.action-item) {
+			font-size: 0.84rem;
+		}
+	}
+
+	&__status {
+		white-space: nowrap;
+	}
+
+	&__status-label {
+		display: inline-flex;
+		align-items: center;
+		font-size: inherit;
+		line-height: 1.35;
+		color: var(--color-text-maxcontrast);
+	}
+
+	&__create-scope-hint {
+		margin: -0.35rem 0 0;
+		font-size: 0.84rem;
+		color: var(--color-text-maxcontrast);
+	}
+
+	&__table-empty {
+		text-align: center;
+		color: var(--color-text-maxcontrast);
+		font-style: italic;
+	}
+
+	&__table-note {
+		margin: 0;
+		font-size: 0.84rem;
+		color: var(--color-text-maxcontrast);
+
+		&--compact {
+			max-width: 26ch;
+		}
+
+		&--align-right {
+			text-align: right;
+		}
+	}
+
+	&__create-scope-dialog {
+		width: min(100%, 38rem);
+		margin: 0 auto;
+		display: flex;
+		flex-direction: column;
+		gap: 0.75rem;
+
+		p {
+			margin: 0;
+		}
+	}
+
+	&__editor-modal-body {
+		width: min(100%, 42rem);
+		margin: 0 auto;
+
+		&--wide {
+			width: min(100%, 64rem);
+		}
+	}
+
+	&__create-scope-grid {
+		display: grid;
+		grid-template-columns: 1fr;
+		gap: 0.68rem;
+	}
+
+	&__create-scope-option {
+		display: flex;
+		flex-direction: column;
+		align-items: flex-start;
+		gap: 0.2rem;
+		width: 100%;
+		padding: 0.7rem 0.8rem;
+		border-radius: 10px;
+		border: 1px solid color-mix(in srgb, var(--color-border-maxcontrast) 45%, transparent);
+		background: color-mix(in srgb, var(--color-main-background) 94%, var(--color-background-dark));
+		text-align: left;
+		cursor: pointer;
+		position: relative;
+		transition: border-color 0.12s ease, background-color 0.12s ease, box-shadow 0.12s ease, transform 0.12s ease;
+
+		&:hover {
+			border-color: color-mix(in srgb, var(--color-primary-element) 58%, var(--color-border-maxcontrast));
+			background: color-mix(in srgb, var(--color-primary-element) 9%, var(--color-main-background));
+			box-shadow: 0 2px 8px color-mix(in srgb, var(--color-primary-element) 12%, transparent);
+			transform: translateY(-1px);
+		}
+
+		&:focus:not(:focus-visible):not(:hover) {
+			outline: none;
+			border-color: color-mix(in srgb, var(--color-border-maxcontrast) 45%, transparent);
+			background: color-mix(in srgb, var(--color-main-background) 94%, var(--color-background-dark));
+			box-shadow: none;
+			transform: none;
+		}
+
+		&:focus-visible {
+			outline: 2px solid color-mix(in srgb, var(--color-primary-element) 70%, transparent);
+			outline-offset: 1px;
+		}
+
+		&--selected {
+			border-color: color-mix(in srgb, var(--color-primary-element) 58%, var(--color-border-maxcontrast));
+			box-shadow: 0 0 0 2px color-mix(in srgb, var(--color-primary-element) 12%, transparent), 0 2px 10px color-mix(in srgb, var(--color-primary-element) 12%, transparent);
+			background: color-mix(in srgb, var(--color-primary-element) 9%, var(--color-main-background));
+		}
+
+		&--disabled {
+			opacity: 0.55;
+			cursor: not-allowed;
+
+			&:hover {
+				box-shadow: none;
+				transform: none;
+			}
+		}
+	}
+
+	&__create-scope-option-icon {
+		position: absolute;
+		top: 0.55rem;
+		right: 0.55rem;
+		color: color-mix(in srgb, var(--color-primary-element) 75%, transparent);
+		opacity: 0;
+		transform: scale(0.9);
+		transition: opacity 0.12s ease, transform 0.12s ease;
+	}
+
+	&__create-scope-option--selected &__create-scope-option-icon {
+		opacity: 1;
+		transform: scale(1);
+	}
+
+	&__create-scope-option-title {
+		font-size: 0.92rem;
+		font-weight: 600;
+		color: var(--color-main-text);
+	}
+
+	&__create-scope-option-description {
+		font-size: 0.83rem;
+		color: var(--color-text-maxcontrast);
+	}
+
+	&__create-scope-notes {
+		margin: 0;
+		padding-inline-start: 1.1rem;
+		font-size: 0.84rem;
+		color: var(--color-text-maxcontrast);
+
+		li {
+			margin: 0;
+		}
+	}
+
+
+	&__table-empty-state {
+		display: flex;
+		flex-direction: column;
+		gap: 0.2rem;
+
+		p {
+			margin: 0;
+			font-size: 0.86rem;
+			color: var(--color-main-text);
+		}
+
+		p:last-child {
+			color: var(--color-text-maxcontrast);
+		}
+	}
+
+	&__row-status {
+		font-size: 0.86rem;
+		color: var(--color-text-maxcontrast);
+
+		&--inherit {
+			color: var(--color-main-text);
+		}
+	}
+
+	&__pagination {
+		display: flex;
+		align-items: center;
+		justify-content: flex-end;
+		gap: 0.65rem;
+		font-size: 0.84rem;
+		color: var(--color-text-maxcontrast);
+	}
+
+	// Empty state for subsections
+	&__empty-subsection {
+		margin: 0;
+		font-size: 0.88rem;
+		color: var(--color-text-maxcontrast);
+		font-style: italic;
+	}
+
+	// Inline blocker reason message
+	&__blocker-reason {
+		margin: 0.5rem 0 0;
+		padding: 0.6rem 0.75rem;
+		border-radius: 9px;
+		border: 1px solid color-mix(in srgb, var(--color-warning) 36%, transparent);
+		background: color-mix(in srgb, var(--color-warning) 14%, var(--color-main-background));
+		font-size: 0.85rem;
+		line-height: 1.4;
+		color: var(--color-text-maxcontrast);
+	}
+
+	// Collapsible precedence explanation
+	&__precedence-explanation {
+		margin-top: 0.65rem;
+		padding: 0.9rem;
+		border-radius: 12px;
+		border: 1px solid color-mix(in srgb, var(--color-primary-element) 22%, var(--color-border-maxcontrast));
+		background: color-mix(in srgb, var(--color-main-background) 72%, white);
+	}
+
+	&__precedence-header {
+		display: flex;
+		justify-content: space-between;
+		align-items: center;
+		margin-bottom: 0.6rem;
+
+		h3 {
+			margin: 0;
+			font-size: 0.92rem;
+		}
+
+		:deep(.button-vue) {
+			flex-shrink: 0;
+		}
+	}
+
+	&__precedence-list {
+		margin: 0;
+		padding-left: 1.2rem;
+		display: flex;
+		flex-direction: column;
+		gap: 0.3rem;
+		font-size: 0.86rem;
+		color: var(--color-text-maxcontrast);
+
+		li {
+			line-height: 1.4;
+		}
+	}
+
+	// Base rule section
+	&__base-rule-info {
+		padding: 0.8rem;
+		border-radius: 10px;
+		background: color-mix(in srgb, var(--color-background-dark) 8%, var(--color-main-background));
+		margin-bottom: 0.6rem;
+	}
+
+	&__base-rule-current {
+		p {
+			margin: 0;
+		}
+
+		p:not(:last-child) {
+			margin-bottom: 0.2rem;
+		}
+	}
+
+	&__base-rule-label {
+		font-size: 0.78rem;
+		color: var(--color-text-maxcontrast);
+		text-transform: uppercase;
+		letter-spacing: 0.02em;
+	}
+
+	&__base-rule-value {
+		font-size: 0.95rem;
+		font-weight: 600;
+		color: var(--color-main-text);
+	}
+
+	&__base-rule-source {
+		font-size: 0.8rem;
+		color: var(--color-text-maxcontrast);
+	}
+
+	&__base-rule-no-global {
+		display: flex;
+		flex-direction: column;
+		gap: 0.6rem;
+
+		p {
+			margin: 0;
+			font-size: 0.88rem;
+		}
+
+		:deep(.button-vue) {
+			max-width: 100%;
+		}
+	}
+
+	&__base-rule-fallback {
+		padding: 0.55rem;
+		border-radius: 8px;
+		background: color-mix(in srgb, var(--color-primary-element) 6%, var(--color-main-background));
+		border-left: 2px solid color-mix(in srgb, var(--color-primary-element) 24%, transparent);
+	}
+
+	&__base-rule-label--small {
+		font-size: 0.76rem;
+		color: var(--color-text-maxcontrast);
+		margin: 0;
+		text-transform: uppercase;
+		letter-spacing: 0.02em;
+	}
+
+	&__base-rule-value--small {
+		font-size: 0.88rem;
+		font-weight: 600;
+		color: var(--color-main-text);
+		margin: 0.15rem 0 0;
+	}
+
+	&__table-like {
+		display: flex;
+		flex-direction: column;
+		gap: 0.65rem;
+	}
+
+	&__section-blocker {
+		padding: 0.6rem 0.75rem;
+		border-radius: 9px;
+		border: 1px solid color-mix(in srgb, var(--color-warning) 36%, transparent);
+		background: color-mix(in srgb, var(--color-warning) 14%, var(--color-main-background));
+		font-size: 0.85rem;
+		line-height: 1.4;
+
+		p {
+			margin: 0;
+		}
+	}
+
+	&__stack {
+		display: flex;
+		flex-direction: column;
+		gap: 0.75rem;
+	}
+
+	&__field {
+		display: flex;
+		flex-direction: column;
+		gap: 0.45rem;
+	}
+
+	&__inline-note-actions {
+		display: flex;
+		flex-direction: column;
+		align-items: flex-start;
+		justify-content: flex-start;
+		gap: 0.75rem;
+
+		p {
+			margin: 0;
+		}
+
+		:deep(.button-vue) {
+			max-width: 100%;
+		}
+	}
+
+	&__setting-surface {
+		display: flex;
+		flex-direction: column;
+		gap: 0.75rem;
+		padding: 0.8rem;
+		border-radius: 12px;
+		border: 1px solid color-mix(in srgb, var(--color-primary-element) 45%, var(--color-border-maxcontrast));
+		background: color-mix(in srgb, var(--color-primary-element) 5%, var(--color-main-background));
+		box-shadow: inset 0 0 0 1px color-mix(in srgb, var(--color-primary-element) 8%, transparent);
+	}
+
+	&__editor-actions {
+		display: flex;
+		flex-direction: row;
+		justify-content: flex-end;
+		align-items: center;
+		gap: 0.75rem;
+		flex-wrap: wrap;
+
+		:deep(.button-vue) {
+			flex-shrink: 0;
+		}
+	}
+
+	&__editor-actions--sticky-mobile {
+		position: sticky;
+		bottom: 0;
+		padding-top: 0.55rem;
+	}
+
+	&__save-feedback {
+		margin: 0;
+		font-size: 0.84rem;
+		font-weight: 600;
+		color: color-mix(in srgb, var(--color-primary-element-text) 78%, var(--color-success));
+	}
+
+	&__removal-feedback {
+		margin: 0 0 0.2rem;
+
+		:deep(.notecard) {
+			margin: 0;
+		}
+	}
+
+	&__saving-overlay {
+		position: absolute;
+		inset: 0;
+		display: flex;
+		flex-direction: column;
+		align-items: center;
+		justify-content: center;
+		gap: 0.55rem;
+		padding: 1rem;
+		background: color-mix(in srgb, var(--color-main-background) 78%, transparent);
+		backdrop-filter: blur(1px);
+		z-index: 2;
+
+		p {
+			margin: 0;
+			font-weight: 600;
+			color: var(--color-text-maxcontrast);
+		}
+	}
+
+	&__saving-spinner {
+		width: 1.4rem;
+		height: 1.4rem;
+		border-radius: 999px;
+		border: 2px solid color-mix(in srgb, var(--color-primary-element) 22%, var(--color-border-maxcontrast));
+		border-top-color: var(--color-primary-element);
+		animation: policy-workbench-spin 0.8s linear infinite;
+	}
+
+	:deep(mark) {
+		background: color-mix(in srgb, var(--color-warning) 35%, transparent);
+		color: inherit;
+		padding: 0 0.1rem;
+		border-radius: 3px;
+	}
+}
+
+@keyframes policy-workbench-spin {
+	to {
+		transform: rotate(360deg);
+	}
+}
+
+@media (max-width: 960px) {
+	.policy-workbench {
+		&__catalog-toolbar {
+			display: flex;
+			flex-direction: column;
+			align-items: stretch;
+		}
+
+		&__catalog-view-switch {
+			justify-content: flex-start;
+
+			:deep(.button-vue) {
+				justify-content: center;
+			}
+		}
+
+		&__catalog-meta {
+			margin-top: -0.15rem;
+		}
+
+		&__catalog-foot {
+			flex-direction: column;
+			align-items: flex-start;
+
+			:deep(.button-vue) {
+				width: 100%;
+				justify-content: center;
+			}
+		}
+
+		&__empty-state-actions {
+			width: 100%;
+
+			:deep(.button-vue) {
+				width: 100%;
+				justify-content: center;
+			}
+		}
+
+		&__workspace,
+		&__dialog-header,
+		&__setting-header {
+			display: flex;
+			flex-direction: column;
+		}
+
+		&__summary-line {
+			gap: 0.25rem;
+		}
+
+		&__table-toolbar {
+			grid-template-columns: 1fr;
+		}
+
+		&__table-filter {
+			:deep(.button-vue) {
+				min-width: 0;
+				width: 100%;
+			}
+		}
+
+		&__pagination {
+			justify-content: flex-start;
+		}
+
+		&__summary-learn-link {
+			margin-left: 0;
+			margin-top: 0.35rem;
+		}
+
+		&__precedence-explanation {
+			margin-top: 0.6rem;
+		}
+
+		&__removal-feedback {
+			margin: 0 0 0.2rem;
+		}
+
+		&__settings-row {
+			grid-template-columns: 1fr;
+			align-items: stretch;
+
+			:deep(.button-vue) {
+				width: 100%;
+				justify-content: center;
+			}
+		}
+
+		&__dialog {
+			width: 100%;
+			min-height: auto;
+			gap: 0;
+		}
+
+		&__tier {
+			padding: 1rem 0;
+		}
+
+		&__tier-head {
+			flex-direction: column;
+			align-items: stretch;
+			gap: 0.65rem;
+		}
+
+		&__table-toolbar-row {
+			flex-direction: column;
+			align-items: stretch;
+		}
+
+		&__crud-create {
+			align-items: stretch;
+
+			:deep(.button-vue) {
+				width: 100%;
+				justify-content: center;
+			}
+		}
+
+		&__editor-panel,
+		&__editor-mobile-hint {
+			position: static;
+		}
+
+		&__dialog-actions {
+			:deep(.button-vue) {
+				width: 100%;
+				justify-content: center;
+			}
+		}
+
+		&__inline-note-actions {
+			align-items: stretch;
+			justify-content: flex-start;
+
+			:deep(.button-vue) {
+				width: 100%;
+				justify-content: center;
+			}
+		}
+
+		&__setting-header {
+			:deep(.button-vue) {
+				width: 100%;
+				justify-content: center;
+			}
+		}
+
+		&__group,
+		&__editor-panel,
+		&__editor-mobile-hint,
+		&__setting-tile {
+			padding: 1rem;
+		}
+
+		&__base-rule-info {
+			margin-bottom: 0.5rem;
+		}
+	}
+}
+
+@media (min-width: 961px) and (max-width: 1280px) {
+	.policy-workbench {
+		&__workspace {
+			grid-template-columns: minmax(280px, 0.9fr) minmax(460px, 1.1fr);
+		}
+	}
+}
+
+@media (max-width: 640px) {
+	.policy-workbench {
+		&__settings-grid {
+			gap: 0.75rem;
+		}
+
+		&__dialog {
+			gap: 0.6rem;
+		}
+
+		&__setting-stats {
+			gap: 0.5rem;
+
+			li {
+				word-break: break-word;
+			}
+		}
+
+		&__workspace,
+		&__rules-column,
+		&__editor-column,
+		&__stack {
+			gap: 0.75rem;
+		}
+
+		&__dialog-header,
+		&__group-header,
+		&__editor-header {
+			h2,
+			h3,
+			p {
+				word-break: break-word;
+			}
+		}
+
+		&__settings-row-stats {
+			grid-template-columns: 1fr;
+		}
+
+		&__summary-line {
+			font-size: 0.82rem;
+			gap: 0.3rem;
+		}
+
+		&__precedence-list {
+			font-size: 0.8rem;
+		}
+	}
+}
+</style>
diff --git a/src/views/Settings/PolicyWorkbench/SettingsPolicyWorkbench.vue b/src/views/Settings/PolicyWorkbench/SettingsPolicyWorkbench.vue
new file mode 100644
index 0000000000..e7e4ad3b05
--- /dev/null
+++ b/src/views/Settings/PolicyWorkbench/SettingsPolicyWorkbench.vue
@@ -0,0 +1,1517 @@
+<!--
+  - SPDX-FileCopyrightText: 2026 LibreCode coop and LibreCode contributors
+  - SPDX-License-Identifier: AGPL-3.0-or-later
+-->
+
+<template>
+	<NcSettingsSection
+		:name="t('libresign', 'Policy workbench')"
+		:description="t('libresign', 'POC for managing global, group and user rules without duplicating each setting UI.')">
+		<NcNoteCard type="warning">
+			{{ t('libresign', 'This POC keeps state only in the current browser session. It is meant to validate UX, composition and reuse before wiring the real persistence layer.') }}
+		</NcNoteCard>
+
+		<div class="policy-workbench__catalog-toolbar">
+			<div class="policy-workbench__catalog-search">
+				<NcTextField
+					:model-value="settingsFilter"
+					:label="t('libresign', 'Find setting')"
+					:placeholder="t('libresign', 'Search by name, summary, description or context')"
+					@keydown.esc.prevent="clearSettingsFilter"
+					@update:modelValue="onSettingsFilterChange" />
+				<div class="policy-workbench__catalog-foot">
+					<p class="policy-workbench__catalog-meta" aria-live="polite">
+						{{ t('libresign', '{shown} of {total} settings visible', {
+							shown: String(filteredSettingSummaries.length),
+							total: String(state.visibleSettingSummaries.length),
+						}) }}
+					</p>
+					<NcButton
+						variant="tertiary"
+						class="policy-workbench__clear-filter-button"
+						:class="{ 'policy-workbench__clear-filter-button--hidden': !hasActiveFilter }"
+						:aria-label="t('libresign', 'Clear settings filter')"
+						:disabled="!hasActiveFilter"
+						:tabindex="hasActiveFilter ? undefined : -1"
+						@click="clearSettingsFilter">
+						{{ t('libresign', 'Clear filter') }}
+					</NcButton>
+				</div>
+			</div>
+
+			<div class="policy-workbench__catalog-view-switch" role="group" :aria-label="t('libresign', 'Choose settings view mode')">
+				<NcButton
+					:aria-label="catalogViewButtonLabel"
+					:title="catalogViewButtonLabel"
+					:disabled="isSmallViewport"
+					class="policy-workbench__catalog-view-button"
+					@click="toggleCatalogLayout">
+					<template #icon>
+						<NcIconSvgWrapper v-if="effectiveCatalogLayout === 'cards'" :path="mdiFormatListBulletedSquare" />
+						<NcIconSvgWrapper v-else :path="mdiViewGridOutline" />
+					</template>
+				</NcButton>
+			</div>
+		</div>
+
+		<div v-if="effectiveCatalogLayout === 'cards'" class="policy-workbench__settings-grid">
+			<article
+				v-for="summary in filteredSettingSummaries"
+				:key="summary.key"
+				class="policy-workbench__setting-tile"
+				tabindex="0"
+				role="button"
+				@pointerdown="trackPress('cards', summary.key, $event)"
+				@mouseup="markSelectionGesture('cards', summary.key)"
+				@click="openSettingFromPointer('cards', summary.key, $event)"
+				@keydown.enter.prevent="state.openSetting(summary.key)"
+				@keydown.space.prevent="state.openSetting(summary.key)">
+				<div class="policy-workbench__setting-header">
+					<div>
+						<h3 class="policy-workbench__setting-title">
+							<span v-html="highlightText(summary.title)"></span>
+							<span v-if="summary.context" class="policy-workbench__setting-context">(<span v-html="highlightText(summary.context)"></span>)</span>
+						</h3>
+						<p v-html="highlightText(summary.description)"></p>
+					</div>
+					<NcButton variant="secondary" class="policy-workbench__manage-button" :aria-label="t('libresign', 'Manage this setting')" @click.stop="state.openSetting(summary.key)">
+						{{ t('libresign', 'Manage') }}
+					</NcButton>
+				</div>
+
+				<p class="policy-workbench__origin-badge">
+					{{ resolveSettingOrigin(summary.groupCount, summary.userCount) }}
+				</p>
+
+				<ul class="policy-workbench__setting-stats">
+					<li>
+						<strong>{{ t('libresign', 'Default') }}:</strong>
+						<span :title="summary.defaultSummary" v-html="highlightText(summary.defaultSummary)"></span>
+					</li>
+					<li>
+						<strong>{{ t('libresign', 'Group rules') }}:</strong>
+						{{ summary.groupCount }}
+					</li>
+					<li>
+						<strong>{{ t('libresign', 'User rules') }}:</strong>
+						{{ summary.userCount }}
+					</li>
+				</ul>
+			</article>
+		</div>
+
+		<div v-else class="policy-workbench__settings-list" role="list">
+			<article
+				v-for="summary in filteredSettingSummaries"
+				:key="summary.key"
+				class="policy-workbench__settings-row"
+				role="button"
+				tabindex="0"
+				@pointerdown="trackPress('list', summary.key, $event)"
+				@mouseup="markSelectionGesture('list', summary.key)"
+				@click="openSettingFromPointer('list', summary.key, $event)"
+				@keydown.enter.prevent="state.openSetting(summary.key)"
+				@keydown.space.prevent="state.openSetting(summary.key)">
+				<div class="policy-workbench__settings-row-main">
+					<h3 class="policy-workbench__setting-title">
+						<span v-html="highlightText(summary.title)"></span>
+						<span v-if="summary.context" class="policy-workbench__setting-context">(<span v-html="highlightText(summary.context)"></span>)</span>
+					</h3>
+					<p v-html="highlightText(summary.description)"></p>
+					<p class="policy-workbench__origin-badge policy-workbench__origin-badge--inline">
+						{{ resolveSettingOrigin(summary.groupCount, summary.userCount) }}
+					</p>
+				</div>
+
+				<div class="policy-workbench__settings-row-stats">
+					<span class="policy-workbench__settings-row-stat policy-workbench__settings-row-stat--default" :title="summary.defaultSummary">
+						<strong>{{ t('libresign', 'Default') }}:</strong>
+						<span v-html="highlightText(summary.defaultSummary)"></span>
+					</span>
+					<span class="policy-workbench__settings-row-stat"><strong>{{ t('libresign', 'Group') }}:</strong> {{ summary.groupCount }}</span>
+					<span class="policy-workbench__settings-row-stat"><strong>{{ t('libresign', 'User') }}:</strong> {{ summary.userCount }}</span>
+				</div>
+
+				<NcButton variant="secondary" class="policy-workbench__manage-button" :aria-label="t('libresign', 'Manage this setting')" @click.stop="state.openSetting(summary.key)">
+					{{ t('libresign', 'Manage') }}
+				</NcButton>
+			</article>
+		</div>
+
+		<NcNoteCard v-if="filteredSettingSummaries.length === 0" type="info">
+			<div class="policy-workbench__empty-state">
+				<p>{{ t('libresign', 'No settings matched this search. Try fewer words or clear the filter.') }}</p>
+				<div class="policy-workbench__empty-state-actions">
+					<NcButton variant="secondary" :aria-label="t('libresign', 'Clear settings filter')" :disabled="!hasActiveFilter" @click="clearSettingsFilter">
+						{{ t('libresign', 'Clear filter') }}
+					</NcButton>
+					<NcButton variant="tertiary" :aria-label="t('libresign', 'Show all settings')" @click="clearSettingsFilter">
+						{{ t('libresign', 'Show all settings') }}
+					</NcButton>
+				</div>
+			</div>
+		</NcNoteCard>
+
+		<NcDialog
+			v-if="state.activeDefinition"
+			:name="state.activeDefinition.title"
+			size="full"
+			:can-close="true"
+			@closing="state.closeSetting()">
+			<div class="policy-workbench__dialog">
+				<header class="policy-workbench__dialog-header">
+					<div>
+						<p class="policy-workbench__eyebrow">
+							{{ state.viewMode === 'system-admin' ? t('libresign', 'Global admin workspace') : t('libresign', 'Group admin workspace') }}
+						</p>
+						<h2>{{ state.activeDefinition.title }}</h2>
+						<p>{{ state.activeDefinition.description }}</p>
+					</div>
+					<div class="policy-workbench__dialog-actions">
+						<NcButton
+							v-if="state.viewMode === 'system-admin'"
+							variant="secondary"
+							:aria-label="t('libresign', 'Edit default rule')"
+							@click="state.startEditor({ scope: 'system', ruleId: state.inheritedSystemRule?.id })">
+							{{ state.inheritedSystemRule ? t('libresign', 'Edit default rule') : t('libresign', 'Create default rule') }}
+						</NcButton>
+						<NcButton
+							v-if="state.viewMode === 'system-admin' && state.inheritedSystemRule"
+							variant="error"
+							:aria-label="t('libresign', 'Reset default rule')"
+							@click="promptRuleRemoval(state.inheritedSystemRule.id, 'system', t('libresign', 'Default configuration'))">
+							{{ t('libresign', 'Reset default rule') }}
+						</NcButton>
+						<NcButton
+							v-else
+							variant="secondary"
+							:aria-label="t('libresign', 'Edit current group rule')"
+							@click="state.startEditor({ scope: 'group', ruleId: state.currentGroupRule?.id })">
+							{{ state.currentGroupRule ? t('libresign', 'Edit current group rule') : t('libresign', 'Create current group rule') }}
+						</NcButton>
+						<NcButton
+							v-if="state.viewMode === 'system-admin'"
+							variant="secondary"
+							:aria-label="t('libresign', 'Add group rule')"
+							@click="state.startEditor({ scope: 'group' })">
+							{{ t('libresign', 'Add group rule') }}
+						</NcButton>
+						<NcButton variant="primary" :aria-label="t('libresign', 'Add user rule')" @click="state.startEditor({ scope: 'user' })">
+							{{ t('libresign', 'Add user rule') }}
+						</NcButton>
+					</div>
+				</header>
+
+				<div class="policy-workbench__workspace">
+					<div class="policy-workbench__rules-column">
+						<section class="policy-workbench__group">
+							<div class="policy-workbench__group-header">
+								<h3>{{ state.viewMode === 'system-admin' ? t('libresign', 'Instance default') : t('libresign', 'Inherited instance default') }}</h3>
+								<p>
+									{{ state.viewMode === 'system-admin'
+										? t('libresign', 'This rule is the baseline for the whole instance.')
+										: t('libresign', 'Group admins can see the inherited default but do not edit it from this view.') }}
+								</p>
+							</div>
+
+							<PolicyRuleCard
+								v-if="state.inheritedSystemRule"
+								eyebrow="System"
+								:title="t('libresign', 'Default configuration')"
+								:summary="summarizeRuleValue(state.inheritedSystemRule.value)"
+								:description="t('libresign', 'Used whenever no group or user rule matches.')"
+								:badges="systemRuleBadges"
+								:highlighted="state.highlightedRuleId === state.inheritedSystemRule.id"
+								:show-edit-action="state.viewMode === 'system-admin'"
+								:show-remove-action="state.viewMode === 'system-admin'"
+								:edit-label="t('libresign', 'Edit default')"
+								:remove-label="t('libresign', 'Reset default')"
+								:edit-text="t('libresign', 'Edit')"
+								:remove-text="t('libresign', 'Reset')"
+								@edit="state.viewMode === 'system-admin' && state.startEditor({ scope: 'system', ruleId: state.inheritedSystemRule.id })"
+								@remove="state.viewMode === 'system-admin' && promptRuleRemoval(state.inheritedSystemRule.id, 'system', t('libresign', 'Default configuration'))" />
+
+							<NcNoteCard v-else type="info">
+								{{ t('libresign', 'No custom default exists yet for this setting.') }}
+							</NcNoteCard>
+						</section>
+
+						<section class="policy-workbench__group">
+							<div class="policy-workbench__group-header">
+								<h3>{{ state.viewMode === 'system-admin' ? t('libresign', 'Group rules') : t('libresign', 'Current group rule') }}</h3>
+								<p>
+									{{ state.viewMode === 'system-admin'
+										? t('libresign', 'These rules override the default for specific groups.')
+										: t('libresign', 'This is the rule for the current group, which can still create user-level exceptions below.') }}
+								</p>
+							</div>
+
+							<div v-if="state.visibleGroupRules.length > 0" class="policy-workbench__stack">
+								<PolicyRuleCard
+									v-for="rule in state.visibleGroupRules"
+									:key="rule.id"
+									eyebrow="Group"
+									:title="state.resolveTargetLabel('group', rule.targetId)"
+									:summary="summarizeRuleValue(rule.value)"
+									:description="t('libresign', 'Overrides the inherited rule for this group.')"
+									:badges="groupRuleBadges(rule.allowChildOverride)"
+									:highlighted="state.highlightedRuleId === rule.id"
+									:edit-label="t('libresign', 'Edit group rule')"
+									:remove-label="t('libresign', 'Delete group rule')"
+									:edit-text="t('libresign', 'Edit')"
+									:remove-text="t('libresign', 'Delete')"
+									@edit="state.startEditor({ scope: 'group', ruleId: rule.id })"
+									@remove="promptRuleRemoval(rule.id, 'group', state.resolveTargetLabel('group', rule.targetId))" />
+							</div>
+
+							<NcNoteCard v-else type="info">
+								{{ state.viewMode === 'system-admin'
+									? t('libresign', 'No group rules exist yet for this setting.')
+									: t('libresign', 'The current group still inherits the instance default.') }}
+							</NcNoteCard>
+						</section>
+
+						<section class="policy-workbench__group">
+							<div class="policy-workbench__group-header">
+								<h3>{{ t('libresign', 'User rules') }}</h3>
+								<p>
+									{{ state.viewMode === 'system-admin'
+										? t('libresign', 'Use these only when an individual needs a different behavior from the group or instance default.')
+										: t('libresign', 'Group admins can only create rules for users inside their own group.') }}
+								</p>
+							</div>
+
+							<div v-if="state.visibleUserRules.length > 0" class="policy-workbench__stack">
+								<PolicyRuleCard
+									v-for="rule in state.visibleUserRules"
+									:key="rule.id"
+									eyebrow="User"
+									:title="state.resolveTargetLabel('user', rule.targetId)"
+									:summary="summarizeRuleValue(rule.value)"
+									:description="t('libresign', 'Applies only to this user.')"
+									:badges="[t('libresign', 'Final rule')]"
+									:highlighted="state.highlightedRuleId === rule.id"
+									:edit-label="t('libresign', 'Edit user rule')"
+									:remove-label="t('libresign', 'Delete user rule')"
+									:edit-text="t('libresign', 'Edit')"
+									:remove-text="t('libresign', 'Delete')"
+									@edit="state.startEditor({ scope: 'user', ruleId: rule.id })"
+									@remove="promptRuleRemoval(rule.id, 'user', state.resolveTargetLabel('user', rule.targetId))" />
+							</div>
+
+							<NcNoteCard v-else type="info">
+								{{ t('libresign', 'No user rules exist yet for this setting.') }}
+							</NcNoteCard>
+						</section>
+					</div>
+
+					<div class="policy-workbench__editor-column">
+						<section v-if="state.editorDraft && !shouldUseEditorModal" class="policy-workbench__editor-panel">
+							<div class="policy-workbench__editor-panel-content" :class="{ 'policy-workbench__editor-panel-content--saving': saveStatus === 'saving' }">
+								<div class="policy-workbench__editor-header">
+									<p class="policy-workbench__eyebrow">
+										{{ state.editorMode === 'edit' ? t('libresign', 'Edit rule') : t('libresign', 'Create rule') }}
+									</p>
+									<h3>{{ editorTitle }}</h3>
+									<p>{{ editorHelp }}</p>
+								</div>
+
+								<div v-if="state.editorDraft.scope !== 'system'" class="policy-workbench__field">
+									<label class="policy-workbench__label">
+										{{ state.editorDraft.scope === 'group' ? t('libresign', 'Target group') : t('libresign', 'Target user') }}
+									</label>
+									<NcSelect
+										:model-value="selectedTargetOption"
+										label="label"
+										:options="state.availableTargets"
+										:clearable="false"
+										:disabled="(state.editorDraft.scope === 'group' && state.viewMode === 'group-admin') || saveStatus === 'saving'"
+										@update:modelValue="onTargetChange" />
+								</div>
+
+								<div v-if="activeEditor" class="policy-workbench__setting-surface">
+									<component
+										:is="activeEditor"
+										:model-value="state.editorDraft.value"
+										@update:modelValue="state.updateDraftValue" />
+								</div>
+
+								<NcCheckboxRadioSwitch
+									v-if="state.editorDraft.scope !== 'user'"
+									type="switch"
+									:model-value="state.editorDraft.allowChildOverride"
+									:disabled="saveStatus === 'saving'"
+									@update:modelValue="state.updateDraftAllowOverride">
+									<div class="policy-workbench__switch-copy">
+										<span>{{ t('libresign', 'Require this signing order') }}</span>
+										<p>
+											{{ state.editorDraft.allowChildOverride ? t('libresign', 'All users must follow this signing order.') : t('libresign', 'Users can choose their preferred signing order.') }}
+										</p>
+									</div>
+								</NcCheckboxRadioSwitch>
+
+								<NcNoteCard v-if="state.duplicateMessage" type="error">
+									{{ state.duplicateMessage }}
+								</NcNoteCard>
+
+								<div class="policy-workbench__editor-actions">
+									<NcButton variant="primary" :aria-label="state.editorMode === 'edit' ? t('libresign', 'Save rule changes') : t('libresign', 'Create rule')" :disabled="!state.canSaveDraft || saveStatus === 'saving'" @click="handleSaveDraft()">
+										{{ state.editorMode === 'edit' ? t('libresign', 'Save changes') : t('libresign', 'Create rule') }}
+									</NcButton>
+									<NcButton variant="secondary" :aria-label="t('libresign', 'Cancel editing')" :disabled="saveStatus === 'saving'" @click="state.cancelEditor()">
+										{{ t('libresign', 'Cancel') }}
+									</NcButton>
+								</div>
+								<p v-if="saveStatus !== 'idle'" class="policy-workbench__save-feedback" aria-live="polite">
+									{{ saveStatus === 'saving' ? t('libresign', 'Saving...') : t('libresign', 'Saved') }}
+								</p>
+							</div>
+
+							<div v-if="saveStatus === 'saving'" class="policy-workbench__saving-overlay" aria-live="polite" aria-busy="true">
+								<div class="policy-workbench__saving-spinner" aria-hidden="true"></div>
+								<p>{{ t('libresign', 'Saving...') }}</p>
+							</div>
+						</section>
+
+						<section v-else-if="state.editorDraft && shouldUseEditorModal" class="policy-workbench__editor-mobile-hint">
+							<p class="policy-workbench__eyebrow">{{ t('libresign', 'Editing surface') }}</p>
+							<h3>{{ t('libresign', 'Editor opened in modal') }}</h3>
+							<p>
+								{{ t('libresign', 'On small screens, editing opens in a focused modal to avoid a cramped form and preserve context.') }}
+							</p>
+							<NcButton
+								variant="secondary"
+								:aria-label="t('libresign', 'Cancel editing')"
+								@click="state.cancelEditor()">
+								{{ t('libresign', 'Cancel editing') }}
+							</NcButton>
+						</section>
+
+						<section v-else class="policy-workbench__editor-empty">
+							<p class="policy-workbench__eyebrow">{{ t('libresign', 'Editing surface') }}</p>
+							<h3>{{ t('libresign', 'Choose an action to start editing') }}</h3>
+							<p>
+								{{ t('libresign', 'Use the buttons above to create a default rule, add a rule for a group or user, or edit one of the cards from the left column.') }}
+							</p>
+						</section>
+					</div>
+				</div>
+			</div>
+		</NcDialog>
+
+		<NcDialog
+			v-if="state.editorDraft && shouldUseEditorModal"
+			:name="editorTitle || t('libresign', 'Rule editor')"
+			size="full"
+			:can-close="true"
+			@closing="state.cancelEditor()">
+			<div class="policy-workbench__editor-modal-body">
+				<section class="policy-workbench__editor-panel">
+					<div class="policy-workbench__editor-panel-content" :class="{ 'policy-workbench__editor-panel-content--saving': saveStatus === 'saving' }">
+						<div class="policy-workbench__editor-header">
+							<p class="policy-workbench__eyebrow">
+								{{ state.editorMode === 'edit' ? t('libresign', 'Edit rule') : t('libresign', 'Create rule') }}
+							</p>
+							<h3>{{ editorTitle }}</h3>
+							<p>{{ editorHelp }}</p>
+						</div>
+
+						<div v-if="state.editorDraft.scope !== 'system'" class="policy-workbench__field">
+							<label class="policy-workbench__label">
+								{{ state.editorDraft.scope === 'group' ? t('libresign', 'Target group') : t('libresign', 'Target user') }}
+							</label>
+							<NcSelect
+								:model-value="selectedTargetOption"
+								label="label"
+								:options="state.availableTargets"
+								:clearable="false"
+								:disabled="(state.editorDraft.scope === 'group' && state.viewMode === 'group-admin') || saveStatus === 'saving'"
+								@update:modelValue="onTargetChange" />
+						</div>
+
+						<div v-if="activeEditor" class="policy-workbench__setting-surface">
+							<component
+								:is="activeEditor"
+								:model-value="state.editorDraft.value"
+								@update:modelValue="state.updateDraftValue" />
+						</div>
+
+						<NcCheckboxRadioSwitch
+							v-if="state.editorDraft.scope !== 'user'"
+							type="switch"
+							:model-value="state.editorDraft.allowChildOverride"
+							:disabled="saveStatus === 'saving'"
+							@update:modelValue="state.updateDraftAllowOverride">
+							<div class="policy-workbench__switch-copy">
+								<span>{{ t('libresign', 'Require this signing order') }}</span>
+								<p>
+									{{ state.editorDraft.allowChildOverride ? t('libresign', 'All users must follow this signing order.') : t('libresign', 'Users can choose their preferred signing order.') }}
+								</p>
+							</div>
+						</NcCheckboxRadioSwitch>
+
+						<NcNoteCard v-if="state.duplicateMessage" type="error">
+							{{ state.duplicateMessage }}
+						</NcNoteCard>
+
+						<div class="policy-workbench__editor-actions policy-workbench__editor-actions--sticky-mobile">
+							<NcButton variant="primary" :aria-label="state.editorMode === 'edit' ? t('libresign', 'Save rule changes') : t('libresign', 'Create rule')" :disabled="!state.canSaveDraft || saveStatus === 'saving'" @click="handleSaveDraft()">
+								{{ state.editorMode === 'edit' ? t('libresign', 'Save changes') : t('libresign', 'Create rule') }}
+							</NcButton>
+							<NcButton variant="secondary" :aria-label="t('libresign', 'Cancel editing')" :disabled="saveStatus === 'saving'" @click="state.cancelEditor()">
+								{{ t('libresign', 'Cancel') }}
+							</NcButton>
+						</div>
+						<p v-if="saveStatus !== 'idle'" class="policy-workbench__save-feedback" aria-live="polite">
+							{{ saveStatus === 'saving' ? t('libresign', 'Saving...') : t('libresign', 'Saved') }}
+						</p>
+					</div>
+
+					<div v-if="saveStatus === 'saving'" class="policy-workbench__saving-overlay" aria-live="polite" aria-busy="true">
+						<div class="policy-workbench__saving-spinner" aria-hidden="true"></div>
+						<p>{{ t('libresign', 'Saving...') }}</p>
+					</div>
+				</section>
+			</div>
+		</NcDialog>
+
+		<NcDialog
+			v-if="pendingRemoval"
+			:name="t('libresign', 'Confirm rule removal')"
+			:can-close="true"
+			@closing="cancelRuleRemoval">
+			<div class="policy-workbench__confirm-dialog">
+				<p>{{ t('libresign', 'You are about to remove this rule:') }}</p>
+				<p class="policy-workbench__confirm-target">{{ pendingRemoval.targetLabel }}</p>
+				<p class="policy-workbench__confirm-help">{{ pendingRemoval.help }}</p>
+				<div class="policy-workbench__confirm-actions">
+					<NcButton variant="secondary" :aria-label="t('libresign', 'Cancel removal')" @click="cancelRuleRemoval">
+						{{ t('libresign', 'Cancel') }}
+					</NcButton>
+					<NcButton variant="error" :aria-label="t('libresign', 'Confirm removal')" @click="confirmRuleRemoval">
+						{{ t('libresign', 'Remove rule') }}
+					</NcButton>
+				</div>
+			</div>
+		</NcDialog>
+	</NcSettingsSection>
+</template>
+
+<script setup lang="ts">
+import {
+	mdiFormatListBulletedSquare,
+	mdiViewGridOutline,
+} from '@mdi/js'
+import { computed, nextTick, onBeforeUnmount, onMounted, reactive, ref } from 'vue'
+import { t } from '@nextcloud/l10n'
+
+import NcButton from '@nextcloud/vue/components/NcButton'
+import NcCheckboxRadioSwitch from '@nextcloud/vue/components/NcCheckboxRadioSwitch'
+import NcDialog from '@nextcloud/vue/components/NcDialog'
+import NcIconSvgWrapper from '@nextcloud/vue/components/NcIconSvgWrapper'
+import NcNoteCard from '@nextcloud/vue/components/NcNoteCard'
+import NcSelect from '@nextcloud/vue/components/NcSelect'
+import NcSettingsSection from '@nextcloud/vue/components/NcSettingsSection'
+import NcTextField from '@nextcloud/vue/components/NcTextField'
+
+import PolicyRuleCard from './PolicyRuleCard.vue'
+import { createPolicyWorkbenchState } from './usePolicyWorkbench'
+
+defineOptions({
+	name: 'SettingsPolicyWorkbench',
+})
+
+const state = reactive(createPolicyWorkbenchState())
+const settingsFilter = ref('')
+const isSmallViewport = ref(false)
+const catalogLayout = ref<'cards' | 'compact'>('cards')
+const saveStatus = ref<'idle' | 'saving' | 'saved'>('idle')
+const saveFeedbackTimeout = ref<number | null>(null)
+const pendingRemoval = ref<{ ruleId: string, targetLabel: string, help: string } | null>(null)
+const lastPress = ref<{ surface: 'cards' | 'list', key: string, x: number, y: number } | null>(null)
+const recentSelectionGesture = ref<{ surface: 'cards' | 'list', key: string, at: number } | null>(null)
+
+const DRAG_OPEN_THRESHOLD_PX = 6
+const SELECTION_GUARD_WINDOW_MS = 400
+
+const filteredSettingSummaries = computed(() => {
+	const normalized = settingsFilter.value.trim().toLowerCase()
+	if (!normalized) {
+		return state.visibleSettingSummaries
+	}
+
+	return state.visibleSettingSummaries.filter((summary) => {
+		return [summary.title, summary.context ?? '', summary.description, summary.defaultSummary]
+			.some((value) => value.toLowerCase().includes(normalized))
+	})
+})
+
+const shouldUseEditorModal = computed(() => isSmallViewport.value)
+const activeEditor = computed(() => state.activeDefinition?.editor ?? null)
+const effectiveCatalogLayout = computed(() => isSmallViewport.value ? 'cards' : catalogLayout.value)
+const hasActiveFilter = computed(() => settingsFilter.value.trim().length > 0)
+const catalogViewButtonLabel = computed(() => {
+	return effectiveCatalogLayout.value === 'cards'
+		? t('libresign', 'Switch to compact view')
+		: t('libresign', 'Switch to cards view')
+})
+
+const selectedTargetOption = computed(() => {
+	if (!state.editorDraft) {
+		return null
+	}
+
+	return state.availableTargets.find(option => option.id === state.editorDraft?.targetId) ?? null
+})
+
+const systemRuleBadges = computed(() => {
+	if (!state.inheritedSystemRule || !state.activeDefinition) {
+		return []
+	}
+
+	const allowOverrideBadge = state.activeDefinition.formatAllowOverride(state.inheritedSystemRule.allowChildOverride)
+
+	return allowOverrideBadge ? [allowOverrideBadge] : []
+})
+
+const editorTitle = computed(() => {
+	if (!state.editorDraft) {
+		return ''
+	}
+
+	if (state.editorDraft.scope === 'system') {
+		return t('libresign', 'Default rule')
+	}
+
+	return state.draftTargetLabel || t('libresign', 'Select target')
+})
+
+const editorHelp = computed(() => {
+	if (!state.editorDraft) {
+		return ''
+	}
+
+	if (state.editorDraft.scope === 'system') {
+		return t('libresign', 'This rule becomes the baseline inherited by groups and users unless another rule overrides it.')
+	}
+
+	if (state.editorDraft.scope === 'group') {
+		return t('libresign', 'A group rule overrides the default and can still allow lower layers to diverge.')
+	}
+
+	return t('libresign', 'A user rule is the most specific layer and wins over inherited defaults.')
+})
+
+function groupRuleBadges(allowChildOverride: boolean) {
+	if (!state.activeDefinition) {
+		return []
+	}
+
+	const allowOverrideBadge = state.activeDefinition.formatAllowOverride(allowChildOverride)
+	return allowOverrideBadge ? [allowOverrideBadge] : []
+}
+
+function onTargetChange(option: { id: string } | null) {
+	state.updateDraftTarget(option?.id ?? null)
+}
+
+function summarizeRuleValue(value: unknown) {
+	if (!state.activeDefinition) {
+		return ''
+	}
+
+	return state.activeDefinition.summarizeValue(value as never)
+}
+
+function onSettingsFilterChange(value: string | number) {
+	settingsFilter.value = String(value ?? '')
+}
+
+function hasActiveTextSelection() {
+	const selection = window.getSelection()
+	return !!selection && selection.type === 'Range' && selection.toString().trim().length > 0
+}
+
+function markSelectionGesture(surface: 'cards' | 'list', key: string) {
+	if (!hasActiveTextSelection()) {
+		return
+	}
+
+	recentSelectionGesture.value = {
+		surface,
+		key,
+		at: Date.now(),
+	}
+}
+
+function shouldIgnoreDueToRecentSelection(surface: 'cards' | 'list', key: string) {
+	const gesture = recentSelectionGesture.value
+	if (!gesture) {
+		return false
+	}
+
+	const expired = (Date.now() - gesture.at) > SELECTION_GUARD_WINDOW_MS
+	const matchesTarget = gesture.surface === surface && gesture.key === key
+	if (expired || !matchesTarget) {
+		return false
+	}
+
+	recentSelectionGesture.value = null
+	return true
+}
+
+function isPlainPrimaryClick(event: MouseEvent) {
+	const button = typeof event.button === 'number' ? event.button : 0
+	const hasModifier = Boolean(event.metaKey || event.ctrlKey || event.shiftKey || event.altKey)
+	return button === 0 && !hasModifier
+}
+
+function trackPress(surface: 'cards' | 'list', key: string, event: PointerEvent) {
+	if (event.button !== 0) {
+		lastPress.value = null
+		return
+	}
+
+	lastPress.value = {
+		surface,
+		key,
+		x: event.clientX,
+		y: event.clientY,
+	}
+}
+
+function movedBeyondThreshold(event: MouseEvent, press: { x: number, y: number }) {
+	const deltaX = Math.abs(event.clientX - press.x)
+	const deltaY = Math.abs(event.clientY - press.y)
+	return deltaX > DRAG_OPEN_THRESHOLD_PX || deltaY > DRAG_OPEN_THRESHOLD_PX
+}
+
+function openSettingFromPointer(surface: 'cards' | 'list', key: string, event: MouseEvent) {
+	if (!isPlainPrimaryClick(event)) {
+		return
+	}
+
+	if (shouldIgnoreDueToRecentSelection(surface, key)) {
+		return
+	}
+
+	if (hasActiveTextSelection()) {
+		return
+	}
+
+	const press = lastPress.value
+	if (press && press.surface === surface && press.key === key && movedBeyondThreshold(event, press)) {
+		return
+	}
+
+	state.openSetting(key as never)
+}
+
+function clearSettingsFilter() {
+	settingsFilter.value = ''
+}
+
+function escapeRegExp(value: string) {
+	return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+}
+
+function escapeHtml(value: string) {
+	return value
+		.replaceAll('&', '&amp;')
+		.replaceAll('<', '&lt;')
+		.replaceAll('>', '&gt;')
+		.replaceAll('"', '&quot;')
+		.replaceAll("'", '&#39;')
+}
+
+function highlightText(value: string) {
+	const query = settingsFilter.value.trim()
+	const safeValue = escapeHtml(value)
+	if (!query) {
+		return safeValue
+	}
+
+	const matcher = new RegExp(`(${escapeRegExp(query)})`, 'ig')
+	return safeValue.replace(matcher, '<mark>$1</mark>')
+}
+
+function resolveSettingOrigin(groupCount: number, userCount: number) {
+	if (userCount > 0) {
+		return t('libresign', 'User overrides active')
+	}
+
+	if (groupCount > 0) {
+		return t('libresign', 'Group overrides active')
+	}
+
+	return t('libresign', 'Inherited default only')
+}
+
+function toggleCatalogLayout() {
+	if (isSmallViewport.value) {
+		catalogLayout.value = 'cards'
+		return
+	}
+
+	catalogLayout.value = effectiveCatalogLayout.value === 'cards' ? 'compact' : 'cards'
+}
+
+function updateViewportMode() {
+	isSmallViewport.value = window.innerWidth <= 960
+}
+
+async function handleSaveDraft() {
+	if (!state.canSaveDraft || saveStatus.value === 'saving') {
+		return
+	}
+
+	saveStatus.value = 'saving'
+	await nextTick()
+	state.saveDraft()
+	saveStatus.value = 'saved'
+
+	if (saveFeedbackTimeout.value !== null) {
+		window.clearTimeout(saveFeedbackTimeout.value)
+	}
+
+	saveFeedbackTimeout.value = window.setTimeout(() => {
+		saveStatus.value = 'idle'
+		saveFeedbackTimeout.value = null
+	}, 1300)
+}
+
+function promptRuleRemoval(ruleId: string, scope: 'system' | 'group' | 'user', targetLabel: string) {
+	const help = scope === 'system'
+		? t('libresign', 'Removing this rule will restore inherited behavior for all groups and users.')
+		: scope === 'group'
+			? t('libresign', 'Removing this rule will restore the instance default for this group.')
+			: t('libresign', 'Removing this rule will restore inherited behavior for this user.')
+
+	pendingRemoval.value = { ruleId, targetLabel, help }
+}
+
+function cancelRuleRemoval() {
+	pendingRemoval.value = null
+}
+
+function confirmRuleRemoval() {
+	if (!pendingRemoval.value) {
+		return
+	}
+
+	state.removeRule(pendingRemoval.value.ruleId)
+	pendingRemoval.value = null
+}
+
+onMounted(() => {
+	updateViewportMode()
+	window.addEventListener('resize', updateViewportMode, { passive: true })
+})
+
+onBeforeUnmount(() => {
+	window.removeEventListener('resize', updateViewportMode)
+	if (saveFeedbackTimeout.value !== null) {
+		window.clearTimeout(saveFeedbackTimeout.value)
+	}
+})
+</script>
+
+<style scoped lang="scss">
+.policy-workbench {
+	&__catalog-toolbar {
+		margin-top: 1.1rem;
+		display: grid;
+		grid-template-columns: minmax(0, 1fr) auto;
+		gap: 0.75rem;
+		align-items: start;
+	}
+
+	&__catalog-search {
+		display: flex;
+		flex-direction: column;
+		gap: 0.4rem;
+	}
+
+	&__catalog-foot {
+		display: flex;
+		justify-content: space-between;
+		align-items: center;
+		gap: 0.75rem;
+
+		:deep(.button-vue) {
+			white-space: nowrap;
+		}
+	}
+
+	&__clear-filter-button {
+		&--hidden {
+			visibility: hidden;
+			pointer-events: none;
+		}
+	}
+
+	&__catalog-view-switch {
+		display: flex;
+		gap: 0.6rem;
+		flex-wrap: wrap;
+		justify-content: flex-end;
+
+		:deep(.button-vue) {
+			min-width: var(--clickable-area-small);
+		}
+	}
+
+	&__catalog-view-button {
+		:deep(.button-vue__text) {
+			display: none;
+		}
+	}
+
+	&__catalog-meta {
+		margin: 0;
+		font-size: 0.86rem;
+		color: var(--color-text-maxcontrast);
+	}
+
+	&__settings-grid {
+		margin-top: 1rem;
+		display: grid;
+		grid-template-columns: repeat(auto-fit, minmax(290px, 1fr));
+		gap: 1rem;
+	}
+
+	&__settings-list {
+		margin-top: 1rem;
+		display: flex;
+		flex-direction: column;
+		gap: 0.75rem;
+	}
+
+	&__settings-row {
+		display: grid;
+		grid-template-columns: minmax(240px, 1.2fr) minmax(290px, 1fr) auto;
+		gap: 1rem;
+		align-items: center;
+		padding: 0.9rem 1rem;
+		border-radius: 14px;
+		border: 1px solid color-mix(in srgb, var(--color-primary-element) 12%, var(--color-border-maxcontrast));
+		background: color-mix(in srgb, var(--color-main-background) 94%, white);
+		transition: border-color 0.15s ease, box-shadow 0.15s ease;
+
+		&:hover,
+		&:focus-within {
+			border-color: color-mix(in srgb, var(--color-primary-element) 40%, var(--color-border-maxcontrast));
+			box-shadow: 0 0 0 2px color-mix(in srgb, var(--color-primary-element) 12%, transparent);
+		}
+
+		:deep(.button-vue) {
+			flex-shrink: 0;
+		}
+	}
+
+	&__settings-row-main {
+		min-width: 0;
+
+		h3,
+		p {
+			margin: 0;
+		}
+
+		h3 {
+			overflow-wrap: anywhere;
+		}
+
+		p:not(.policy-workbench__origin-badge) {
+			margin-top: 0.25rem;
+			color: var(--color-text-maxcontrast);
+			display: -webkit-box;
+			-webkit-box-orient: vertical;
+			-webkit-line-clamp: 2;
+			overflow: hidden;
+		}
+	}
+
+	&__origin-badge {
+		margin: 0;
+		display: inline-flex;
+		align-self: flex-start;
+		padding: 0.2rem 0.55rem;
+		border-radius: 999px;
+		font-size: 0.76rem;
+		font-weight: 600;
+		color: var(--color-primary-element);
+		border: 1px solid color-mix(in srgb, var(--color-primary-element) 28%, var(--color-border-maxcontrast));
+		background: color-mix(in srgb, var(--color-primary-element) 16%, var(--color-main-background));
+
+		&--inline {
+			margin-top: 0.5rem;
+		}
+	}
+
+	&__settings-row-stats {
+		display: grid;
+		grid-template-columns: minmax(0, 1.8fr) auto auto;
+		gap: 0.65rem;
+		font-size: 0.9rem;
+		color: var(--color-text-maxcontrast);
+		min-width: 0;
+	}
+
+	&__settings-row-stat {
+		min-width: 0;
+		white-space: nowrap;
+	}
+
+	&__settings-row-stat--default {
+		display: flex;
+		align-items: baseline;
+		gap: 0.25rem;
+		min-width: 0;
+
+		strong {
+			white-space: nowrap;
+			flex-shrink: 0;
+		}
+
+		span {
+			display: block;
+			min-width: 0;
+			white-space: nowrap;
+			overflow: hidden;
+			text-overflow: ellipsis;
+		}
+	}
+
+	&__setting-tile {
+		text-align: left;
+		padding: 1.25rem;
+		border-radius: 20px;
+		border: 1px solid color-mix(in srgb, var(--color-primary-element) 14%, var(--color-border-maxcontrast));
+		background:
+			radial-gradient(circle at top right, color-mix(in srgb, var(--color-primary-element) 14%, transparent), transparent 45%),
+			linear-gradient(180deg, color-mix(in srgb, var(--color-main-background) 92%, white), var(--color-main-background));
+		display: flex;
+		flex-direction: column;
+		gap: 1rem;
+		cursor: pointer;
+		transition: border-color 0.15s ease, box-shadow 0.15s ease;
+
+		&:hover,
+		&:focus-visible,
+		&:focus-within {
+			border-color: color-mix(in srgb, var(--color-primary-element) 46%, var(--color-border-maxcontrast));
+			box-shadow: 0 0 0 2px color-mix(in srgb, var(--color-primary-element) 14%, transparent);
+		}
+
+		h3,
+		p {
+			margin: 0;
+		}
+
+		:deep(.button-vue) {
+			flex-shrink: 0;
+		}
+	}
+
+	&__setting-header {
+		display: grid;
+		grid-template-columns: minmax(0, 1fr) auto;
+		gap: 1rem;
+		align-items: flex-start;
+
+		> div {
+			min-width: 0;
+		}
+
+		h3 {
+			overflow-wrap: anywhere;
+			word-break: break-word;
+		}
+	}
+
+	&__setting-title {
+		display: inline-flex;
+		align-items: baseline;
+		gap: 0.35rem;
+	}
+
+	&__setting-context {
+		font-size: 0.88em;
+		font-weight: 500;
+		color: var(--color-text-maxcontrast);
+	}
+
+	&__setting-stats {
+		margin: 0;
+		padding: 0;
+		list-style: none;
+		display: flex;
+		flex-direction: column;
+		gap: 0.35rem;
+
+		li {
+			display: flex;
+			gap: 0.3rem;
+			align-items: baseline;
+
+			strong {
+				white-space: nowrap;
+				flex-shrink: 0;
+			}
+
+			span {
+				min-width: 0;
+				overflow: hidden;
+				text-overflow: ellipsis;
+				white-space: nowrap;
+			}
+		}
+	}
+
+	&__manage-button {
+		:deep(.button-vue) {
+			transition: transform 0.12s ease;
+		}
+	}
+
+	&__setting-tile:hover &__manage-button,
+	&__setting-tile:focus-within &__manage-button,
+	&__settings-row:hover &__manage-button,
+	&__settings-row:focus-within &__manage-button {
+		:deep(.button-vue) {
+			transform: translateY(-1px);
+		}
+	}
+
+	&__empty-state {
+		display: flex;
+		flex-direction: column;
+		gap: 0.65rem;
+
+		p {
+			margin: 0;
+		}
+	}
+
+	&__empty-state-actions {
+		display: flex;
+		gap: 0.6rem;
+		flex-wrap: wrap;
+	}
+
+	&__dialog {
+		width: min(1480px, 100%);
+		min-height: min(820px, calc(100vh - 7rem));
+		margin: 0 auto;
+		display: flex;
+		flex-direction: column;
+		gap: 1.25rem;
+	}
+
+	&__dialog-header {
+		display: flex;
+		justify-content: space-between;
+		gap: 1rem;
+		align-items: flex-start;
+
+		h2,
+		p {
+			margin: 0;
+		}
+
+		h2 {
+			word-break: break-word;
+		}
+	}
+
+	&__dialog-actions {
+		display: flex;
+		flex-wrap: wrap;
+		gap: 0.75rem;
+
+		:deep(.button-vue) {
+			max-width: 100%;
+		}
+	}
+
+	&__workspace {
+		display: grid;
+		grid-template-columns: minmax(300px, 0.82fr) minmax(560px, 1.18fr);
+		gap: 1.25rem;
+		align-items: start;
+		flex: 1;
+	}
+
+	&__rules-column,
+	&__editor-column {
+		display: flex;
+		flex-direction: column;
+		gap: 1rem;
+		min-width: 0;
+	}
+
+	&__group,
+	&__editor-panel,
+	&__editor-mobile-hint,
+	&__editor-empty {
+		padding: 1.25rem;
+		border-radius: 18px;
+		background: color-mix(in srgb, var(--color-background-dark) 8%, var(--color-main-background));
+		display: flex;
+		flex-direction: column;
+		gap: 0.85rem;
+		overflow: hidden;
+	}
+
+	&__editor-panel-content {
+		display: flex;
+		flex-direction: column;
+		gap: 0.85rem;
+
+		&--saving {
+			opacity: 0.5;
+			pointer-events: none;
+			user-select: none;
+		}
+	}
+
+	&__editor-panel,
+	&__editor-mobile-hint,
+	&__editor-empty {
+		position: sticky;
+		top: 0;
+	}
+
+	&__editor-mobile-hint {
+		p,
+		h3 {
+			margin: 0;
+		}
+
+		p:last-of-type {
+			margin-top: 0.25rem;
+			color: var(--color-text-maxcontrast);
+		}
+
+		:deep(.button-vue) {
+			margin-top: 0.65rem;
+			width: 100%;
+			justify-content: center;
+		}
+	}
+
+	&__editor-modal-body {
+		width: min(860px, 100%);
+		margin: 0 auto;
+	}
+
+	&__group-header,
+	&__editor-header {
+		h3,
+		p {
+			margin: 0;
+		}
+
+		p:last-child {
+			margin-top: 0.35rem;
+			color: var(--color-text-maxcontrast);
+		}
+	}
+
+	&__stack {
+		display: flex;
+		flex-direction: column;
+		gap: 0.75rem;
+	}
+
+	&__field {
+		display: flex;
+		flex-direction: column;
+		gap: 0.45rem;
+	}
+
+	&__setting-surface {
+		display: flex;
+		flex-direction: column;
+		gap: 0.75rem;
+		padding: 0.8rem;
+		border-radius: 12px;
+		border: 1px solid color-mix(in srgb, var(--color-primary-element) 45%, var(--color-border-maxcontrast));
+		background: color-mix(in srgb, var(--color-primary-element) 5%, var(--color-main-background));
+		box-shadow: inset 0 0 0 1px color-mix(in srgb, var(--color-primary-element) 8%, transparent);
+	}
+
+	&__label,
+	&__eyebrow {
+		font-size: 0.78rem;
+		text-transform: uppercase;
+		letter-spacing: 0.04em;
+		color: var(--color-text-maxcontrast);
+	}
+
+	&__switch-copy {
+		display: flex;
+		flex-direction: column;
+		gap: 0.25rem;
+
+		p {
+			margin: 0;
+			font-size: 0.84rem;
+			color: var(--color-text-maxcontrast);
+		}
+	}
+
+	&__editor-actions {
+		display: flex;
+		flex-wrap: wrap;
+		gap: 0.75rem;
+
+		:deep(.button-vue) {
+			max-width: 100%;
+		}
+	}
+
+	&__editor-actions--sticky-mobile {
+		position: sticky;
+		bottom: 0;
+		padding-top: 0.55rem;
+		margin-top: 0.25rem;
+		background: linear-gradient(180deg, color-mix(in srgb, var(--color-main-background) 15%, transparent), var(--color-main-background));
+	}
+
+	&__save-feedback {
+		margin: 0;
+		font-size: 0.84rem;
+		font-weight: 600;
+		color: color-mix(in srgb, var(--color-primary-element-text) 78%, var(--color-success));
+	}
+
+	&__saving-overlay {
+		position: absolute;
+		inset: 0;
+		display: flex;
+		flex-direction: column;
+		align-items: center;
+		justify-content: center;
+		gap: 0.55rem;
+		padding: 1rem;
+		background: color-mix(in srgb, var(--color-main-background) 78%, transparent);
+		backdrop-filter: blur(1px);
+		z-index: 2;
+
+		p {
+			margin: 0;
+			font-weight: 600;
+			color: var(--color-text-maxcontrast);
+		}
+	}
+
+	&__saving-spinner {
+		width: 1.4rem;
+		height: 1.4rem;
+		border-radius: 999px;
+		border: 2px solid color-mix(in srgb, var(--color-primary-element) 22%, var(--color-border-maxcontrast));
+		border-top-color: var(--color-primary-element);
+		animation: policy-workbench-spin 0.8s linear infinite;
+	}
+
+	&__confirm-dialog {
+		display: flex;
+		flex-direction: column;
+		gap: 0.75rem;
+		width: min(540px, calc(100vw - 2rem));
+		max-width: 100%;
+		box-sizing: border-box;
+
+		p {
+			margin: 0;
+		}
+	}
+
+	&__confirm-target {
+		font-weight: 700;
+	}
+
+	&__confirm-help {
+		color: var(--color-text-maxcontrast);
+	}
+
+	&__confirm-actions {
+		display: grid;
+		grid-template-columns: repeat(2, minmax(0, 1fr));
+		gap: 0.6rem;
+		align-items: stretch;
+
+		:deep(.button-vue) {
+			width: 100%;
+			justify-content: center;
+		}
+	}
+
+	:deep(mark) {
+		background: color-mix(in srgb, var(--color-warning) 35%, transparent);
+		color: inherit;
+		padding: 0 0.1rem;
+		border-radius: 3px;
+	}
+}
+
+@keyframes policy-workbench-spin {
+	to {
+		transform: rotate(360deg);
+	}
+}
+
+@media (max-width: 960px) {
+	.policy-workbench {
+		&__catalog-toolbar {
+			display: flex;
+			flex-direction: column;
+			align-items: stretch;
+		}
+
+		&__catalog-view-switch {
+			justify-content: flex-start;
+
+			:deep(.button-vue) {
+				justify-content: center;
+			}
+		}
+
+		&__catalog-meta {
+			margin-top: -0.15rem;
+		}
+
+		&__catalog-foot {
+			flex-direction: column;
+			align-items: flex-start;
+
+			:deep(.button-vue) {
+				width: 100%;
+				justify-content: center;
+			}
+		}
+
+		&__empty-state-actions {
+			width: 100%;
+
+			:deep(.button-vue) {
+				width: 100%;
+				justify-content: center;
+			}
+		}
+
+		&__workspace,
+		&__dialog-header,
+		&__setting-header {
+			display: flex;
+			flex-direction: column;
+		}
+
+		&__settings-row {
+			grid-template-columns: 1fr;
+			align-items: stretch;
+
+			:deep(.button-vue) {
+				width: 100%;
+				justify-content: center;
+			}
+		}
+
+		&__dialog {
+			width: 100%;
+			min-height: auto;
+			gap: 1rem;
+		}
+
+		&__editor-panel,
+		&__editor-mobile-hint,
+		&__editor-empty {
+			position: static;
+		}
+
+		&__dialog-actions,
+		&__editor-actions {
+			:deep(.button-vue) {
+				width: 100%;
+				justify-content: center;
+			}
+		}
+
+		&__confirm-actions {
+			:deep(.button-vue) {
+				width: 100%;
+				justify-content: center;
+			}
+		}
+
+		&__setting-header {
+			:deep(.button-vue) {
+				width: 100%;
+				justify-content: center;
+			}
+		}
+
+		&__group,
+		&__editor-panel,
+		&__editor-mobile-hint,
+		&__editor-empty,
+		&__setting-tile {
+			padding: 1rem;
+		}
+	}
+}
+
+@media (min-width: 961px) and (max-width: 1280px) {
+	.policy-workbench {
+		&__workspace {
+			grid-template-columns: minmax(280px, 0.9fr) minmax(460px, 1.1fr);
+		}
+	}
+}
+
+@media (max-width: 640px) {
+	.policy-workbench {
+		&__settings-grid {
+			gap: 0.75rem;
+		}
+
+		&__dialog {
+			gap: 0.75rem;
+		}
+
+		&__setting-stats {
+			gap: 0.5rem;
+
+			li {
+				word-break: break-word;
+			}
+		}
+
+		&__workspace,
+		&__rules-column,
+		&__editor-column,
+		&__stack {
+			gap: 0.75rem;
+		}
+
+		&__dialog-header,
+		&__group-header,
+		&__editor-header {
+			h2,
+			h3,
+			p {
+				word-break: break-word;
+			}
+		}
+
+		&__settings-row-stats {
+			grid-template-columns: 1fr;
+		}
+
+		&__confirm-actions {
+			grid-template-columns: 1fr;
+		}
+	}
+}
+</style>
diff --git a/src/views/Settings/PolicyWorkbench/settings/confetti/ConfettiRuleEditor.vue b/src/views/Settings/PolicyWorkbench/settings/confetti/ConfettiRuleEditor.vue
new file mode 100644
index 0000000000..99ccd40eb4
--- /dev/null
+++ b/src/views/Settings/PolicyWorkbench/settings/confetti/ConfettiRuleEditor.vue
@@ -0,0 +1,59 @@
+<!--
+  - SPDX-FileCopyrightText: 2026 LibreCode coop and LibreCode contributors
+  - SPDX-License-Identifier: AGPL-3.0-or-later
+-->
+
+<template>
+	<div class="confetti-rule-editor">
+		<NcCheckboxRadioSwitch
+			type="switch"
+			:model-value="modelValue.enabled"
+			@update:modelValue="onEnabledChange">
+			<span>{{ t('libresign', 'Show confetti animation after signing') }}</span>
+		</NcCheckboxRadioSwitch>
+
+		<p class="confetti-rule-editor__hint">
+			{{ t('libresign', 'This is intentionally simple so we can validate the policy shell with a lightweight setting too.') }}
+		</p>
+	</div>
+</template>
+
+<script setup lang="ts">
+import { t } from '@nextcloud/l10n'
+
+import NcCheckboxRadioSwitch from '@nextcloud/vue/components/NcCheckboxRadioSwitch'
+
+import type { ConfettiRuleValue } from '../../types'
+
+defineOptions({
+	name: 'ConfettiRuleEditor',
+})
+
+const props = defineProps<{
+	modelValue: ConfettiRuleValue
+}>()
+
+const emit = defineEmits<{
+	'update:modelValue': [value: ConfettiRuleValue]
+}>()
+
+function onEnabledChange(enabled: boolean) {
+	emit('update:modelValue', {
+		...props.modelValue,
+		enabled,
+	})
+}
+</script>
+
+<style scoped lang="scss">
+.confetti-rule-editor {
+	display: flex;
+	flex-direction: column;
+	gap: 0.75rem;
+
+	&__hint {
+		margin: 0;
+		color: var(--color-text-maxcontrast);
+	}
+}
+</style>
diff --git a/src/views/Settings/PolicyWorkbench/settings/confetti/index.ts b/src/views/Settings/PolicyWorkbench/settings/confetti/index.ts
new file mode 100644
index 0000000000..3fa124d084
--- /dev/null
+++ b/src/views/Settings/PolicyWorkbench/settings/confetti/index.ts
@@ -0,0 +1,26 @@
+/**
+ * SPDX-FileCopyrightText: 2026 LibreCode coop and LibreCode contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+import { t } from '@nextcloud/l10n'
+
+import ConfettiRuleEditor from './ConfettiRuleEditor.vue'
+import type { PolicySettingDefinition } from '../../types'
+
+export const confettiDefinition: PolicySettingDefinition<'confetti'> = {
+	key: 'confetti',
+	title: t('libresign', 'Confetti animation'),
+	context: t('libresign', 'UI effect'),
+	description: t('libresign', 'Control whether a celebratory animation is shown when someone signs a document.'),
+	editor: ConfettiRuleEditor,
+	createEmptyValue: () => ({
+		enabled: true,
+	}),
+	summarizeValue: (value) => value.enabled
+		? t('libresign', 'Enabled')
+		: t('libresign', 'Disabled'),
+	formatAllowOverride: (allowChildOverride) => allowChildOverride
+		? t('libresign', 'Lower layers may override this rule')
+		: t('libresign', 'Lower layers must inherit this value'),
+}
diff --git a/src/views/Settings/PolicyWorkbench/settings/docmdp/DocMdpScalarRuleEditor.vue b/src/views/Settings/PolicyWorkbench/settings/docmdp/DocMdpScalarRuleEditor.vue
new file mode 100644
index 0000000000..6e7ae56b72
--- /dev/null
+++ b/src/views/Settings/PolicyWorkbench/settings/docmdp/DocMdpScalarRuleEditor.vue
@@ -0,0 +1,124 @@
+<!--
+  - SPDX-FileCopyrightText: 2026 LibreCode coop and LibreCode contributors
+  - SPDX-License-Identifier: AGPL-3.0-or-later
+-->
+
+<template>
+	<div class="docmdp-scalar-editor">
+		<div class="docmdp-scalar-editor__options">
+			<NcCheckboxRadioSwitch
+				v-for="level in levels"
+				:key="level.value"
+				class="docmdp-scalar-editor__option"
+				type="radio"
+				:model-value="normalizedValue === level.value"
+				name="docmdp-scalar-editor"
+				@update:modelValue="onLevelChange(level.value, $event)">
+				<div class="docmdp-scalar-editor__copy">
+					<strong>{{ level.label }}</strong>
+					<p>{{ level.description }}</p>
+				</div>
+			</NcCheckboxRadioSwitch>
+		</div>
+	</div>
+</template>
+
+<script setup lang="ts">
+import { computed } from 'vue'
+import { t } from '@nextcloud/l10n'
+
+import NcCheckboxRadioSwitch from '@nextcloud/vue/components/NcCheckboxRadioSwitch'
+import type { EffectivePolicyValue } from '../../../../../types/index'
+
+defineOptions({
+	name: 'DocMdpScalarRuleEditor',
+})
+
+const props = defineProps<{
+	modelValue: EffectivePolicyValue
+}>()
+
+const emit = defineEmits<{
+	'update:modelValue': [value: EffectivePolicyValue]
+}>()
+
+const levels: Array<{ value: number, label: string, description: string }> = [
+	{
+		value: 0,
+		label: t('libresign', 'Disabled'),
+		description: t('libresign', 'Do not apply DocMDP certification by default.'),
+	},
+	{
+		value: 1,
+		label: t('libresign', 'No changes allowed'),
+		description: t('libresign', 'After signing, no changes are allowed in the document.'),
+	},
+	{
+		value: 2,
+		label: t('libresign', 'Form filling'),
+		description: t('libresign', 'After signing, only form filling is allowed.'),
+	},
+	{
+		value: 3,
+		label: t('libresign', 'Form filling and annotations'),
+		description: t('libresign', 'After signing, form filling and annotations are allowed.'),
+	},
+]
+
+const normalizedValue = computed<number | null>(() => {
+	const value = props.modelValue
+	if (typeof value === 'number' && value >= 0 && value <= 3) {
+		return value
+	}
+
+	if (typeof value === 'string' && /^[0-3]$/.test(value)) {
+		return Number(value)
+	}
+
+	return null
+})
+
+function onLevelChange(level: number, selected?: unknown) {
+	if (selected === false) {
+		return
+	}
+
+	emit('update:modelValue', level)
+}
+</script>
+
+<style scoped lang="scss">
+.docmdp-scalar-editor {
+	display: flex;
+	flex-direction: column;
+	gap: 1rem;
+
+	&__options {
+		display: flex;
+		flex-direction: column;
+		gap: 0.75rem;
+	}
+
+	&__option {
+		width: 100%;
+	}
+
+	&__copy p {
+		margin: 0.35rem 0 0;
+		color: var(--color-text-maxcontrast);
+	}
+
+	:deep(.docmdp-scalar-editor__option.checkbox-radio-switch) {
+		width: 100%;
+	}
+
+	:deep(.docmdp-scalar-editor__option .checkbox-radio-switch__content) {
+		width: 100%;
+		max-width: none;
+	}
+
+	:deep(.docmdp-scalar-editor__option.checkbox-radio-switch--checked:focus-within .checkbox-radio-switch__content) {
+		background-color: transparent;
+	}
+}
+</style>
diff --git a/src/views/Settings/PolicyWorkbench/settings/docmdp/realDefinition.ts b/src/views/Settings/PolicyWorkbench/settings/docmdp/realDefinition.ts
new file mode 100644
index 0000000000..0ca74bee5d
--- /dev/null
+++ b/src/views/Settings/PolicyWorkbench/settings/docmdp/realDefinition.ts
@@ -0,0 +1,64 @@
+/**
+ * SPDX-FileCopyrightText: 2026 LibreCode coop and LibreCode contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+import { t } from '@nextcloud/l10n'
+
+import DocMdpScalarRuleEditor from './DocMdpScalarRuleEditor.vue'
+import type { EffectivePolicyValue } from '../../../../../types/index'
+import type { RealPolicySettingDefinition } from '../realTypes'
+
+export function resolveDocMdpLevel(value: EffectivePolicyValue): number | null {
+	if (typeof value === 'number' && value >= 0 && value <= 3) {
+		return value
+	}
+
+	if (typeof value === 'string' && /^[0-3]$/.test(value)) {
+		return Number(value)
+	}
+
+	return null
+}
+
+export const docMdpRealDefinition: RealPolicySettingDefinition = {
+	key: 'docmdp',
+	title: t('libresign', 'PDF certification'),
+	context: t('libresign', 'DocMDP'),
+	description: t('libresign', 'Control what changes are allowed after a document is signed.'),
+	editor: DocMdpScalarRuleEditor,
+	resolutionMode: 'precedence',
+	createEmptyValue: () => 0,
+	normalizeDraftValue: (value: EffectivePolicyValue) => {
+		const level = resolveDocMdpLevel(value)
+		return level ?? 0
+	},
+	hasSelectableDraftValue: (value: EffectivePolicyValue) => resolveDocMdpLevel(value) !== null,
+	normalizeAllowChildOverride: (_scope, allowChildOverride: boolean) => allowChildOverride,
+	getFallbackSystemDefault: (policyValue: EffectivePolicyValue | null | undefined, sourceScope?: string | null) => {
+		if (sourceScope === 'system' && policyValue !== null && policyValue !== undefined) {
+			return policyValue
+		}
+
+		return 0
+	},
+	summarizeValue: (value: EffectivePolicyValue) => {
+		const level = resolveDocMdpLevel(value)
+		switch (level) {
+		case 0:
+			return t('libresign', 'Disabled')
+		case 1:
+			return t('libresign', 'No changes allowed')
+		case 2:
+			return t('libresign', 'Form filling')
+		case 3:
+			return t('libresign', 'Form filling and annotations')
+		default:
+			return t('libresign', 'Not configured')
+		}
+	},
+	formatAllowOverride: (allowChildOverride: boolean) =>
+		allowChildOverride
+			? t('libresign', 'Groups and users can set their own rule')
+			: t('libresign', 'Groups and users must follow this value'),
+}
diff --git a/src/views/Settings/PolicyWorkbench/settings/identify-factors/IdentifyFactorsRuleEditor.vue b/src/views/Settings/PolicyWorkbench/settings/identify-factors/IdentifyFactorsRuleEditor.vue
new file mode 100644
index 0000000000..ae1afac191
--- /dev/null
+++ b/src/views/Settings/PolicyWorkbench/settings/identify-factors/IdentifyFactorsRuleEditor.vue
@@ -0,0 +1,266 @@
+<!--
+  - SPDX-FileCopyrightText: 2026 LibreCode coop and LibreCode contributors
+  - SPDX-License-Identifier: AGPL-3.0-or-later
+-->
+
+<template>
+	<div class="identify-factors-rule-editor">
+		<NcCheckboxRadioSwitch
+			type="switch"
+			:model-value="modelValue.enabled"
+			@update:modelValue="onEnabledChange">
+			<span>{{ t('libresign', 'Enable identification factors rules') }}</span>
+		</NcCheckboxRadioSwitch>
+
+		<div v-if="modelValue.enabled" class="identify-factors-rule-editor__content">
+			<div class="identify-factors-rule-editor__health">
+				<p>
+					{{ t('libresign', '{enabled} enabled, {required} required', {
+						enabled: String(enabledFactorsCount),
+						required: String(requiredFactorsCount),
+					}) }}
+				</p>
+				<p>
+					{{ modelValue.requireAnyTwo
+						? t('libresign', 'Rule strategy: any two factors')
+						: t('libresign', 'Rule strategy: a single configured factor') }}
+				</p>
+			</div>
+
+			<NcCheckboxRadioSwitch
+				type="switch"
+				:model-value="modelValue.requireAnyTwo"
+				@update:modelValue="onRequireAnyTwoChange">
+				<span>{{ t('libresign', 'Require at least two enabled factors') }}</span>
+			</NcCheckboxRadioSwitch>
+
+			<NcNoteCard v-if="showTwoFactorWarning" type="warning">
+				{{ t('libresign', 'At least two factors must be enabled to satisfy this policy strategy.') }}
+			</NcNoteCard>
+
+			<div
+				v-for="factor in modelValue.factors"
+				:key="factor.key"
+				class="identify-factors-rule-editor__factor">
+				<div class="identify-factors-rule-editor__factor-header">
+					<strong>{{ factor.label }}</strong>
+					<span>{{ factor.key }}</span>
+				</div>
+
+				<NcCheckboxRadioSwitch
+					type="switch"
+					:model-value="factor.enabled"
+					@update:modelValue="onFactorSwitch(factor.key, 'enabled', $event)">
+					<span>{{ t('libresign', 'Enabled for this target') }}</span>
+				</NcCheckboxRadioSwitch>
+
+				<div v-if="factor.enabled" class="identify-factors-rule-editor__factor-options">
+					<NcCheckboxRadioSwitch
+						type="switch"
+						:model-value="factor.required"
+						@update:modelValue="onFactorSwitch(factor.key, 'required', $event)">
+						<span>{{ t('libresign', 'Mandatory for signer') }}</span>
+					</NcCheckboxRadioSwitch>
+
+					<NcCheckboxRadioSwitch
+						v-if="factor.key === 'email'"
+						type="switch"
+						:model-value="factor.allowCreateAccount"
+						@update:modelValue="onFactorSwitch(factor.key, 'allowCreateAccount', $event)">
+						<span>{{ t('libresign', 'Allow account creation fallback') }}</span>
+					</NcCheckboxRadioSwitch>
+
+					<fieldset class="identify-factors-rule-editor__signature-methods">
+						<legend>{{ t('libresign', 'Signature method') }}</legend>
+						<NcCheckboxRadioSwitch
+							v-for="methodOption in signatureMethodOptionsByFactor[factor.key]"
+							:key="methodOption.value"
+							type="radio"
+							:name="`identify-factor-${factor.key}`"
+							:model-value="factor.signatureMethod === methodOption.value"
+							@update:modelValue="onSignatureMethodChange(factor.key, methodOption.value)">
+							{{ methodOption.label }}
+						</NcCheckboxRadioSwitch>
+					</fieldset>
+				</div>
+			</div>
+		</div>
+	</div>
+</template>
+
+<script setup lang="ts">
+import { computed } from 'vue'
+import { t } from '@nextcloud/l10n'
+
+import NcCheckboxRadioSwitch from '@nextcloud/vue/components/NcCheckboxRadioSwitch'
+import NcNoteCard from '@nextcloud/vue/components/NcNoteCard'
+
+import type {
+	IdentifyFactorKey,
+	IdentifyFactorOption,
+	IdentifyFactorSignatureMethod,
+	IdentifyFactorsRuleValue,
+} from '../../types'
+
+defineOptions({
+	name: 'IdentifyFactorsRuleEditor',
+})
+
+const props = defineProps<{
+	modelValue: IdentifyFactorsRuleValue
+}>()
+
+const emit = defineEmits<{
+	'update:modelValue': [value: IdentifyFactorsRuleValue]
+}>()
+
+const signatureMethodOptionsByFactor: Record<IdentifyFactorKey, Array<{ value: IdentifyFactorSignatureMethod, label: string }>> = {
+	email: [
+		{ value: 'email_token', label: t('libresign', 'Email token') },
+		{ value: 'document_validation', label: t('libresign', 'Document validation') },
+	],
+	sms: [
+		{ value: 'sms_token', label: t('libresign', 'SMS token') },
+		{ value: 'document_validation', label: t('libresign', 'Document validation') },
+	],
+	whatsapp: [
+		{ value: 'whatsapp_token', label: t('libresign', 'WhatsApp token') },
+		{ value: 'document_validation', label: t('libresign', 'Document validation') },
+	],
+	document: [
+		{ value: 'document_validation', label: t('libresign', 'Document validation') },
+	],
+}
+
+const enabledFactorsCount = computed(() => props.modelValue.factors.filter((factor) => factor.enabled).length)
+const requiredFactorsCount = computed(() => props.modelValue.factors.filter((factor) => factor.enabled && factor.required).length)
+const showTwoFactorWarning = computed(() => props.modelValue.requireAnyTwo && enabledFactorsCount.value < 2)
+
+function updateValue(nextValue: Partial<IdentifyFactorsRuleValue>) {
+	emit('update:modelValue', {
+		...props.modelValue,
+		...nextValue,
+	})
+}
+
+function onEnabledChange(enabled: boolean) {
+	updateValue({ enabled })
+}
+
+function onRequireAnyTwoChange(requireAnyTwo: boolean) {
+	updateValue({ requireAnyTwo })
+}
+
+function onFactorSwitch(
+	factorKey: IdentifyFactorKey,
+	field: 'enabled' | 'required' | 'allowCreateAccount',
+	value: boolean,
+) {
+	updateFactor(factorKey, {
+		[field]: value,
+	} as Partial<IdentifyFactorOption>)
+}
+
+function onSignatureMethodChange(factorKey: IdentifyFactorKey, signatureMethod: IdentifyFactorSignatureMethod) {
+	updateFactor(factorKey, { signatureMethod })
+}
+
+function updateFactor(factorKey: IdentifyFactorKey, patch: Partial<IdentifyFactorOption>) {
+	updateValue({
+		factors: props.modelValue.factors.map((factor) => {
+			if (factor.key !== factorKey) {
+				return factor
+			}
+			return {
+				...factor,
+				...patch,
+			}
+		}),
+	})
+}
+</script>
+
+<style scoped lang="scss">
+.identify-factors-rule-editor {
+	display: flex;
+	flex-direction: column;
+	gap: 1rem;
+
+	&__content {
+		display: flex;
+		flex-direction: column;
+		gap: 0.9rem;
+	}
+
+	&__health {
+		display: grid;
+		grid-template-columns: repeat(2, minmax(0, 1fr));
+		gap: 0.5rem;
+		border-radius: 10px;
+		padding: 0.65rem;
+		background: color-mix(in srgb, var(--color-primary-element) 9%, var(--color-main-background));
+
+		p {
+			margin: 0;
+			font-size: 0.85rem;
+			color: var(--color-text-maxcontrast);
+		}
+	}
+
+	&__factor {
+		border-radius: 12px;
+		border: 1px solid var(--color-border-maxcontrast);
+		padding: 0.75rem;
+		display: flex;
+		flex-direction: column;
+		gap: 0.6rem;
+	}
+
+	&__factor-header {
+		display: flex;
+		justify-content: space-between;
+		align-items: center;
+		gap: 0.6rem;
+
+		span {
+			font-size: 0.8rem;
+			color: var(--color-text-maxcontrast);
+			text-transform: uppercase;
+		}
+	}
+
+	&__factor-options {
+		display: flex;
+		flex-direction: column;
+		gap: 0.55rem;
+		padding-left: 0.4rem;
+	}
+
+	&__signature-methods {
+		margin: 0;
+		padding: 0.6rem;
+		border-radius: 10px;
+		border: 1px dashed color-mix(in srgb, var(--color-primary-element) 45%, var(--color-border-maxcontrast));
+		display: flex;
+		flex-direction: column;
+		gap: 0.35rem;
+
+		legend {
+			font-weight: 600;
+			padding: 0 0.35rem;
+		}
+	}
+}
+
+@media (max-width: 640px) {
+	.identify-factors-rule-editor {
+		&__health {
+			grid-template-columns: 1fr;
+		}
+
+		&__factor-header {
+			flex-wrap: wrap;
+		}
+	}
+}
+</style>
diff --git a/src/views/Settings/PolicyWorkbench/settings/identify-factors/index.ts b/src/views/Settings/PolicyWorkbench/settings/identify-factors/index.ts
new file mode 100644
index 0000000000..fb8765f8ab
--- /dev/null
+++ b/src/views/Settings/PolicyWorkbench/settings/identify-factors/index.ts
@@ -0,0 +1,69 @@
+/**
+ * SPDX-FileCopyrightText: 2026 LibreCode coop and LibreCode contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+import { t } from '@nextcloud/l10n'
+
+import IdentifyFactorsRuleEditor from './IdentifyFactorsRuleEditor.vue'
+import type { PolicySettingDefinition } from '../../types'
+
+export const identifyFactorsDefinition: PolicySettingDefinition<'identify_factors'> = {
+	key: 'identify_factors',
+	title: t('libresign', 'Identification factors'),
+	context: t('libresign', 'Identity matrix'),
+	description: t('libresign', 'Configure which factors identify signers and how each factor maps to signature methods.'),
+	editor: IdentifyFactorsRuleEditor,
+	createEmptyValue: () => ({
+		enabled: true,
+		requireAnyTwo: false,
+		factors: [
+			{
+				key: 'email',
+				label: t('libresign', 'Email'),
+				enabled: true,
+				required: true,
+				allowCreateAccount: true,
+				signatureMethod: 'email_token',
+			},
+			{
+				key: 'sms',
+				label: t('libresign', 'SMS'),
+				enabled: false,
+				required: false,
+				allowCreateAccount: false,
+				signatureMethod: 'sms_token',
+			},
+			{
+				key: 'whatsapp',
+				label: t('libresign', 'WhatsApp'),
+				enabled: false,
+				required: false,
+				allowCreateAccount: false,
+				signatureMethod: 'whatsapp_token',
+			},
+			{
+				key: 'document',
+				label: t('libresign', 'Document data'),
+				enabled: false,
+				required: false,
+				allowCreateAccount: false,
+				signatureMethod: 'document_validation',
+			},
+		],
+	}),
+	summarizeValue: (value) => {
+		if (!value.enabled) {
+			return t('libresign', 'Disabled')
+		}
+
+		const enabledCount = value.factors.filter((factor) => factor.enabled).length
+		const strategy = value.requireAnyTwo
+			? t('libresign', 'any two')
+			: t('libresign', 'single factor')
+		return `${enabledCount} ${t('libresign', 'factors enabled')} - ${strategy}`
+	},
+	formatAllowOverride: (allowChildOverride) => allowChildOverride
+		? t('libresign', 'Lower layers may override this rule')
+		: t('libresign', 'Lower layers must inherit this value'),
+}
diff --git a/src/views/Settings/PolicyWorkbench/settings/realDefinitions.ts b/src/views/Settings/PolicyWorkbench/settings/realDefinitions.ts
new file mode 100644
index 0000000000..ba65d6ccf9
--- /dev/null
+++ b/src/views/Settings/PolicyWorkbench/settings/realDefinitions.ts
@@ -0,0 +1,15 @@
+/**
+ * SPDX-FileCopyrightText: 2026 LibreCode coop and LibreCode contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+import { docMdpRealDefinition } from './docmdp/realDefinition'
+import { signatureFooterRealDefinition } from './signature-footer/realDefinition'
+import { signatureFlowRealDefinition } from './signature-flow/realDefinition'
+import type { RealPolicySettingDefinition } from './realTypes'
+
+export const realDefinitions = {
+	add_footer: signatureFooterRealDefinition,
+	signature_flow: signatureFlowRealDefinition,
+	docmdp: docMdpRealDefinition,
+} satisfies Record<string, RealPolicySettingDefinition>
diff --git a/src/views/Settings/PolicyWorkbench/settings/realTypes.ts b/src/views/Settings/PolicyWorkbench/settings/realTypes.ts
new file mode 100644
index 0000000000..8b56008c73
--- /dev/null
+++ b/src/views/Settings/PolicyWorkbench/settings/realTypes.ts
@@ -0,0 +1,27 @@
+/**
+ * SPDX-FileCopyrightText: 2026 LibreCode coop and LibreCode contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+import type { EffectivePolicyValue } from '../../../../types/index'
+
+export type RealPolicyScope = 'system' | 'group' | 'user'
+export type RealPolicyResolutionMode = 'precedence' | 'merge' | 'conflict_requires_selection'
+export type RealPolicyEditorDialogLayout = 'default' | 'wide'
+
+export interface RealPolicySettingDefinition {
+	key: string
+	title: string
+	context?: string
+	description: string
+	editor: unknown
+	editorDialogLayout?: RealPolicyEditorDialogLayout
+	resolutionMode: RealPolicyResolutionMode
+	createEmptyValue: () => EffectivePolicyValue
+	normalizeDraftValue: (value: EffectivePolicyValue) => EffectivePolicyValue
+	hasSelectableDraftValue: (value: EffectivePolicyValue) => boolean
+	normalizeAllowChildOverride: (scope: RealPolicyScope, allowChildOverride: boolean) => boolean
+	getFallbackSystemDefault: (policyValue: EffectivePolicyValue | null | undefined, sourceScope?: string | null) => EffectivePolicyValue
+	summarizeValue: (value: EffectivePolicyValue) => string
+	formatAllowOverride: (allowChildOverride: boolean) => string
+}
diff --git a/src/views/Settings/PolicyWorkbench/settings/signature-flow/SignatureFlowRuleEditor.vue b/src/views/Settings/PolicyWorkbench/settings/signature-flow/SignatureFlowRuleEditor.vue
new file mode 100644
index 0000000000..be05cf9220
--- /dev/null
+++ b/src/views/Settings/PolicyWorkbench/settings/signature-flow/SignatureFlowRuleEditor.vue
@@ -0,0 +1,101 @@
+<!--
+  - SPDX-FileCopyrightText: 2026 LibreCode coop and LibreCode contributors
+  - SPDX-License-Identifier: AGPL-3.0-or-later
+-->
+
+<template>
+	<div class="signature-flow-rule-editor">
+		<NcCheckboxRadioSwitch
+			type="switch"
+			:model-value="modelValue.enabled"
+			@update:modelValue="onEnabledChange">
+			<span>{{ t('libresign', 'Enable a signing order override for this target') }}</span>
+		</NcCheckboxRadioSwitch>
+
+		<div v-if="modelValue.enabled" class="signature-flow-rule-editor__options">
+			<NcCheckboxRadioSwitch
+				v-for="flow in flows"
+				:key="flow.value"
+				type="radio"
+				:model-value="modelValue.flow === flow.value"
+				name="signature-flow-rule-editor"
+				@update:modelValue="onFlowChange(flow.value)">
+				<div class="signature-flow-rule-editor__copy">
+					<strong>{{ flow.label }}</strong>
+					<p>{{ flow.description }}</p>
+				</div>
+			</NcCheckboxRadioSwitch>
+		</div>
+	</div>
+</template>
+
+<script setup lang="ts">
+import { t } from '@nextcloud/l10n'
+
+import NcCheckboxRadioSwitch from '@nextcloud/vue/components/NcCheckboxRadioSwitch'
+
+import type { SignatureFlowMode, SignatureFlowRuleValue } from '../../types'
+
+defineOptions({
+	name: 'SignatureFlowRuleEditor',
+})
+
+const props = defineProps<{
+	modelValue: SignatureFlowRuleValue
+}>()
+
+const emit = defineEmits<{
+	'update:modelValue': [value: SignatureFlowRuleValue]
+}>()
+
+const flows: Array<{ value: SignatureFlowMode, label: string, description: string }> = [
+	{
+		value: 'parallel',
+		label: t('libresign', 'Simultaneous (Parallel)'),
+		description: t('libresign', 'All signers receive the document at the same time and can sign in any order.'),
+	},
+	{
+		value: 'ordered_numeric',
+		label: t('libresign', 'Sequential'),
+		description: t('libresign', 'Signers are organized by signing order number. Only those with the lowest pending order number can sign.'),
+	},
+]
+
+function updateValue(nextValue: Partial<SignatureFlowRuleValue>) {
+	emit('update:modelValue', {
+		...props.modelValue,
+		...nextValue,
+	})
+}
+
+function onEnabledChange(enabled: boolean) {
+	updateValue({
+		enabled,
+	})
+}
+
+function onFlowChange(flow: SignatureFlowMode) {
+	updateValue({
+		flow,
+	})
+}
+</script>
+
+<style scoped lang="scss">
+.signature-flow-rule-editor {
+	display: flex;
+	flex-direction: column;
+	gap: 1rem;
+
+	&__options {
+		display: flex;
+		flex-direction: column;
+		gap: 0.75rem;
+	}
+
+	&__copy p {
+		margin: 0.35rem 0 0;
+		color: var(--color-text-maxcontrast);
+	}
+}
+</style>
diff --git a/src/views/Settings/PolicyWorkbench/settings/signature-flow/SignatureFlowScalarRuleEditor.vue b/src/views/Settings/PolicyWorkbench/settings/signature-flow/SignatureFlowScalarRuleEditor.vue
new file mode 100644
index 0000000000..56a623baa1
--- /dev/null
+++ b/src/views/Settings/PolicyWorkbench/settings/signature-flow/SignatureFlowScalarRuleEditor.vue
@@ -0,0 +1,148 @@
+<!--
+  - SPDX-FileCopyrightText: 2026 LibreCode coop and LibreCode contributors
+  - SPDX-License-Identifier: AGPL-3.0-or-later
+-->
+
+<template>
+	<div class="signature-flow-scalar-editor">
+		<div class="signature-flow-scalar-editor__options">
+			<NcCheckboxRadioSwitch
+				v-for="flow in flows"
+				:key="flow.value"
+				class="signature-flow-scalar-editor__option"
+				type="radio"
+				:disabled="flow.disabled"
+				:model-value="normalizedValue === flow.value"
+				name="signature-flow-scalar-editor"
+				@update:modelValue="onFlowChange(flow.value, flow.disabled, $event)">
+				<div class="signature-flow-scalar-editor__copy">
+					<strong>{{ flow.label }}</strong>
+					<p>{{ flow.description }}</p>
+				</div>
+			</NcCheckboxRadioSwitch>
+		</div>
+		<p v-if="isInstanceCreateMode" class="signature-flow-scalar-editor__hint">
+			{{ t('libresign', 'To create a rule for everyone, choose Simultaneous or Sequential. "User choice" already matches the default and is not saved as a custom rule.') }}
+		</p>
+	</div>
+</template>
+
+<script setup lang="ts">
+import { computed } from 'vue'
+import { t } from '@nextcloud/l10n'
+
+import NcCheckboxRadioSwitch from '@nextcloud/vue/components/NcCheckboxRadioSwitch'
+import type { EffectivePolicyValue, SignatureFlowMode } from '../../../../../types/index'
+
+defineOptions({
+	name: 'SignatureFlowScalarRuleEditor',
+})
+
+const props = defineProps<{
+	modelValue: EffectivePolicyValue
+	editorScope?: 'system' | 'group' | 'user'
+	editorMode?: 'create' | 'edit' | null
+}>()
+
+const emit = defineEmits<{
+	'update:modelValue': [value: EffectivePolicyValue]
+}>()
+
+const baseFlows: Array<{ value: SignatureFlowMode | 'none', label: string, description: string }> = [
+	{
+		value: 'parallel',
+		label: t('libresign', 'Simultaneous (Parallel)'),
+		description: t('libresign', 'All signers receive the document at the same time and can sign in any order.'),
+	},
+	{
+		value: 'ordered_numeric',
+		label: t('libresign', 'Sequential'),
+		description: t('libresign', 'Signers follow a defined order. Only the next signer can proceed.'),
+	},
+	{
+		value: 'none',
+		label: t('libresign', 'User choice'),
+		description: t('libresign', 'Users can choose between simultaneous or sequential signing.'),
+	},
+]
+
+const isInstanceCreateMode = computed(() => {
+	return props.editorScope === 'system' && props.editorMode === 'create'
+})
+
+const flows = computed(() => {
+	return baseFlows.map((flow) => {
+		if (flow.value === 'none' && isInstanceCreateMode.value) {
+			return {
+				...flow,
+				disabled: true,
+				description: t('libresign', 'Already the default for this setting. Choose another option to create an explicit custom rule.'),
+			}
+		}
+
+		return {
+			...flow,
+			disabled: false,
+		}
+	})
+})
+
+const normalizedValue = computed<SignatureFlowMode | 'none' | null>(() => {
+	const value = props.modelValue
+	if (value === 'parallel' || value === 'ordered_numeric' || value === 'none') {
+		return value
+	}
+
+	return null
+})
+
+function onFlowChange(flow: SignatureFlowMode | 'none', disabled: boolean, selected?: unknown) {
+	if (disabled || selected === false) {
+		return
+	}
+
+	emit('update:modelValue', flow)
+}
+</script>
+
+<style scoped lang="scss">
+.signature-flow-scalar-editor {
+	display: flex;
+	flex-direction: column;
+	gap: 1rem;
+
+	&__options {
+		display: flex;
+		flex-direction: column;
+		gap: 0.75rem;
+	}
+
+	&__option {
+		width: 100%;
+	}
+
+	&__copy p {
+		margin: 0.35rem 0 0;
+		color: var(--color-text-maxcontrast);
+	}
+
+	&__hint {
+		margin: 0;
+		font-size: 0.84rem;
+		color: var(--color-text-maxcontrast);
+	}
+
+	:deep(.signature-flow-scalar-editor__option.checkbox-radio-switch) {
+		width: 100%;
+	}
+
+	:deep(.signature-flow-scalar-editor__option .checkbox-radio-switch__content) {
+		width: 100%;
+		max-width: none;
+	}
+
+	:deep(.signature-flow-scalar-editor__option.checkbox-radio-switch--checked:focus-within .checkbox-radio-switch__content) {
+		background-color: transparent;
+	}
+}
+</style>
diff --git a/src/views/Settings/PolicyWorkbench/settings/signature-flow/index.ts b/src/views/Settings/PolicyWorkbench/settings/signature-flow/index.ts
new file mode 100644
index 0000000000..d2e0af65f2
--- /dev/null
+++ b/src/views/Settings/PolicyWorkbench/settings/signature-flow/index.ts
@@ -0,0 +1,33 @@
+/**
+ * SPDX-FileCopyrightText: 2026 LibreCode coop and LibreCode contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+import { t } from '@nextcloud/l10n'
+
+import SignatureFlowRuleEditor from './SignatureFlowRuleEditor.vue'
+import type { PolicySettingDefinition } from '../../types'
+
+export const signatureFlowDefinition: PolicySettingDefinition<'signature_flow'> = {
+	key: 'signature_flow',
+	title: t('libresign', 'Signing order'),
+	context: t('libresign', 'SignatureFlow'),
+	description: t('libresign', 'Define how signers receive and process the signature request.'),
+	editor: SignatureFlowRuleEditor,
+	createEmptyValue: () => ({
+		enabled: true,
+		flow: 'parallel',
+	}),
+	summarizeValue: (value) => {
+		if (!value.enabled) {
+			return t('libresign', 'User choice')
+		}
+
+		return value.flow === 'parallel'
+			? t('libresign', 'Parallel')
+			: t('libresign', 'Sequential')
+	},
+	formatAllowOverride: (allowChildOverride) => allowChildOverride
+		? t('libresign', 'Groups and users can set their own rule')
+		: t('libresign', 'Groups and users must follow this value'),
+}
diff --git a/src/views/Settings/PolicyWorkbench/settings/signature-flow/realDefinition.ts b/src/views/Settings/PolicyWorkbench/settings/signature-flow/realDefinition.ts
new file mode 100644
index 0000000000..2b62ddbb24
--- /dev/null
+++ b/src/views/Settings/PolicyWorkbench/settings/signature-flow/realDefinition.ts
@@ -0,0 +1,84 @@
+/**
+ * SPDX-FileCopyrightText: 2026 LibreCode coop and LibreCode contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+import { t } from '@nextcloud/l10n'
+
+import SignatureFlowScalarRuleEditor from './SignatureFlowScalarRuleEditor.vue'
+import type { EffectivePolicyValue } from '../../../../../types/index'
+import type { RealPolicySettingDefinition } from '../realTypes'
+
+export function resolveSignatureFlowMode(value: EffectivePolicyValue): string | null {
+	if (value === 0) {
+		return 'none'
+	}
+
+	if (value === 1) {
+		return 'parallel'
+	}
+
+	if (value === 2) {
+		return 'ordered_numeric'
+	}
+
+	if (typeof value === 'string') {
+		if (value === 'parallel' || value === 'ordered_numeric' || value === 'none') {
+			return value
+		}
+
+		return null
+	}
+
+	if (value && typeof value === 'object' && 'flow' in (value as Record<string, unknown>)) {
+		const candidate = (value as { flow?: unknown }).flow
+		return typeof candidate === 'string' ? candidate : null
+	}
+
+	return null
+}
+
+export const signatureFlowRealDefinition: RealPolicySettingDefinition = {
+	key: 'signature_flow',
+	title: t('libresign', 'Signing order'),
+	description: t('libresign', 'Choose whether documents are signed in order or all at once.'),
+	editor: SignatureFlowScalarRuleEditor,
+	resolutionMode: 'precedence',
+	createEmptyValue: () => '' as unknown as EffectivePolicyValue,
+	normalizeDraftValue: (value: EffectivePolicyValue) => {
+		const mode = resolveSignatureFlowMode(value)
+		return mode ?? 'parallel'
+	},
+	hasSelectableDraftValue: (value: EffectivePolicyValue) => resolveSignatureFlowMode(value) !== null,
+	normalizeAllowChildOverride: (scope, allowChildOverride: boolean) => {
+		if (scope === 'system' || scope === 'group') {
+			return false
+		}
+
+		return allowChildOverride
+	},
+	getFallbackSystemDefault: (policyValue: EffectivePolicyValue | null | undefined, sourceScope?: string | null) => {
+		if (sourceScope === 'system' && policyValue !== null && policyValue !== undefined) {
+			return policyValue
+		}
+
+		return 'none'
+	},
+	summarizeValue: (value: EffectivePolicyValue) => {
+		const flowValue = resolveSignatureFlowMode(value)
+		switch (flowValue) {
+		case 'parallel':
+			return t('libresign', 'Simultaneous (Parallel)')
+		case 'ordered_numeric':
+			return t('libresign', 'Sequential')
+		case 'none':
+			return t('libresign', 'User choice')
+		default:
+			return t('libresign', 'Not configured')
+		}
+	},
+	formatAllowOverride: (allowChildOverride: boolean) =>
+		allowChildOverride
+			? t('libresign', 'Groups and users can set their own rule')
+			: t('libresign', 'Groups and users must follow this value'),
+}
diff --git a/src/views/Settings/PolicyWorkbench/settings/signature-footer/SignatureFooterRuleEditor.vue b/src/views/Settings/PolicyWorkbench/settings/signature-footer/SignatureFooterRuleEditor.vue
new file mode 100644
index 0000000000..888d5c20e9
--- /dev/null
+++ b/src/views/Settings/PolicyWorkbench/settings/signature-footer/SignatureFooterRuleEditor.vue
@@ -0,0 +1,153 @@
+<!--
+  - SPDX-FileCopyrightText: 2026 LibreCode coop and LibreCode contributors
+  - SPDX-License-Identifier: AGPL-3.0-or-later
+-->
+
+<template>
+	<div class="signature-footer-rule-editor">
+		<NcCheckboxRadioSwitch
+			type="switch"
+			:model-value="value.enabled"
+			@update:modelValue="onEnabledChange">
+			<span>{{ t('libresign', 'Add visible footer with signature details') }}</span>
+		</NcCheckboxRadioSwitch>
+
+		<div v-if="value.enabled" class="signature-footer-rule-editor__nested">
+			<NcCheckboxRadioSwitch
+				type="switch"
+				:model-value="value.writeQrcodeOnFooter"
+				@update:modelValue="onWriteQrcodeChange">
+				<span>{{ t('libresign', 'Write QR code on footer with validation URL') }}</span>
+			</NcCheckboxRadioSwitch>
+
+			<div v-if="value.writeQrcodeOnFooter" class="signature-footer-rule-editor__field">
+				<p class="signature-footer-rule-editor__hint">
+					{{ t('libresign', 'To validate the signature of the documents. Only change this value if you want to replace the default validation URL with a different one.') }}
+				</p>
+				<NcTextField
+					:model-value="value.validationSite"
+					:label="t('libresign', 'Validation URL')"
+					:placeholder="t('libresign', 'Use instance default validation URL')"
+					@update:modelValue="onValidationSiteChange" />
+			</div>
+
+			<NcCheckboxRadioSwitch
+				type="switch"
+				:model-value="value.customizeFooterTemplate"
+				@update:modelValue="onCustomizeFooterTemplateChange">
+				<span>{{ t('libresign', 'Customize footer template') }}</span>
+			</NcCheckboxRadioSwitch>
+
+			<FooterTemplateEditor
+				v-if="value.customizeFooterTemplate"
+				ref="footerTemplateEditor"
+				@template-reset="onTemplateReset" />
+		</div>
+	</div>
+</template>
+
+<script setup lang="ts">
+import { computed, ref } from 'vue'
+import { t } from '@nextcloud/l10n'
+
+import NcCheckboxRadioSwitch from '@nextcloud/vue/components/NcCheckboxRadioSwitch'
+import NcTextField from '@nextcloud/vue/components/NcTextField'
+
+import FooterTemplateEditor from '../../../../../components/FooterTemplateEditor.vue'
+import type { EffectivePolicyValue } from '../../../../../types/index'
+import {
+	normalizeSignatureFooterPolicyConfig,
+	serializeSignatureFooterPolicyConfig,
+	type SignatureFooterPolicyConfig,
+} from './model'
+
+defineOptions({
+	name: 'SignatureFooterRuleEditor',
+})
+
+type FooterTemplateEditorInstance = {
+	resetFooterTemplate: () => Promise<void> | void
+}
+
+const props = defineProps<{
+	modelValue: EffectivePolicyValue
+}>()
+
+const emit = defineEmits<{
+	'update:modelValue': [value: EffectivePolicyValue]
+}>()
+
+const footerTemplateEditor = ref<FooterTemplateEditorInstance | null>(null)
+
+const value = computed<SignatureFooterPolicyConfig>(() => {
+	return normalizeSignatureFooterPolicyConfig(props.modelValue)
+})
+
+function updateValue(partial: Partial<SignatureFooterPolicyConfig>) {
+	const nextValue = {
+		...value.value,
+		...partial,
+	}
+
+	emit('update:modelValue', serializeSignatureFooterPolicyConfig(nextValue))
+}
+
+function onEnabledChange(enabled: boolean) {
+	if (!enabled) {
+		updateValue({
+			enabled,
+			writeQrcodeOnFooter: false,
+		})
+		return
+	}
+
+	updateValue({ enabled })
+}
+
+function onWriteQrcodeChange(writeQrcodeOnFooter: boolean) {
+	updateValue({ writeQrcodeOnFooter })
+}
+
+function onValidationSiteChange(validationSite: string | number) {
+	updateValue({ validationSite: String(validationSite).trim() })
+}
+
+async function onCustomizeFooterTemplateChange(customizeFooterTemplate: boolean) {
+	updateValue({ customizeFooterTemplate })
+	if (!customizeFooterTemplate) {
+		await footerTemplateEditor.value?.resetFooterTemplate()
+	}
+}
+
+function onTemplateReset() {
+	updateValue({ customizeFooterTemplate: false })
+}
+</script>
+
+<style scoped lang="scss">
+.signature-footer-rule-editor {
+	display: flex;
+	flex-direction: column;
+	gap: 0.9rem;
+
+	&__nested {
+		display: flex;
+		flex-direction: column;
+		gap: 0.9rem;
+		padding-inline-start: 0.45rem;
+		border-inline-start: 2px solid var(--color-border-maxcontrast);
+	}
+
+	&__field {
+		display: flex;
+		flex-direction: column;
+		gap: 0.4rem;
+	}
+
+	&__hint {
+		margin: 0;
+		font-size: 0.9rem;
+		color: var(--color-text-maxcontrast);
+	}
+}
+</style>
diff --git a/src/views/Settings/PolicyWorkbench/settings/signature-footer/model.ts b/src/views/Settings/PolicyWorkbench/settings/signature-footer/model.ts
new file mode 100644
index 0000000000..945399548e
--- /dev/null
+++ b/src/views/Settings/PolicyWorkbench/settings/signature-footer/model.ts
@@ -0,0 +1,111 @@
+/**
+ * SPDX-FileCopyrightText: 2026 LibreCode coop and LibreCode contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+import type { EffectivePolicyValue } from '../../../../../types/index'
+
+export type SignatureFooterPolicyConfig = {
+	enabled: boolean
+	writeQrcodeOnFooter: boolean
+	validationSite: string
+	customizeFooterTemplate: boolean
+}
+
+export function getDefaultSignatureFooterPolicyConfig(): SignatureFooterPolicyConfig {
+	return {
+		enabled: true,
+		writeQrcodeOnFooter: true,
+		validationSite: '',
+		customizeFooterTemplate: false,
+	}
+}
+
+function toBoolean(value: unknown, fallback: boolean): boolean {
+	if (typeof value === 'boolean') {
+		return value
+	}
+
+	if (typeof value === 'number') {
+		return value === 1
+	}
+
+	if (typeof value === 'string') {
+		return ['1', 'true', 'yes', 'on'].includes(value.trim().toLowerCase())
+	}
+
+	if (value === null || value === undefined) {
+		return fallback
+	}
+
+	return Boolean(value)
+}
+
+function toStringValue(value: unknown): string {
+	if (typeof value === 'string') {
+		return value.trim()
+	}
+
+	if (typeof value === 'number' || typeof value === 'boolean') {
+		return String(value)
+	}
+
+	return ''
+}
+
+export function normalizeSignatureFooterPolicyConfig(value: EffectivePolicyValue): SignatureFooterPolicyConfig {
+	const defaults = getDefaultSignatureFooterPolicyConfig()
+
+	if (typeof value === 'boolean' || typeof value === 'number') {
+		return {
+			...defaults,
+			enabled: toBoolean(value, defaults.enabled),
+		}
+	}
+
+	if (typeof value === 'string') {
+		const trimmedValue = value.trim()
+		if (trimmedValue === '') {
+			return defaults
+		}
+
+		try {
+			const parsedValue = JSON.parse(trimmedValue) as Record<string, unknown> | string | number | boolean | null
+			if (parsedValue && typeof parsedValue === 'object') {
+				return {
+					enabled: toBoolean(parsedValue.enabled ?? parsedValue.addFooter, defaults.enabled),
+					writeQrcodeOnFooter: toBoolean(parsedValue.writeQrcodeOnFooter ?? parsedValue.write_qrcode_on_footer, defaults.writeQrcodeOnFooter),
+					validationSite: toStringValue(parsedValue.validationSite ?? parsedValue.validation_site),
+					customizeFooterTemplate: toBoolean(parsedValue.customizeFooterTemplate ?? parsedValue.customize_footer_template, defaults.customizeFooterTemplate),
+				}
+			}
+
+			if (typeof parsedValue === 'boolean' || typeof parsedValue === 'number' || typeof parsedValue === 'string') {
+				return {
+					...defaults,
+					enabled: toBoolean(parsedValue, defaults.enabled),
+				}
+			}
+		} catch {
+			return {
+				...defaults,
+				enabled: toBoolean(trimmedValue, defaults.enabled),
+			}
+		}
+
+		return defaults
+	}
+
+	return defaults
+}
+
+export function serializeSignatureFooterPolicyConfig(value: SignatureFooterPolicyConfig): EffectivePolicyValue {
+	const normalizedValue: SignatureFooterPolicyConfig = {
+		enabled: toBoolean(value.enabled, true),
+		writeQrcodeOnFooter: toBoolean(value.writeQrcodeOnFooter, true),
+		validationSite: toStringValue(value.validationSite),
+		customizeFooterTemplate: toBoolean(value.customizeFooterTemplate, false),
+	}
+
+	return JSON.stringify(normalizedValue)
+}
diff --git a/src/views/Settings/PolicyWorkbench/settings/signature-footer/realDefinition.ts b/src/views/Settings/PolicyWorkbench/settings/signature-footer/realDefinition.ts
new file mode 100644
index 0000000000..973617a850
--- /dev/null
+++ b/src/views/Settings/PolicyWorkbench/settings/signature-footer/realDefinition.ts
@@ -0,0 +1,58 @@
+/**
+ * SPDX-FileCopyrightText: 2026 LibreCode coop and LibreCode contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+import { t } from '@nextcloud/l10n'
+
+import type { EffectivePolicyValue } from '../../../../../types/index'
+import type { RealPolicySettingDefinition } from '../realTypes'
+import SignatureFooterRuleEditor from './SignatureFooterRuleEditor.vue'
+import {
+	getDefaultSignatureFooterPolicyConfig,
+	normalizeSignatureFooterPolicyConfig,
+	serializeSignatureFooterPolicyConfig,
+} from './model'
+
+export const signatureFooterRealDefinition: RealPolicySettingDefinition = {
+	key: 'add_footer',
+	title: t('libresign', 'Signature footer'),
+	description: t('libresign', 'Manage footer visibility, QR code behavior, validation URL, and footer template customization.'),
+	editor: SignatureFooterRuleEditor,
+	editorDialogLayout: 'wide',
+	resolutionMode: 'precedence',
+	createEmptyValue: () => serializeSignatureFooterPolicyConfig(getDefaultSignatureFooterPolicyConfig()),
+	normalizeDraftValue: (value: EffectivePolicyValue) => {
+		return serializeSignatureFooterPolicyConfig(normalizeSignatureFooterPolicyConfig(value))
+	},
+	hasSelectableDraftValue: () => true,
+	normalizeAllowChildOverride: (_scope, allowChildOverride: boolean) => allowChildOverride,
+	getFallbackSystemDefault: (policyValue: EffectivePolicyValue | null | undefined, sourceScope?: string | null) => {
+		if (sourceScope === 'system' && policyValue !== null && policyValue !== undefined) {
+			return policyValue
+		}
+
+		return serializeSignatureFooterPolicyConfig(getDefaultSignatureFooterPolicyConfig())
+	},
+	summarizeValue: (value: EffectivePolicyValue) => {
+		const normalized = normalizeSignatureFooterPolicyConfig(value)
+		if (!normalized.enabled) {
+			return t('libresign', 'Disabled')
+		}
+
+		const summary: string[] = [t('libresign', 'Enabled')]
+		summary.push(normalized.writeQrcodeOnFooter ? t('libresign', 'QR code on') : t('libresign', 'QR code off'))
+		if (normalized.validationSite) {
+			summary.push(t('libresign', 'Custom URL'))
+		}
+		if (normalized.customizeFooterTemplate) {
+			summary.push(t('libresign', 'Custom template'))
+		}
+
+		return summary.join(' • ')
+	},
+	formatAllowOverride: (allowChildOverride: boolean) =>
+		allowChildOverride
+			? t('libresign', 'Groups and users can set their own rule')
+			: t('libresign', 'Groups and users must follow this value'),
+}
diff --git a/src/views/Settings/PolicyWorkbench/settings/signature-stamp/SignatureStampRuleEditor.vue b/src/views/Settings/PolicyWorkbench/settings/signature-stamp/SignatureStampRuleEditor.vue
new file mode 100644
index 0000000000..cd60c97e14
--- /dev/null
+++ b/src/views/Settings/PolicyWorkbench/settings/signature-stamp/SignatureStampRuleEditor.vue
@@ -0,0 +1,429 @@
+<!--
+  - SPDX-FileCopyrightText: 2026 LibreCode coop and LibreCode contributors
+  - SPDX-License-Identifier: AGPL-3.0-or-later
+-->
+
+<template>
+	<div class="signature-stamp-rule-editor">
+		<NcCheckboxRadioSwitch
+			type="switch"
+			:model-value="modelValue.enabled"
+			@update:modelValue="onEnabledChange">
+			<span>{{ t('libresign', 'Enable visible signature stamp') }}</span>
+		</NcCheckboxRadioSwitch>
+
+		<div v-if="modelValue.enabled" class="signature-stamp-rule-editor__grid">
+			<div class="signature-stamp-rule-editor__presets">
+				<p class="signature-stamp-rule-editor__presets-title">{{ t('libresign', 'Quick presets') }}</p>
+				<div class="signature-stamp-rule-editor__preset-actions">
+					<NcButton
+						v-for="preset in presets"
+						:key="preset.id"
+						variant="secondary"
+						:aria-label="t('libresign', 'Apply preset')"
+						@click="applyPreset(preset.id)">
+						{{ preset.label }}
+					</NcButton>
+				</div>
+			</div>
+
+			<fieldset class="signature-stamp-rule-editor__fieldset">
+				<legend>{{ t('libresign', 'Render mode') }}</legend>
+				<NcCheckboxRadioSwitch
+					v-for="renderModeOption in renderModeOptions"
+					:key="renderModeOption.value"
+					type="radio"
+					name="stamp-render-mode"
+					:model-value="modelValue.renderMode === renderModeOption.value"
+					@update:modelValue="onRenderModeChange(renderModeOption.value)">
+					<div class="signature-stamp-rule-editor__copy">
+						<strong>{{ renderModeOption.label }}</strong>
+						<p>{{ renderModeOption.description }}</p>
+					</div>
+				</NcCheckboxRadioSwitch>
+			</fieldset>
+
+			<fieldset class="signature-stamp-rule-editor__fieldset">
+				<legend>{{ t('libresign', 'Background mode') }}</legend>
+				<NcCheckboxRadioSwitch
+					v-for="backgroundModeOption in backgroundModeOptions"
+					:key="backgroundModeOption.value"
+					type="radio"
+					name="stamp-background-mode"
+					:model-value="modelValue.backgroundMode === backgroundModeOption.value"
+					@update:modelValue="onBackgroundModeChange(backgroundModeOption.value)">
+					{{ backgroundModeOption.label }}
+				</NcCheckboxRadioSwitch>
+			</fieldset>
+
+			<div class="signature-stamp-rule-editor__field">
+				<label class="signature-stamp-rule-editor__label" for="signature-stamp-template">
+					{{ t('libresign', 'Template text') }}
+				</label>
+				<textarea
+					id="signature-stamp-template"
+					class="signature-stamp-rule-editor__textarea"
+					:value="modelValue.template"
+					@input="onTemplateChange" />
+				<div class="signature-stamp-rule-editor__variables">
+					<span>{{ t('libresign', 'Insert variable:') }}</span>
+					<NcButton
+						v-for="stampVariable in stampVariables"
+						:key="stampVariable"
+						variant="tertiary"
+						:aria-label="t('libresign', 'Insert variable into template')"
+						@click="insertVariable(stampVariable)">
+						{{ stampVariable }}
+					</NcButton>
+				</div>
+				<p class="signature-stamp-rule-editor__meta">
+					{{ t('libresign', 'Template length: {count} characters', {
+						count: String(templateLength),
+					}) }}
+				</p>
+			</div>
+
+			<div class="signature-stamp-rule-editor__dimensions">
+				<NcTextField
+					:model-value="String(modelValue.templateFontSize)"
+					:label="t('libresign', 'Template font size')"
+					type="number"
+					:min="8"
+					:max="48"
+					:step="1"
+					@update:modelValue="onNumberChange('templateFontSize', $event, 8, 48)" />
+				<NcTextField
+					:model-value="String(modelValue.signatureFontSize)"
+					:label="t('libresign', 'Signature font size')"
+					type="number"
+					:min="8"
+					:max="48"
+					:step="1"
+					@update:modelValue="onNumberChange('signatureFontSize', $event, 8, 48)" />
+				<NcTextField
+					:model-value="String(modelValue.signatureWidth)"
+					:label="t('libresign', 'Default width')"
+					type="number"
+					:min="120"
+					:max="800"
+					:step="10"
+					@update:modelValue="onNumberChange('signatureWidth', $event, 120, 800)" />
+				<NcTextField
+					:model-value="String(modelValue.signatureHeight)"
+					:label="t('libresign', 'Default height')"
+					type="number"
+					:min="40"
+					:max="320"
+					:step="10"
+					@update:modelValue="onNumberChange('signatureHeight', $event, 40, 320)" />
+			</div>
+
+			<NcCheckboxRadioSwitch
+				type="switch"
+				:model-value="modelValue.showSigningDate"
+				@update:modelValue="onSigningDateChange">
+				<span>{{ t('libresign', 'Show signing date in the stamp') }}</span>
+			</NcCheckboxRadioSwitch>
+
+			<NcNoteCard v-if="isTemplateTooLong" type="warning">
+				{{ t('libresign', 'This template is long and can overflow small signature boxes. Consider fewer variables or a larger width.') }}
+			</NcNoteCard>
+
+			<NcNoteCard v-if="isExtremeRatio" type="warning">
+				{{ t('libresign', 'Current width and height ratio is extreme. This may reduce readability on mobile and PDF preview.') }}
+			</NcNoteCard>
+
+			<div class="signature-stamp-rule-editor__preview">
+				<p class="signature-stamp-rule-editor__preview-title">{{ t('libresign', 'Preview summary') }}</p>
+				<p>{{ previewSummary }}</p>
+			</div>
+		</div>
+	</div>
+</template>
+
+<script setup lang="ts">
+import { computed } from 'vue'
+import { t } from '@nextcloud/l10n'
+
+import NcButton from '@nextcloud/vue/components/NcButton'
+import NcCheckboxRadioSwitch from '@nextcloud/vue/components/NcCheckboxRadioSwitch'
+import NcNoteCard from '@nextcloud/vue/components/NcNoteCard'
+import NcTextField from '@nextcloud/vue/components/NcTextField'
+
+import type { SignatureStampBackgroundMode, SignatureStampRenderMode, SignatureStampRuleValue } from '../../types'
+
+defineOptions({
+	name: 'SignatureStampRuleEditor',
+})
+
+const props = defineProps<{
+	modelValue: SignatureStampRuleValue
+}>()
+
+const emit = defineEmits<{
+	'update:modelValue': [value: SignatureStampRuleValue]
+}>()
+
+const renderModeOptions: Array<{ value: SignatureStampRenderMode, label: string, description: string }> = [
+	{
+		value: 'GRAPHIC_AND_DESCRIPTION',
+		label: t('libresign', 'Signature and description'),
+		description: t('libresign', 'Shows signature image and textual context side by side.'),
+	},
+	{
+		value: 'DESCRIPTION_ONLY',
+		label: t('libresign', 'Description only'),
+		description: t('libresign', 'Useful when a visual mark is not required, only the contextual text.'),
+	},
+	{
+		value: 'SIGNAME_AND_DESCRIPTION',
+		label: t('libresign', 'Signer name and description'),
+		description: t('libresign', 'Renders signer name in place of the graphic signature image.'),
+	},
+	{
+		value: 'GRAPHIC_ONLY',
+		label: t('libresign', 'Signature only'),
+		description: t('libresign', 'Uses only the signature image area without description text.'),
+	},
+]
+
+const backgroundModeOptions: Array<{ value: SignatureStampBackgroundMode, label: string }> = [
+	{ value: 'default', label: t('libresign', 'Default background') },
+	{ value: 'custom', label: t('libresign', 'Custom background') },
+	{ value: 'none', label: t('libresign', 'No background') },
+]
+
+const stampVariables = ['{{ signer_name }}', '{{ request_uuid }}', '{{ signed_at }}', '{{ organization }}']
+
+const presets: Array<{ id: 'compact' | 'balanced' | 'detailed', label: string }> = [
+	{ id: 'compact', label: t('libresign', 'Compact') },
+	{ id: 'balanced', label: t('libresign', 'Balanced') },
+	{ id: 'detailed', label: t('libresign', 'Detailed') },
+]
+
+const templateLength = computed(() => props.modelValue.template.trim().length)
+const isTemplateTooLong = computed(() => templateLength.value > 180)
+const isExtremeRatio = computed(() => {
+	const ratio = props.modelValue.signatureWidth / Math.max(1, props.modelValue.signatureHeight)
+	return ratio > 5 || ratio < 1.6
+})
+
+const previewSummary = computed(() => {
+	const mode = renderModeOptions.find((item) => item.value === props.modelValue.renderMode)?.label ?? props.modelValue.renderMode
+	const background = backgroundModeOptions.find((item) => item.value === props.modelValue.backgroundMode)?.label ?? props.modelValue.backgroundMode
+	return `${mode} - ${background} - ${props.modelValue.signatureWidth}x${props.modelValue.signatureHeight}px`
+})
+
+function updateValue(nextValue: Partial<SignatureStampRuleValue>) {
+	emit('update:modelValue', {
+		...props.modelValue,
+		...nextValue,
+	})
+}
+
+function onEnabledChange(enabled: boolean) {
+	updateValue({ enabled })
+}
+
+function onRenderModeChange(renderMode: SignatureStampRenderMode) {
+	updateValue({ renderMode })
+}
+
+function onBackgroundModeChange(backgroundMode: SignatureStampBackgroundMode) {
+	updateValue({ backgroundMode })
+}
+
+function onTemplateChange(event: Event) {
+	const target = event.target as HTMLTextAreaElement
+	updateValue({ template: target.value })
+}
+
+function insertVariable(stampVariable: string) {
+	const separator = props.modelValue.template.length > 0 ? ' ' : ''
+	updateValue({
+		template: `${props.modelValue.template}${separator}${stampVariable}`,
+	})
+}
+
+function applyPreset(presetId: 'compact' | 'balanced' | 'detailed') {
+	if (presetId === 'compact') {
+		updateValue({
+			renderMode: 'GRAPHIC_ONLY',
+			templateFontSize: 9,
+			signatureFontSize: 16,
+			signatureWidth: 150,
+			signatureHeight: 60,
+			backgroundMode: 'none',
+			template: '{{ signer_name }}',
+		})
+		return
+	}
+
+	if (presetId === 'detailed') {
+		updateValue({
+			renderMode: 'GRAPHIC_AND_DESCRIPTION',
+			templateFontSize: 11,
+			signatureFontSize: 22,
+			signatureWidth: 260,
+			signatureHeight: 95,
+			backgroundMode: 'custom',
+			template: '{{ signer_name }} - {{ organization }} - {{ signed_at }}',
+		})
+		return
+	}
+
+	updateValue({
+		renderMode: 'GRAPHIC_AND_DESCRIPTION',
+		templateFontSize: 10,
+		signatureFontSize: 19,
+		signatureWidth: 180,
+		signatureHeight: 70,
+		backgroundMode: 'default',
+		template: '{{ signer_name }} - {{ signed_at }}',
+	})
+}
+
+function onSigningDateChange(showSigningDate: boolean) {
+	updateValue({ showSigningDate })
+}
+
+function onNumberChange(
+	field: 'templateFontSize' | 'signatureFontSize' | 'signatureWidth' | 'signatureHeight',
+	rawValue: string | number,
+	min: number,
+	max: number,
+) {
+	const parsed = Number(rawValue)
+	if (!Number.isFinite(parsed)) {
+		return
+	}
+
+	const clamped = Math.min(max, Math.max(min, parsed))
+	updateValue({
+		[field]: clamped,
+	} as Partial<SignatureStampRuleValue>)
+}
+</script>
+
+<style scoped lang="scss">
+.signature-stamp-rule-editor {
+	display: flex;
+	flex-direction: column;
+	gap: 1rem;
+
+	&__grid {
+		display: flex;
+		flex-direction: column;
+		gap: 1rem;
+	}
+
+	&__presets {
+		display: flex;
+		flex-direction: column;
+		gap: 0.5rem;
+		border-radius: 12px;
+		padding: 0.75rem;
+		background: color-mix(in srgb, var(--color-primary-element) 10%, var(--color-main-background));
+	}
+
+	&__presets-title {
+		margin: 0;
+		font-size: 0.86rem;
+		font-weight: 600;
+		text-transform: uppercase;
+		letter-spacing: 0.04em;
+		color: var(--color-text-maxcontrast);
+	}
+
+	&__preset-actions {
+		display: flex;
+		flex-wrap: wrap;
+		gap: 0.5rem;
+	}
+
+	&__fieldset {
+		border: 1px solid var(--color-border-maxcontrast);
+		border-radius: 12px;
+		padding: 0.75rem;
+		display: flex;
+		flex-direction: column;
+		gap: 0.5rem;
+
+		legend {
+			padding: 0 0.35rem;
+			font-weight: 600;
+		}
+	}
+
+	&__copy p {
+		margin: 0.2rem 0 0;
+		color: var(--color-text-maxcontrast);
+	}
+
+	&__field {
+		display: flex;
+		flex-direction: column;
+		gap: 0.5rem;
+	}
+
+	&__label {
+		font-weight: 600;
+	}
+
+	&__textarea {
+		width: 100%;
+		min-height: 110px;
+		border: 1px solid var(--color-border-maxcontrast);
+		border-radius: 10px;
+		padding: 0.6rem;
+		font: inherit;
+		background: var(--color-main-background);
+	}
+
+	&__variables {
+		display: flex;
+		flex-wrap: wrap;
+		gap: 0.5rem;
+		align-items: center;
+	}
+
+	&__meta {
+		margin: 0;
+		font-size: 0.82rem;
+		color: var(--color-text-maxcontrast);
+	}
+
+	&__dimensions {
+		display: grid;
+		grid-template-columns: repeat(2, minmax(0, 1fr));
+		gap: 0.75rem;
+	}
+
+	&__preview {
+		border-radius: 12px;
+		border: 1px dashed color-mix(in srgb, var(--color-primary-element) 45%, var(--color-border-maxcontrast));
+		padding: 0.75rem;
+		background: color-mix(in srgb, var(--color-main-background) 92%, white);
+	}
+
+	&__preview-title {
+		margin: 0 0 0.35rem;
+		font-weight: 600;
+	}
+}
+
+@media (max-width: 640px) {
+	.signature-stamp-rule-editor {
+		&__preset-actions {
+			:deep(.button-vue) {
+				width: 100%;
+				justify-content: center;
+			}
+		}
+
+		&__dimensions {
+			grid-template-columns: 1fr;
+		}
+	}
+}
+</style>
diff --git a/src/views/Settings/PolicyWorkbench/settings/signature-stamp/index.ts b/src/views/Settings/PolicyWorkbench/settings/signature-stamp/index.ts
new file mode 100644
index 0000000000..8959c0ae05
--- /dev/null
+++ b/src/views/Settings/PolicyWorkbench/settings/signature-stamp/index.ts
@@ -0,0 +1,38 @@
+/**
+ * SPDX-FileCopyrightText: 2026 LibreCode coop and LibreCode contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+import { t } from '@nextcloud/l10n'
+
+import SignatureStampRuleEditor from './SignatureStampRuleEditor.vue'
+import type { PolicySettingDefinition } from '../../types'
+
+export const signatureStampDefinition: PolicySettingDefinition<'signature_stamp'> = {
+	key: 'signature_stamp',
+	title: t('libresign', 'Signature stamp'),
+	context: t('libresign', 'Template and rendering'),
+	description: t('libresign', 'Manage the visible signature block, template and dimensions with a richer policy model.'),
+	editor: SignatureStampRuleEditor,
+	createEmptyValue: () => ({
+		enabled: true,
+		renderMode: 'GRAPHIC_AND_DESCRIPTION',
+		template: '{{ signer_name }} - {{ signed_at }}',
+		templateFontSize: 10,
+		signatureFontSize: 20,
+		signatureWidth: 180,
+		signatureHeight: 70,
+		backgroundMode: 'default',
+		showSigningDate: true,
+	}),
+	summarizeValue: (value) => {
+		if (!value.enabled) {
+			return t('libresign', 'Disabled')
+		}
+
+		return `${value.renderMode} - ${value.signatureWidth}x${value.signatureHeight}`
+	},
+	formatAllowOverride: (allowChildOverride) => allowChildOverride
+		? t('libresign', 'Lower layers may override this rule')
+		: t('libresign', 'Lower layers must inherit this value'),
+}
diff --git a/src/views/Settings/PolicyWorkbench/types.ts b/src/views/Settings/PolicyWorkbench/types.ts
new file mode 100644
index 0000000000..71fd23f56e
--- /dev/null
+++ b/src/views/Settings/PolicyWorkbench/types.ts
@@ -0,0 +1,112 @@
+/**
+ * SPDX-FileCopyrightText: 2026 LibreCode coop and LibreCode contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+import type { Component } from 'vue'
+
+export type AdminViewMode = 'system-admin' | 'group-admin'
+export type PolicyScope = 'system' | 'group' | 'user'
+export type PolicySettingKey =
+	| 'signature_flow'
+	| 'confetti'
+	| 'signature_stamp'
+	| 'identify_factors'
+	| 'auto_reminders'
+	| 'request_notifications'
+	| 'document_download_after_sign'
+export type SignatureFlowMode = 'parallel' | 'ordered_numeric'
+export type SignatureStampRenderMode = 'DESCRIPTION_ONLY' | 'GRAPHIC_AND_DESCRIPTION' | 'SIGNAME_AND_DESCRIPTION' | 'GRAPHIC_ONLY'
+export type SignatureStampBackgroundMode = 'default' | 'custom' | 'none'
+export type IdentifyFactorKey = 'email' | 'sms' | 'whatsapp' | 'document'
+export type IdentifyFactorSignatureMethod = 'email_token' | 'sms_token' | 'whatsapp_token' | 'document_validation'
+
+export type SignatureFlowRuleValue = {
+	enabled: boolean
+	flow: SignatureFlowMode
+}
+
+export type ConfettiRuleValue = {
+	enabled: boolean
+}
+
+export type SignatureStampRuleValue = {
+	enabled: boolean
+	renderMode: SignatureStampRenderMode
+	template: string
+	templateFontSize: number
+	signatureFontSize: number
+	signatureWidth: number
+	signatureHeight: number
+	backgroundMode: SignatureStampBackgroundMode
+	showSigningDate: boolean
+}
+
+export type IdentifyFactorOption = {
+	key: IdentifyFactorKey
+	label: string
+	enabled: boolean
+	required: boolean
+	allowCreateAccount: boolean
+	signatureMethod: IdentifyFactorSignatureMethod
+}
+
+export type IdentifyFactorsRuleValue = {
+	enabled: boolean
+	requireAnyTwo: boolean
+	factors: IdentifyFactorOption[]
+}
+
+export type PolicySettingValueMap = {
+	signature_flow: SignatureFlowRuleValue
+	confetti: ConfettiRuleValue
+	signature_stamp: SignatureStampRuleValue
+	identify_factors: IdentifyFactorsRuleValue
+	auto_reminders: ConfettiRuleValue
+	request_notifications: ConfettiRuleValue
+	document_download_after_sign: ConfettiRuleValue
+}
+
+export type PolicyRuleRecord<K extends PolicySettingKey = PolicySettingKey> = {
+	id: string
+	scope: PolicyScope
+	targetId: string | null
+	allowChildOverride: boolean
+	value: PolicySettingValueMap[K]
+}
+
+export type PolicyEditorDraft = {
+	id: string | null
+	settingKey: PolicySettingKey
+	scope: PolicyScope
+	targetId: string | null
+	allowChildOverride: boolean
+	value: PolicySettingValueMap[PolicySettingKey]
+}
+
+export type PolicyTargetOption = {
+	id: string
+	label: string
+	groupId?: string
+}
+
+export type PolicySettingDefinition<K extends PolicySettingKey = PolicySettingKey> = {
+	key: K
+	title: string
+	context?: string
+	description: string
+	editor: Component
+	createEmptyValue: (scope: PolicyScope) => PolicySettingValueMap[K]
+	summarizeValue: (value: PolicySettingValueMap[K]) => string
+	formatAllowOverride: (allowChildOverride: boolean) => string | null
+}
+
+export type PolicySettingSummary = {
+	key: PolicySettingKey
+	title: string
+	context?: string
+	description: string
+	defaultSummary: string
+	groupCount: number
+	userCount: number
+}
diff --git a/src/views/Settings/PolicyWorkbench/usePolicyWorkbench.ts b/src/views/Settings/PolicyWorkbench/usePolicyWorkbench.ts
new file mode 100644
index 0000000000..b6c3e187e6
--- /dev/null
+++ b/src/views/Settings/PolicyWorkbench/usePolicyWorkbench.ts
@@ -0,0 +1,879 @@
+/**
+ * SPDX-FileCopyrightText: 2026 LibreCode coop and LibreCode contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+import { computed, reactive, ref, toRaw } from 'vue'
+import { t } from '@nextcloud/l10n'
+
+import ConfettiRuleEditor from './settings/confetti/ConfettiRuleEditor.vue'
+import { confettiDefinition } from './settings/confetti'
+import { identifyFactorsDefinition } from './settings/identify-factors'
+import { signatureFlowDefinition } from './settings/signature-flow'
+import { signatureStampDefinition } from './settings/signature-stamp'
+import type {
+	AdminViewMode,
+	PolicyEditorDraft,
+	PolicyRuleRecord,
+	PolicyScope,
+	PolicySettingDefinition,
+	PolicySettingKey,
+	PolicySettingSummary,
+	PolicySettingValueMap,
+	PolicyTargetOption,
+} from './types'
+
+type SettingsState = {
+	[K in PolicySettingKey]: PolicyRuleRecord<K>[]
+}
+
+type StartEditorOptions = {
+	scope: PolicyScope
+	ruleId?: string
+}
+
+const CURRENT_GROUP_ID = 'finance'
+
+const groups: PolicyTargetOption[] = [
+	{ id: 'finance', label: 'Financeiro' },
+	{ id: 'legal', label: 'Jurídico' },
+	{ id: 'sales', label: 'Comercial' },
+]
+
+const users: PolicyTargetOption[] = [
+	{ id: 'maria', label: 'Maria Silva', groupId: 'finance' },
+	{ id: 'joao', label: 'João Pereira', groupId: 'finance' },
+	{ id: 'ana', label: 'Ana Carvalho', groupId: 'legal' },
+	{ id: 'bruno', label: 'Bruno Costa', groupId: 'sales' },
+]
+
+const definitions = {
+	signature_flow: signatureFlowDefinition,
+	confetti: confettiDefinition,
+	signature_stamp: signatureStampDefinition,
+	identify_factors: identifyFactorsDefinition,
+	auto_reminders: {
+		key: 'auto_reminders',
+		title: t('libresign', 'Automatic reminders'),
+		context: t('libresign', 'Notification cadence'),
+		description: t('libresign', 'Control whether reminder notifications are automatically sent for pending signers.'),
+		editor: ConfettiRuleEditor,
+		createEmptyValue: () => ({ enabled: true }),
+		summarizeValue: (value) => value.enabled
+			? t('libresign', 'Enabled')
+			: t('libresign', 'Disabled'),
+		formatAllowOverride: (allowChildOverride) => allowChildOverride
+			? t('libresign', 'Lower layers may override this rule')
+			: t('libresign', 'Lower layers must inherit this value'),
+	} satisfies PolicySettingDefinition<'auto_reminders'>,
+	request_notifications: {
+		key: 'request_notifications',
+		title: t('libresign', 'Request notifications'),
+		context: t('libresign', 'Delivery channel'),
+		description: t('libresign', 'Define whether users receive status notifications while a request is in progress.'),
+		editor: ConfettiRuleEditor,
+		createEmptyValue: () => ({ enabled: true }),
+		summarizeValue: (value) => value.enabled
+			? t('libresign', 'Enabled')
+			: t('libresign', 'Disabled'),
+		formatAllowOverride: (allowChildOverride) => allowChildOverride
+			? t('libresign', 'Lower layers may override this rule')
+			: t('libresign', 'Lower layers must inherit this value'),
+	} satisfies PolicySettingDefinition<'request_notifications'>,
+	document_download_after_sign: {
+		key: 'document_download_after_sign',
+		title: t('libresign', 'Download after signing'),
+		context: t('libresign', 'Post-sign action'),
+		description: t('libresign', 'Control whether the finalized document is automatically offered for download after signing.'),
+		editor: ConfettiRuleEditor,
+		createEmptyValue: () => ({ enabled: true }),
+		summarizeValue: (value) => value.enabled
+			? t('libresign', 'Enabled')
+			: t('libresign', 'Disabled'),
+		formatAllowOverride: (allowChildOverride) => allowChildOverride
+			? t('libresign', 'Lower layers may override this rule')
+			: t('libresign', 'Lower layers must inherit this value'),
+	} satisfies PolicySettingDefinition<'document_download_after_sign'>,
+} satisfies { [K in PolicySettingKey]: PolicySettingDefinition<K> }
+
+function cloneValue<K extends PolicySettingKey>(value: PolicySettingValueMap[K]): PolicySettingValueMap[K] {
+	return JSON.parse(JSON.stringify(toRaw(value))) as PolicySettingValueMap[K]
+}
+
+export function createPolicyWorkbenchState() {
+	const viewMode = ref<AdminViewMode>('system-admin')
+	const activeSettingKey = ref<PolicySettingKey | null>(null)
+	const editorDraft = ref<PolicyEditorDraft | null>(null)
+	const editorMode = ref<'create' | 'edit' | null>(null)
+	const highlightedRuleId = ref<string | null>(null)
+	const nextRuleNumber = ref(100)
+
+	const settingsState = reactive<SettingsState>({
+		signature_flow: [
+			{
+				id: 'signature-system',
+				scope: 'system',
+				targetId: null,
+				allowChildOverride: true,
+				value: { enabled: true, flow: 'ordered_numeric' },
+			},
+			{
+				id: 'signature-group-finance',
+				scope: 'group',
+				targetId: 'finance',
+				allowChildOverride: true,
+				value: { enabled: true, flow: 'parallel' },
+			},
+			{
+				id: 'signature-group-legal',
+				scope: 'group',
+				targetId: 'legal',
+				allowChildOverride: false,
+				value: { enabled: true, flow: 'ordered_numeric' },
+			},
+			{
+				id: 'signature-user-maria',
+				scope: 'user',
+				targetId: 'maria',
+				allowChildOverride: false,
+				value: { enabled: true, flow: 'parallel' },
+			},
+		],
+		auto_reminders: [
+			{
+				id: 'reminders-system',
+				scope: 'system',
+				targetId: null,
+				allowChildOverride: true,
+				value: { enabled: true },
+			},
+			{
+				id: 'reminders-group-sales',
+				scope: 'group',
+				targetId: 'sales',
+				allowChildOverride: false,
+				value: { enabled: false },
+			},
+			{
+				id: 'reminders-user-ana',
+				scope: 'user',
+				targetId: 'ana',
+				allowChildOverride: false,
+				value: { enabled: false },
+			},
+		],
+		request_notifications: [
+			{
+				id: 'notifications-system',
+				scope: 'system',
+				targetId: null,
+				allowChildOverride: true,
+				value: { enabled: true },
+			},
+			{
+				id: 'notifications-group-legal',
+				scope: 'group',
+				targetId: 'legal',
+				allowChildOverride: true,
+				value: { enabled: true },
+			},
+			{
+				id: 'notifications-user-joao',
+				scope: 'user',
+				targetId: 'joao',
+				allowChildOverride: false,
+				value: { enabled: false },
+			},
+		],
+		document_download_after_sign: [
+			{
+				id: 'download-system',
+				scope: 'system',
+				targetId: null,
+				allowChildOverride: true,
+				value: { enabled: true },
+			},
+			{
+				id: 'download-group-finance',
+				scope: 'group',
+				targetId: 'finance',
+				allowChildOverride: true,
+				value: { enabled: true },
+			},
+			{
+				id: 'download-user-maria',
+				scope: 'user',
+				targetId: 'maria',
+				allowChildOverride: false,
+				value: { enabled: false },
+			},
+		],
+		confetti: [
+			{
+				id: 'confetti-system',
+				scope: 'system',
+				targetId: null,
+				allowChildOverride: true,
+				value: { enabled: true },
+			},
+			{
+				id: 'confetti-group-sales',
+				scope: 'group',
+				targetId: 'sales',
+				allowChildOverride: false,
+				value: { enabled: false },
+			},
+			{
+				id: 'confetti-group-legal',
+				scope: 'group',
+				targetId: 'legal',
+				allowChildOverride: true,
+				value: { enabled: true },
+			},
+			{
+				id: 'confetti-user-ana',
+				scope: 'user',
+				targetId: 'ana',
+				allowChildOverride: false,
+				value: { enabled: false },
+			},
+			{
+				id: 'confetti-user-bruno',
+				scope: 'user',
+				targetId: 'bruno',
+				allowChildOverride: false,
+				value: { enabled: true },
+			},
+		],
+		signature_stamp: [
+			{
+				id: 'stamp-system',
+				scope: 'system',
+				targetId: null,
+				allowChildOverride: true,
+				value: {
+					enabled: true,
+					renderMode: 'GRAPHIC_AND_DESCRIPTION',
+					template: '{{ signer_name }} - {{ signed_at }}',
+					templateFontSize: 10,
+					signatureFontSize: 19,
+					signatureWidth: 180,
+					signatureHeight: 70,
+					backgroundMode: 'default',
+					showSigningDate: true,
+				},
+			},
+			{
+				id: 'stamp-group-legal',
+				scope: 'group',
+				targetId: 'legal',
+				allowChildOverride: false,
+				value: {
+					enabled: true,
+					renderMode: 'DESCRIPTION_ONLY',
+					template: '{{ signer_name }} - {{ request_uuid }}',
+					templateFontSize: 11,
+					signatureFontSize: 16,
+					signatureWidth: 220,
+					signatureHeight: 80,
+					backgroundMode: 'none',
+					showSigningDate: false,
+				},
+			},
+			{
+				id: 'stamp-group-sales',
+				scope: 'group',
+				targetId: 'sales',
+				allowChildOverride: true,
+				value: {
+					enabled: true,
+					renderMode: 'GRAPHIC_ONLY',
+					template: '{{ signer_name }} - {{ organization }}',
+					templateFontSize: 10,
+					signatureFontSize: 18,
+					signatureWidth: 190,
+					signatureHeight: 70,
+					backgroundMode: 'default',
+					showSigningDate: true,
+				},
+			},
+			{
+				id: 'stamp-user-joao',
+				scope: 'user',
+				targetId: 'joao',
+				allowChildOverride: false,
+				value: {
+					enabled: true,
+					renderMode: 'SIGNAME_AND_DESCRIPTION',
+					template: '{{ signer_name }}',
+					templateFontSize: 12,
+					signatureFontSize: 22,
+					signatureWidth: 210,
+					signatureHeight: 80,
+					backgroundMode: 'custom',
+					showSigningDate: true,
+				},
+			},
+			{
+				id: 'stamp-user-ana',
+				scope: 'user',
+				targetId: 'ana',
+				allowChildOverride: false,
+				value: {
+					enabled: true,
+					renderMode: 'DESCRIPTION_ONLY',
+					template: '{{ signer_name }} - {{ request_uuid }}',
+					templateFontSize: 11,
+					signatureFontSize: 17,
+					signatureWidth: 220,
+					signatureHeight: 82,
+					backgroundMode: 'none',
+					showSigningDate: false,
+				},
+			},
+		],
+		identify_factors: [
+			{
+				id: 'identify-system',
+				scope: 'system',
+				targetId: null,
+				allowChildOverride: true,
+				value: {
+					enabled: true,
+					requireAnyTwo: false,
+					factors: [
+						{
+							key: 'email',
+							label: 'Email',
+							enabled: true,
+							required: true,
+							allowCreateAccount: true,
+							signatureMethod: 'email_token',
+						},
+						{
+							key: 'sms',
+							label: 'SMS',
+							enabled: true,
+							required: false,
+							allowCreateAccount: false,
+							signatureMethod: 'sms_token',
+						},
+						{
+							key: 'whatsapp',
+							label: 'WhatsApp',
+							enabled: false,
+							required: false,
+							allowCreateAccount: false,
+							signatureMethod: 'whatsapp_token',
+						},
+						{
+							key: 'document',
+							label: 'Document data',
+							enabled: false,
+							required: false,
+							allowCreateAccount: false,
+							signatureMethod: 'document_validation',
+						},
+					],
+				},
+			},
+			{
+				id: 'identify-group-finance',
+				scope: 'group',
+				targetId: 'finance',
+				allowChildOverride: true,
+				value: {
+					enabled: true,
+					requireAnyTwo: true,
+					factors: [
+						{
+							key: 'email',
+							label: 'Email',
+							enabled: true,
+							required: true,
+							allowCreateAccount: true,
+							signatureMethod: 'email_token',
+						},
+						{
+							key: 'sms',
+							label: 'SMS',
+							enabled: true,
+							required: true,
+							allowCreateAccount: false,
+							signatureMethod: 'sms_token',
+						},
+						{
+							key: 'whatsapp',
+							label: 'WhatsApp',
+							enabled: false,
+							required: false,
+							allowCreateAccount: false,
+							signatureMethod: 'whatsapp_token',
+						},
+						{
+							key: 'document',
+							label: 'Document data',
+							enabled: true,
+							required: false,
+							allowCreateAccount: false,
+							signatureMethod: 'document_validation',
+						},
+					],
+				},
+			},
+			{
+				id: 'identify-group-legal',
+				scope: 'group',
+				targetId: 'legal',
+				allowChildOverride: false,
+				value: {
+					enabled: true,
+					requireAnyTwo: false,
+					factors: [
+						{
+							key: 'email',
+							label: 'Email',
+							enabled: true,
+							required: true,
+							allowCreateAccount: true,
+							signatureMethod: 'email_token',
+						},
+						{
+							key: 'sms',
+							label: 'SMS',
+							enabled: false,
+							required: false,
+							allowCreateAccount: false,
+							signatureMethod: 'sms_token',
+						},
+						{
+							key: 'whatsapp',
+							label: 'WhatsApp',
+							enabled: true,
+							required: false,
+							allowCreateAccount: false,
+							signatureMethod: 'whatsapp_token',
+						},
+						{
+							key: 'document',
+							label: 'Document data',
+							enabled: true,
+							required: false,
+							allowCreateAccount: false,
+							signatureMethod: 'document_validation',
+						},
+					],
+				},
+			},
+			{
+				id: 'identify-user-maria',
+				scope: 'user',
+				targetId: 'maria',
+				allowChildOverride: false,
+				value: {
+					enabled: true,
+					requireAnyTwo: false,
+					factors: [
+						{
+							key: 'email',
+							label: 'Email',
+							enabled: true,
+							required: true,
+							allowCreateAccount: true,
+							signatureMethod: 'email_token',
+						},
+						{
+							key: 'sms',
+							label: 'SMS',
+							enabled: false,
+							required: false,
+							allowCreateAccount: false,
+							signatureMethod: 'sms_token',
+						},
+						{
+							key: 'whatsapp',
+							label: 'WhatsApp',
+							enabled: true,
+							required: false,
+							allowCreateAccount: false,
+							signatureMethod: 'whatsapp_token',
+						},
+						{
+							key: 'document',
+							label: 'Document data',
+							enabled: false,
+							required: false,
+							allowCreateAccount: false,
+							signatureMethod: 'document_validation',
+						},
+					],
+				},
+			},
+			{
+				id: 'identify-user-joao',
+				scope: 'user',
+				targetId: 'joao',
+				allowChildOverride: false,
+				value: {
+					enabled: true,
+					requireAnyTwo: true,
+					factors: [
+						{
+							key: 'email',
+							label: 'Email',
+							enabled: true,
+							required: true,
+							allowCreateAccount: true,
+							signatureMethod: 'email_token',
+						},
+						{
+							key: 'sms',
+							label: 'SMS',
+							enabled: true,
+							required: true,
+							allowCreateAccount: false,
+							signatureMethod: 'sms_token',
+						},
+						{
+							key: 'whatsapp',
+							label: 'WhatsApp',
+							enabled: true,
+							required: false,
+							allowCreateAccount: false,
+							signatureMethod: 'whatsapp_token',
+						},
+						{
+							key: 'document',
+							label: 'Document data',
+							enabled: false,
+							required: false,
+							allowCreateAccount: false,
+							signatureMethod: 'document_validation',
+						},
+					],
+				},
+			},
+		],
+	})
+
+	const activeDefinition = computed(() => activeSettingKey.value ? definitions[activeSettingKey.value] : null)
+
+	const activeRules = computed(() => activeSettingKey.value ? settingsState[activeSettingKey.value] : [])
+
+	const inheritedSystemRule = computed(() => activeRules.value.find(rule => rule.scope === 'system') ?? null)
+
+	const currentGroupRule = computed(() => activeRules.value.find(rule => rule.scope === 'group' && rule.targetId === CURRENT_GROUP_ID) ?? null)
+
+	const visibleGroupRules = computed(() => {
+		if (viewMode.value === 'group-admin') {
+			return currentGroupRule.value ? [currentGroupRule.value] : []
+		}
+
+		return activeRules.value.filter(rule => rule.scope === 'group')
+	})
+
+	const visibleUserRules = computed(() => {
+		const visibleUsers = viewMode.value === 'group-admin'
+			? users.filter(user => user.groupId === CURRENT_GROUP_ID).map(user => user.id)
+			: users.map(user => user.id)
+
+		return activeRules.value.filter(rule => rule.scope === 'user' && rule.targetId !== null && visibleUsers.includes(rule.targetId))
+	})
+
+	const visibleSettingSummaries = computed<PolicySettingSummary[]>(() => {
+		return Object.values(definitions).map((definition) => {
+			const rules = settingsState[definition.key]
+			const systemRule = rules.find(rule => rule.scope === 'system') ?? null
+			const groupRuleCount = viewMode.value === 'group-admin'
+				? rules.filter(rule => rule.scope === 'group' && rule.targetId === CURRENT_GROUP_ID).length
+				: rules.filter(rule => rule.scope === 'group').length
+			const visibleUsersForSummary = viewMode.value === 'group-admin'
+				? users.filter(user => user.groupId === CURRENT_GROUP_ID).map(user => user.id)
+				: users.map(user => user.id)
+			const userRuleCount = rules.filter(rule => rule.scope === 'user' && rule.targetId !== null && visibleUsersForSummary.includes(rule.targetId)).length
+
+			return {
+				key: definition.key,
+				title: definition.title,
+				context: definition.context,
+				description: definition.description,
+				defaultSummary: systemRule ? definition.summarizeValue(systemRule.value as never) : t('libresign', 'No global default rule'),
+				groupCount: groupRuleCount,
+				userCount: userRuleCount,
+			}
+		})
+	})
+
+	const availableTargets = computed(() => {
+		if (!editorDraft.value) {
+			return []
+		}
+
+		if (editorDraft.value.scope === 'group') {
+			const takenTargets = activeRules.value
+				.filter(rule => rule.scope === 'group' && rule.id !== editorDraft.value?.id)
+				.map(rule => rule.targetId)
+
+			return groups.filter(group => !takenTargets.includes(group.id))
+		}
+
+		if (editorDraft.value.scope === 'user') {
+			const baseUsers = viewMode.value === 'group-admin'
+				? users.filter(user => user.groupId === CURRENT_GROUP_ID)
+				: users
+			const takenTargets = activeRules.value
+				.filter(rule => rule.scope === 'user' && rule.id !== editorDraft.value?.id)
+				.map(rule => rule.targetId)
+
+			return baseUsers.filter(user => !takenTargets.includes(user.id))
+		}
+
+		return []
+	})
+
+	const draftTargetLabel = computed(() => {
+		if (!editorDraft.value) {
+			return ''
+		}
+
+		return resolveTargetLabel(editorDraft.value.scope, editorDraft.value.targetId)
+	})
+
+	const duplicateMessage = computed(() => {
+		if (!editorDraft.value || !activeSettingKey.value) {
+			return ''
+		}
+
+		const hasDuplicate = settingsState[activeSettingKey.value].some((rule) => {
+			return rule.scope === editorDraft.value?.scope
+				&& rule.targetId === editorDraft.value?.targetId
+				&& rule.id !== editorDraft.value?.id
+		})
+
+			return hasDuplicate ? t('libresign', 'An override for this target already exists.') : ''
+	})
+
+	const canSaveDraft = computed(() => {
+		if (!editorDraft.value) {
+			return false
+		}
+
+		if (duplicateMessage.value) {
+			return false
+		}
+
+		if (editorDraft.value.scope === 'group' || editorDraft.value.scope === 'user') {
+			return editorDraft.value.targetId !== null
+		}
+
+		return true
+	})
+
+	function setViewMode(mode: AdminViewMode) {
+		viewMode.value = mode
+		resetEditor()
+	}
+
+	function openSetting(key: PolicySettingKey) {
+		activeSettingKey.value = key
+		resetEditor()
+	}
+
+	function closeSetting() {
+		activeSettingKey.value = null
+		resetEditor()
+	}
+
+	function resetEditor() {
+		editorDraft.value = null
+		editorMode.value = null
+		highlightedRuleId.value = null
+	}
+
+	function cancelEditor() {
+		resetEditor()
+	}
+
+	function resolveTargetLabel(scope: PolicyScope, targetId: string | null) {
+		if (scope === 'system') {
+			return t('libresign', 'Global default rule')
+		}
+
+		if (scope === 'group') {
+			return groups.find(group => group.id === targetId)?.label ?? t('libresign', 'Unknown group')
+		}
+
+		return users.find(user => user.id === targetId)?.label ?? t('libresign', 'Unknown user')
+	}
+
+	function getDefinition(key: PolicySettingKey) {
+		return definitions[key]
+	}
+
+	function createDraft<K extends PolicySettingKey>(key: K, scope: PolicyScope, targetId: string | null): PolicyEditorDraft {
+		const definition = definitions[key]
+		return {
+			id: null,
+			settingKey: key,
+			scope,
+			targetId,
+			allowChildOverride: scope !== 'user',
+			value: cloneValue(definition.createEmptyValue(scope)) as PolicySettingValueMap[PolicySettingKey],
+		}
+	}
+
+	function getNextTarget(scope: PolicyScope) {
+		if (scope === 'group') {
+			return groups.find(group => !activeRules.value.some(rule => rule.scope === 'group' && rule.targetId === group.id))?.id ?? null
+		}
+
+		if (scope === 'user') {
+			const baseUsers = viewMode.value === 'group-admin'
+				? users.filter(user => user.groupId === CURRENT_GROUP_ID)
+				: users
+			return baseUsers.find(user => !activeRules.value.some(rule => rule.scope === 'user' && rule.targetId === user.id))?.id ?? null
+		}
+
+		return null
+	}
+
+	function startEditor(options: StartEditorOptions) {
+		if (!activeSettingKey.value) {
+			return
+		}
+
+		if (options.ruleId) {
+			const existingRule = activeRules.value.find(rule => rule.id === options.ruleId)
+			if (!existingRule) {
+				return
+			}
+
+			editorMode.value = 'edit'
+			editorDraft.value = {
+				id: existingRule.id,
+				settingKey: activeSettingKey.value,
+				scope: existingRule.scope,
+				targetId: existingRule.targetId,
+				allowChildOverride: existingRule.allowChildOverride,
+				value: cloneValue(existingRule.value) as PolicySettingValueMap[PolicySettingKey],
+			}
+			highlightedRuleId.value = existingRule.id
+			return
+		}
+
+		editorMode.value = 'create'
+		const targetId = options.scope === 'system'
+			? null
+			: options.scope === 'group' && viewMode.value === 'group-admin'
+				? CURRENT_GROUP_ID
+				: getNextTarget(options.scope)
+
+		editorDraft.value = createDraft(activeSettingKey.value, options.scope, targetId)
+		highlightedRuleId.value = null
+	}
+
+	function updateDraftTarget(targetId: string | null) {
+		if (!editorDraft.value) {
+			return
+		}
+
+		editorDraft.value = {
+			...editorDraft.value,
+			targetId,
+		}
+	}
+
+	function updateDraftAllowOverride(allowChildOverride: boolean) {
+		if (!editorDraft.value) {
+			return
+		}
+
+		editorDraft.value = {
+			...editorDraft.value,
+			allowChildOverride,
+		}
+	}
+
+	function updateDraftValue(value: PolicySettingValueMap[PolicySettingKey]) {
+		if (!editorDraft.value) {
+			return
+		}
+
+		editorDraft.value = {
+			...editorDraft.value,
+			value,
+		}
+	}
+
+	function saveDraft() {
+		if (!activeSettingKey.value || !editorDraft.value || !canSaveDraft.value) {
+			return
+		}
+
+		const rules = settingsState[activeSettingKey.value]
+		const nextRule: PolicyRuleRecord = {
+			id: editorDraft.value.id ?? `${activeSettingKey.value}-${nextRuleNumber.value++}`,
+			scope: editorDraft.value.scope,
+			targetId: editorDraft.value.scope === 'system' ? null : editorDraft.value.targetId,
+			allowChildOverride: editorDraft.value.scope === 'user' ? false : editorDraft.value.allowChildOverride,
+			value: cloneValue(editorDraft.value.value),
+		}
+
+		const existingIndex = rules.findIndex(rule => rule.id === nextRule.id)
+		if (existingIndex >= 0) {
+			rules.splice(existingIndex, 1, nextRule)
+		} else {
+			rules.push(nextRule as never)
+		}
+
+		resetEditor()
+	}
+
+	function removeRule(ruleId: string) {
+		if (!activeSettingKey.value) {
+			return
+		}
+
+		const rules = settingsState[activeSettingKey.value]
+		const index = rules.findIndex(rule => rule.id === ruleId)
+		if (index >= 0) {
+			rules.splice(index, 1)
+		}
+
+		if (highlightedRuleId.value === ruleId) {
+			resetEditor()
+		}
+	}
+
+	return {
+		viewMode,
+		activeSettingKey,
+		activeDefinition,
+		editorDraft,
+		editorMode,
+		highlightedRuleId,
+		visibleSettingSummaries,
+		visibleGroupRules,
+		visibleUserRules,
+		inheritedSystemRule,
+		currentGroupRule,
+		availableTargets,
+		draftTargetLabel,
+		duplicateMessage,
+		canSaveDraft,
+		currentGroupId: CURRENT_GROUP_ID,
+		settingsState,
+		setViewMode,
+		openSetting,
+		closeSetting,
+		cancelEditor,
+		startEditor,
+		updateDraftTarget,
+		updateDraftAllowOverride,
+		updateDraftValue,
+		saveDraft,
+		removeRule,
+		resolveTargetLabel,
+		getDefinition,
+	}
+}
diff --git a/src/views/Settings/PolicyWorkbench/useRealPolicyWorkbench.ts b/src/views/Settings/PolicyWorkbench/useRealPolicyWorkbench.ts
new file mode 100644
index 0000000000..7cebd09db0
--- /dev/null
+++ b/src/views/Settings/PolicyWorkbench/useRealPolicyWorkbench.ts
@@ -0,0 +1,985 @@
+/**
+ * SPDX-FileCopyrightText: 2026 LibreCode coop and LibreCode contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+import axios from '@nextcloud/axios'
+import { getCurrentUser } from '@nextcloud/auth'
+import { loadState } from '@nextcloud/initial-state'
+import { generateOcsUrl } from '@nextcloud/router'
+import { computed, reactive, ref } from 'vue'
+import { t } from '@nextcloud/l10n'
+
+import { realDefinitions } from './settings/realDefinitions'
+import type { RealPolicyResolutionMode } from './settings/realTypes'
+import { usePoliciesStore } from '../../../store/policies'
+import type { EffectivePolicyState, EffectivePolicyValue } from '../../../types/index'
+import logger from '../../../logger.js'
+
+type PolicyScope = 'system' | 'group' | 'user'
+type PolicyResolutionMode = RealPolicyResolutionMode
+
+interface PolicyImpactPreview {
+	groupCount?: number
+	userCount?: number
+	activeChildRules?: number
+	blockedChildRules?: number
+}
+
+interface PolicyStickySummary {
+	currentBaseValue: string
+	baseSource: string
+	configurableLayers: string
+	platformFallback: string
+	resolutionMode: PolicyResolutionMode
+	activeGroupExceptions: number
+	activeUserExceptions: number
+	activeBlockCount: number
+}
+
+interface PolicyRuleRecord {
+	id: string
+	scope: PolicyScope
+	targetId: string | null
+	allowChildOverride: boolean
+	value: EffectivePolicyValue
+}
+
+interface PolicyEditorDraft {
+	scope: PolicyScope
+	ruleId: string | null
+	targetIds: string[]
+	value: EffectivePolicyValue
+	allowChildOverride: boolean
+}
+
+interface PolicySettingSummary {
+	key: string
+	title: string
+	context?: string
+	description: string
+	defaultSummary: string
+	groupCount: number
+	userCount: number
+}
+
+interface PolicyTargetOption {
+	id: string
+	displayName: string
+	subname?: string
+	user?: string
+	isNoUser?: boolean
+}
+
+interface GroupDetailsResponse {
+	ocs?: {
+		data?: {
+			groups?: Array<{
+				id: string
+				displayname?: string
+				usercount?: number
+			}>
+		}
+	}
+}
+
+interface UserDetailsRecord {
+	id: string
+	displayname?: string
+	'display-name'?: string
+	email?: string
+}
+
+interface UserDetailsResponse {
+	ocs?: {
+		data?: {
+			users?: Record<string, UserDetailsRecord | Record<string, unknown> | string>
+		}
+	}
+}
+
+function isUserDetailsRecord(candidate: unknown): candidate is UserDetailsRecord {
+	if (!candidate || typeof candidate !== 'object') {
+		return false
+	}
+
+	const record = candidate as Record<string, unknown>
+	if (typeof record.id !== 'string' || record.id.length === 0) {
+		return false
+	}
+
+	// Defensive filtering: if backend response includes mixed entities,
+	// keep only user-like entries for the user rule target picker.
+	if ('usercount' in record || record.isNoUser === true) {
+		return false
+	}
+
+	return true
+}
+
+function inferSystemAllowOverride(policy: { allowedValues?: unknown[] } | null): boolean {
+	if (!policy || !Array.isArray(policy.allowedValues)) {
+		return true
+	}
+
+	// When lower layers are locked, backend narrows allowedValues to a single value.
+	return policy.allowedValues.length !== 1
+}
+
+function toDraftSnapshot(draft: PolicyEditorDraft | null): string {
+	if (!draft) {
+		return ''
+	}
+
+	return JSON.stringify({
+		scope: draft.scope,
+		ruleId: draft.ruleId,
+		targetIds: [...draft.targetIds].sort(),
+		value: draft.value,
+		allowChildOverride: draft.allowChildOverride,
+	})
+}
+
+export function createRealPolicyWorkbenchState() {
+	const policiesStore = usePoliciesStore()
+	const currentUser = getCurrentUser()
+	const isInstanceAdmin = currentUser?.isAdmin === true
+	const config = loadState<{ can_manage_group_policies?: boolean }>('libresign', 'config', {})
+	const initialViewMode: 'system-admin' | 'group-admin' = currentUser?.isAdmin
+		? 'system-admin'
+		: config.can_manage_group_policies
+			? 'group-admin'
+			: 'system-admin'
+	const viewMode = ref<'system-admin' | 'group-admin'>(initialViewMode)
+	const activeSettingKey = ref<string | null>(null)
+	const editorDraft = ref<PolicyEditorDraft | null>(null)
+	const editorMode = ref<'create' | 'edit' | null>(null)
+	const highlightedRuleId = ref<string | null>(null)
+	const duplicateMessage = ref<string | null>(null)
+	const nextRuleNumber = ref(1)
+
+	const groupRules = ref<PolicyRuleRecord[]>([])
+	const userRules = ref<PolicyRuleRecord[]>([])
+	const explicitSystemRule = ref<PolicyRuleRecord | null>(null)
+	const settingRuleCounts = ref<Record<string, { groupCount: number, userCount: number }>>({})
+
+	function setSettingRuleCounts(policyKey: string, groupCount: number, userCount: number) {
+		settingRuleCounts.value = {
+			...settingRuleCounts.value,
+			[policyKey]: {
+				groupCount,
+				userCount,
+			},
+		}
+	}
+
+	function syncActiveSettingRuleCounts() {
+		if (!activeSettingKey.value) {
+			return
+		}
+
+		setSettingRuleCounts(activeSettingKey.value, groupRules.value.length, userRules.value.length)
+	}
+
+	const groups = ref<PolicyTargetOption[]>([])
+	const users = ref<PolicyTargetOption[]>([])
+	const loadingTargets = ref(false)
+	const hydratePersistedRulesRequestId = ref(0)
+	const editorInitialSnapshot = ref('')
+
+	const visibleSettingSummaries = computed<PolicySettingSummary[]>(() => {
+		return Object.values(realDefinitions).map((definition) => {
+			const policy = policiesStore.getPolicy(definition.key)
+			const hasEffectiveValue = policy?.effectiveValue !== null && policy?.effectiveValue !== undefined
+			const persistedCounts = settingRuleCounts.value[definition.key]
+			const isActiveSetting = activeSettingKey.value === definition.key
+
+			return {
+				key: definition.key,
+				title: definition.title,
+				context: definition.context,
+				description: definition.description,
+				defaultSummary: hasEffectiveValue ? definition.summarizeValue(policy.effectiveValue) : t('libresign', 'Not configured'),
+				groupCount: isActiveSetting ? groupRules.value.length : (persistedCounts?.groupCount ?? 0),
+				userCount: isActiveSetting ? userRules.value.length : (persistedCounts?.userCount ?? 0),
+			}
+		})
+	})
+
+	const activeDefinition = computed(() => {
+		if (!activeSettingKey.value) {
+			return null
+		}
+
+		return realDefinitions[activeSettingKey.value as keyof typeof realDefinitions] || null
+	})
+
+	const activePolicyState = computed(() => {
+		if (!activeDefinition.value) {
+			return null
+		}
+
+		return policiesStore.getPolicy(activeDefinition.value.key)
+	})
+
+	const inheritedSystemRule = computed<PolicyRuleRecord | null>(() => {
+		if (!activeDefinition.value) {
+			return null
+		}
+
+		const policy = activePolicyState.value
+		if (!policy || policy.effectiveValue === null || policy.effectiveValue === undefined) {
+			return explicitSystemRule.value
+		}
+
+		const sourceScope = policy.sourceScope
+		if (sourceScope === 'group' || sourceScope === 'user') {
+			return explicitSystemRule.value
+		}
+
+		if (sourceScope === 'system') {
+			return {
+				id: 'system-inherited-default',
+				scope: 'system',
+				targetId: null,
+				allowChildOverride: inferSystemAllowOverride(policy),
+				value: policy.effectiveValue,
+			}
+		}
+
+		explicitSystemRule.value = {
+			id: 'system-default',
+			scope: 'system',
+			targetId: null,
+			allowChildOverride: inferSystemAllowOverride(policy),
+			value: policy.effectiveValue,
+		}
+
+		return explicitSystemRule.value
+	})
+
+	const policyResolutionMode = computed<PolicyResolutionMode>(() => {
+		if (!activeDefinition.value) {
+			return 'precedence'
+		}
+
+		return activeDefinition.value.resolutionMode
+	})
+
+	const systemDefaultRule = computed<PolicyRuleRecord | null>(() => {
+		if (!activeDefinition.value) {
+			return null
+		}
+
+		const policy = activePolicyState.value
+		const fallbackValue = activeDefinition.value.getFallbackSystemDefault(
+			policy?.effectiveValue,
+			policy?.sourceScope,
+		)
+
+		if (fallbackValue === null || fallbackValue === undefined) {
+			return null
+		}
+
+		return {
+			id: 'policy-system-default',
+			scope: 'system',
+			targetId: null,
+			allowChildOverride: true,
+			value: fallbackValue,
+		}
+	})
+
+	const hasGlobalDefault = computed(() => {
+		if (explicitSystemRule.value !== null) {
+			return true
+		}
+
+		const policy = activePolicyState.value
+		if (!policy) {
+			return false
+		}
+
+		if (!policy.sourceScope) {
+			return inheritedSystemRule.value !== null
+		}
+
+		return policy.sourceScope === 'global'
+	})
+
+	const effectiveSource = computed(() => {
+		const sourceScope = activePolicyState.value?.sourceScope
+		if (sourceScope === 'system') {
+			return 'system'
+		}
+
+		if (sourceScope === 'group' || sourceScope === 'user') {
+			return sourceScope
+		}
+
+		return hasGlobalDefault.value ? 'global' : 'system'
+	})
+
+	const summary = computed<PolicyStickySummary | null>(() => {
+		if (!activeDefinition.value) {
+			return null
+		}
+
+		const fallbackLabel = systemDefaultRule.value
+			? activeDefinition.value.summarizeValue(systemDefaultRule.value.value)
+			: t('libresign', 'Not configured')
+		const currentBaseValue = inheritedSystemRule.value
+			? activeDefinition.value.summarizeValue(inheritedSystemRule.value.value)
+			: fallbackLabel
+
+		const activeGroupExceptions = groupRules.value.length
+		const activeUserExceptions = userRules.value.length
+		const activeBlockCount = [
+			inheritedSystemRule.value?.allowChildOverride === false ? 1 : 0,
+			...groupRules.value.map((rule) => rule.allowChildOverride ? 0 : 1),
+		].reduce((sum, count) => sum + count, 0)
+
+		const baseSource = hasGlobalDefault.value
+			? t('libresign', 'Global default')
+			: t('libresign', 'System default')
+
+		return {
+			currentBaseValue,
+			baseSource,
+			configurableLayers: t('libresign', 'Default > Group > User'),
+			platformFallback: fallbackLabel,
+			resolutionMode: policyResolutionMode.value,
+			activeGroupExceptions,
+			activeUserExceptions,
+			activeBlockCount,
+		}
+	})
+
+	const createGroupOverrideDisabledReason = computed(() => {
+		if (isInstanceAdmin) {
+			return null
+		}
+
+		if (inheritedSystemRule.value?.allowChildOverride === false) {
+			return t('libresign', 'Blocked by the global default.')
+		}
+
+		return null
+	})
+
+	const createUserOverrideDisabledReason = computed(() => {
+		if (viewMode.value === 'system-admin') {
+			return null
+		}
+
+		if (inheritedSystemRule.value?.allowChildOverride === false) {
+			return t('libresign', 'Blocked by a locked default rule.')
+		}
+
+		const blockingGroup = groupRules.value.find((rule) => !rule.allowChildOverride)
+		if (blockingGroup?.targetId) {
+			return t('libresign', 'Blocked by the {group} group rule.', {
+				group: resolveTargetLabel('group', blockingGroup.targetId),
+			})
+		}
+
+		return null
+	})
+
+	const visibleGroupRules = computed<PolicyRuleRecord[]>(() => groupRules.value)
+	const visibleUserRules = computed<PolicyRuleRecord[]>(() => userRules.value)
+
+	function filterTargetsForCreate(scope: 'group' | 'user', targets: PolicyTargetOption[]): PolicyTargetOption[] {
+		if (!editorDraft.value || editorDraft.value.scope !== scope || editorMode.value !== 'create') {
+			return targets
+		}
+
+		const selectedTargetIds = new Set(editorDraft.value.targetIds)
+		const assignedTargetIds = new Set(
+			(scope === 'group' ? groupRules.value : userRules.value)
+				.map((rule) => rule.targetId)
+				.filter((targetId): targetId is string => !!targetId),
+		)
+
+		return targets.filter((target) => {
+			return selectedTargetIds.has(target.id) || !assignedTargetIds.has(target.id)
+		})
+	}
+
+	const availableTargets = computed<PolicyTargetOption[]>(() => {
+		if (!editorDraft.value) {
+			return []
+		}
+
+		if (editorDraft.value.scope === 'group') {
+			return filterTargetsForCreate('group', groups.value)
+		}
+
+		if (editorDraft.value.scope === 'user') {
+			return filterTargetsForCreate('user', users.value)
+		}
+
+		return []
+	})
+
+	const draftTargetLabel = computed(() => {
+		if (!editorDraft.value || editorDraft.value.targetIds.length === 0) {
+			return null
+		}
+
+		const labels = editorDraft.value.targetIds
+			.map((targetId) => availableTargets.value.find((target) => target.id === targetId)?.displayName ?? targetId)
+
+		if (labels.length === 1) {
+			return labels[0]
+		}
+
+		return t('libresign', '{count} targets selected', { count: String(labels.length) })
+	})
+
+	const isDraftDirty = computed(() => {
+		if (!editorDraft.value) {
+			return false
+		}
+
+		return toDraftSnapshot(editorDraft.value) !== editorInitialSnapshot.value
+	})
+
+	function hasSelectableDraftValue(draft: PolicyEditorDraft) {
+		if (!activeDefinition.value) {
+			return false
+		}
+
+		return activeDefinition.value.hasSelectableDraftValue(draft.value)
+	}
+
+	const canSaveDraft = computed(() => {
+		if (!editorDraft.value) {
+			return false
+		}
+
+			if (!hasSelectableDraftValue(editorDraft.value)) {
+				return false
+			}
+
+		if (editorDraft.value.scope !== 'system' && editorDraft.value.targetIds.length === 0) {
+			return false
+		}
+
+		return isDraftDirty.value
+	})
+
+	async function hydratePersistedRules(policyKey: string) {
+		const currentRequestId = hydratePersistedRulesRequestId.value + 1
+		hydratePersistedRulesRequestId.value = currentRequestId
+
+		await Promise.all([
+			loadTargets('group', '', true),
+			loadTargets('user', '', true),
+		])
+
+		const [persistedSystemPolicy, persistedGroupPolicies, persistedUserPolicies] = await Promise.all([
+			policiesStore.fetchSystemPolicy(policyKey).catch((error) => {
+				logger.debug('Could not load explicit system policy for workbench', {
+					error,
+					policyKey,
+				})
+				return null
+			}),
+			Promise.all(groups.value.map(async (group) => {
+				try {
+					const persistedPolicy = await policiesStore.fetchGroupPolicy(group.id, policyKey)
+					if (!persistedPolicy || persistedPolicy.value === null || persistedPolicy.value === undefined) {
+						return null
+					}
+
+					return {
+						id: `group-${group.id}-persisted`,
+						scope: 'group' as const,
+						targetId: group.id,
+						allowChildOverride: persistedPolicy.allowChildOverride,
+						value: persistedPolicy.value,
+					}
+				} catch (error) {
+					logger.debug('Could not load persisted group policy for target', {
+						error,
+						policyKey,
+						groupId: group.id,
+					})
+					return null
+				}
+			})),
+			Promise.all(users.value.map(async (user) => {
+				try {
+					const persistedPolicy = await policiesStore.fetchUserPolicyForUser(user.id, policyKey)
+					if (!persistedPolicy || persistedPolicy.value === null || persistedPolicy.value === undefined) {
+						return null
+					}
+
+					return {
+						id: `user-${user.id}-persisted`,
+						scope: 'user' as const,
+						targetId: user.id,
+						allowChildOverride: true,
+						value: persistedPolicy.value,
+					}
+				} catch (error) {
+					logger.debug('Could not load persisted user policy for target', {
+						error,
+						policyKey,
+						userId: user.id,
+					})
+					return null
+				}
+			})),
+		])
+
+		if (currentRequestId !== hydratePersistedRulesRequestId.value || activeSettingKey.value !== policyKey) {
+			return
+		}
+
+		const hasPersistedRule = <TRule>(rule: TRule | null): rule is TRule => rule !== null
+
+		explicitSystemRule.value = persistedSystemPolicy?.scope === 'global' && persistedSystemPolicy.value !== null && persistedSystemPolicy.value !== undefined
+			? {
+				id: 'system-default',
+				scope: 'system',
+				targetId: null,
+				allowChildOverride: persistedSystemPolicy.allowChildOverride,
+				value: persistedSystemPolicy.value,
+			}
+			: null
+
+		groupRules.value = persistedGroupPolicies.filter(hasPersistedRule)
+		userRules.value = persistedUserPolicies.filter(hasPersistedRule)
+		nextRuleNumber.value = groupRules.value.length + userRules.value.length + 1
+		setSettingRuleCounts(policyKey, groupRules.value.length, userRules.value.length)
+	}
+
+	function openSetting(key: string) {
+		activeSettingKey.value = key
+		explicitSystemRule.value = null
+		groupRules.value = []
+		userRules.value = []
+		void hydratePersistedRules(key)
+	}
+
+	function mergeSelectedTargets(scope: 'group' | 'user', fetchedTargets: PolicyTargetOption[]) {
+		const existingTargets = scope === 'group' ? groups.value : users.value
+		const selectedIds = editorDraft.value?.scope === scope ? editorDraft.value.targetIds : []
+		const selectedTargets = existingTargets.filter((target) => {
+			return selectedIds.includes(target.id) && !fetchedTargets.some((option) => option.id === target.id)
+		})
+
+		return [...selectedTargets, ...fetchedTargets]
+	}
+
+	async function fetchGroups(query = '', limit = 20, offset = 0): Promise<PolicyTargetOption[]> {
+		const { data } = await axios.get<GroupDetailsResponse>(generateOcsUrl('cloud/groups/details'), {
+			params: {
+				search: query,
+				limit,
+				offset,
+			},
+		})
+
+		return (data.ocs?.data?.groups ?? [])
+			.map((group) => ({
+				id: group.id,
+				displayName: group.displayname || group.id,
+				subname: typeof group.usercount === 'number'
+					? t('libresign', '{count} members', { count: String(group.usercount) })
+					: undefined,
+				isNoUser: true,
+			}))
+			.sort((left, right) => left.displayName.localeCompare(right.displayName))
+	}
+
+	async function fetchUsers(query = '', limit = 20, offset = 0): Promise<PolicyTargetOption[]> {
+		const { data } = await axios.get<UserDetailsResponse>(generateOcsUrl('cloud/users/details'), {
+			params: {
+				search: query,
+				limit,
+				offset,
+			},
+		})
+
+		return Object.values(data.ocs?.data?.users ?? {})
+			.filter(isUserDetailsRecord)
+			.map((user) => ({
+				id: user.id,
+				displayName: user['display-name'] || user.displayname || user.id,
+				subname: user.email,
+				user: user.id,
+			}))
+			.sort((left, right) => left.displayName.localeCompare(right.displayName))
+	}
+
+	async function fetchAllTargets(scope: 'group' | 'user'): Promise<PolicyTargetOption[]> {
+		const pageSize = 20
+		let offset = 0
+		const aggregatedTargets: PolicyTargetOption[] = []
+		const seenTargetIds = new Set<string>()
+
+		for (let page = 0; page < 100; page += 1) {
+			const pageTargets = scope === 'group'
+				? await fetchGroups('', pageSize, offset)
+				: await fetchUsers('', pageSize, offset)
+
+			for (const target of pageTargets) {
+				if (seenTargetIds.has(target.id)) {
+					continue
+				}
+
+				seenTargetIds.add(target.id)
+				aggregatedTargets.push(target)
+			}
+
+			if (pageTargets.length < pageSize) {
+				break
+			}
+
+			offset += pageSize
+		}
+
+		return aggregatedTargets.sort((left, right) => left.displayName.localeCompare(right.displayName))
+	}
+
+	async function loadTargets(scope: 'group' | 'user', query = '', includeAll = false) {
+		loadingTargets.value = true
+		try {
+			if (scope === 'group') {
+				const fetchedGroups = includeAll && query === ''
+					? await fetchAllTargets('group')
+					: await fetchGroups(query)
+				groups.value = mergeSelectedTargets('group', fetchedGroups)
+				return
+			}
+
+			const fetchedUsers = includeAll && query === ''
+				? await fetchAllTargets('user')
+				: await fetchUsers(query)
+			users.value = mergeSelectedTargets('user', fetchedUsers)
+		} catch (error) {
+			logger.debug('Could not load policy workbench targets', {
+				error,
+				scope,
+				query,
+			})
+		} finally {
+			loadingTargets.value = false
+		}
+	}
+
+	function searchAvailableTargets(query: string) {
+		const scope = editorDraft.value?.scope
+		if (scope !== 'group' && scope !== 'user') {
+			return
+		}
+
+		void loadTargets(scope, query)
+	}
+
+	function setViewMode(mode: 'system-admin' | 'group-admin') {
+		viewMode.value = mode
+	}
+
+	function closeSetting() {
+		activeSettingKey.value = null
+		groupRules.value = []
+		userRules.value = []
+		explicitSystemRule.value = null
+		editorDraft.value = null
+		editorMode.value = null
+		duplicateMessage.value = null
+	}
+
+	function resolveTargetLabel(scope: 'group' | 'user', targetId: string): string {
+		const targets = scope === 'group' ? groups.value : users.value
+		return targets.find((target) => target.id === targetId)?.displayName || targetId
+	}
+
+	function findRuleById(scope: PolicyScope, ruleId: string): PolicyRuleRecord | null {
+		if (scope === 'group') {
+			return groupRules.value.find((rule) => rule.id === ruleId) ?? null
+		}
+
+		if (scope === 'user') {
+			return userRules.value.find((rule) => rule.id === ruleId) ?? null
+		}
+
+		return inheritedSystemRule.value?.id === ruleId ? inheritedSystemRule.value : null
+	}
+
+	function startEditor({ scope, ruleId }: { scope: PolicyScope, ruleId?: string }) {
+		if (!activeDefinition.value) {
+			return
+		}
+
+		if (!ruleId && scope === 'group' && createGroupOverrideDisabledReason.value) {
+			duplicateMessage.value = createGroupOverrideDisabledReason.value
+			return
+		}
+
+		if (!ruleId && scope === 'user' && createUserOverrideDisabledReason.value) {
+			duplicateMessage.value = createUserOverrideDisabledReason.value
+			return
+		}
+
+		// Cancel any in-flight hydration result to avoid stale overwrite while editing.
+		hydratePersistedRulesRequestId.value += 1
+
+		const isEdit = !!ruleId
+		editorMode.value = isEdit ? 'edit' : 'create'
+		duplicateMessage.value = null
+
+		let value: EffectivePolicyValue = activeDefinition.value.createEmptyValue()
+		let targetIds: string[] = []
+		let allowChildOverride = activeDefinition.value.normalizeAllowChildOverride(scope, true)
+
+		if (isEdit && ruleId) {
+			const rule = findRuleById(scope, ruleId)
+			if (rule) {
+				value = activeDefinition.value.normalizeDraftValue(rule.value)
+				allowChildOverride = activeDefinition.value.normalizeAllowChildOverride(scope, rule.allowChildOverride)
+				targetIds = rule.targetId ? [rule.targetId] : []
+			}
+		} else if (scope === 'system') {
+			const baselineRuleValue = inheritedSystemRule.value?.value ?? systemDefaultRule.value?.value
+			if (baselineRuleValue !== null && baselineRuleValue !== undefined) {
+				value = activeDefinition.value.normalizeDraftValue(baselineRuleValue)
+			}
+		} else if (scope === 'group') {
+			targetIds = []
+		} else if (scope === 'user') {
+			targetIds = []
+		}
+
+		editorDraft.value = {
+			scope,
+			ruleId: ruleId || null,
+			targetIds,
+			value,
+			allowChildOverride,
+		}
+		editorInitialSnapshot.value = toDraftSnapshot(editorDraft.value)
+
+		if (scope === 'group' || scope === 'user') {
+			void loadTargets(scope)
+		}
+	}
+
+	function cancelEditor() {
+		editorDraft.value = null
+		editorMode.value = null
+		duplicateMessage.value = null
+		editorInitialSnapshot.value = ''
+	}
+
+	function updateDraftValue(value: EffectivePolicyValue) {
+		if (editorDraft.value) {
+			editorDraft.value.value = value
+		}
+	}
+
+	function updateDraftTargets(targetIds: string[]) {
+		if (!editorDraft.value) {
+			return
+		}
+
+		editorDraft.value.targetIds = Array.from(new Set(targetIds.filter(Boolean)))
+	}
+
+	function updateDraftTarget(targetId: string | null) {
+		updateDraftTargets(targetId ? [targetId] : [])
+	}
+
+	function updateDraftAllowOverride(allowChildOverride: boolean) {
+		if (editorDraft.value) {
+			editorDraft.value.allowChildOverride = activeDefinition.value
+				? activeDefinition.value.normalizeAllowChildOverride(editorDraft.value.scope, allowChildOverride)
+				: allowChildOverride
+		}
+	}
+
+	function upsertRule(ruleList: PolicyRuleRecord[], scope: 'group' | 'user', targetId: string, value: EffectivePolicyValue, allowChildOverride: boolean) {
+		const existingRule = ruleList.find((rule) => rule.targetId === targetId)
+		if (existingRule) {
+			existingRule.value = value
+			existingRule.allowChildOverride = allowChildOverride
+			highlightedRuleId.value = existingRule.id
+			return
+		}
+
+		const id = `${scope}-${targetId}-${String(nextRuleNumber.value)}`
+		nextRuleNumber.value += 1
+
+		ruleList.push({
+			id,
+			scope,
+			targetId,
+			allowChildOverride,
+			value,
+		})
+
+		highlightedRuleId.value = id
+	}
+
+	async function saveDraft() {
+		if (!editorDraft.value || !activeDefinition.value || !canSaveDraft.value) {
+			return
+		}
+
+		const { scope, value, targetIds } = editorDraft.value
+		const policyKey = activeDefinition.value.key
+		const allowChildOverride = activeDefinition.value.normalizeAllowChildOverride(scope, editorDraft.value.allowChildOverride)
+
+		try {
+			if (scope === 'system') {
+				await policiesStore.saveSystemPolicy(policyKey, value, allowChildOverride)
+				if (viewMode.value === 'system-admin') {
+					await policiesStore.clearUserPreference(policyKey)
+				}
+				explicitSystemRule.value = {
+					id: 'system-default',
+					scope: 'system',
+					targetId: null,
+					allowChildOverride,
+					value,
+				}
+				await policiesStore.fetchEffectivePolicies()
+				syncActiveSettingRuleCounts()
+				cancelEditor()
+				return
+			}
+
+			if (scope === 'group') {
+				await Promise.all(targetIds.map((targetId) => {
+					return policiesStore.saveGroupPolicy(targetId, policyKey, value, allowChildOverride)
+				}))
+
+				for (const targetId of targetIds) {
+					upsertRule(groupRules.value, 'group', targetId, value, allowChildOverride)
+				}
+
+				await policiesStore.fetchEffectivePolicies()
+				syncActiveSettingRuleCounts()
+				cancelEditor()
+				return
+			}
+
+			await Promise.all(targetIds.map((targetId) => {
+				return policiesStore.saveUserPolicyForUser(targetId, policyKey, value)
+			}))
+
+			for (const targetId of targetIds) {
+				upsertRule(userRules.value, 'user', targetId, value, true)
+			}
+
+			await policiesStore.fetchEffectivePolicies()
+			syncActiveSettingRuleCounts()
+			cancelEditor()
+		} catch (error) {
+			console.error('Failed to save policy:', error)
+		}
+	}
+
+	async function removeRule(ruleId: string) {
+		if (!activeDefinition.value) {
+			return
+		}
+
+		const policyKey = activeDefinition.value.key
+		const inheritedSystemRuleId = inheritedSystemRule.value?.id
+		const isEditingMode = editorMode.value === 'edit'
+
+		const shouldCloseSystemEditor = isEditingMode && editorDraft.value?.scope === 'system'
+		const shouldCloseGroupEditor = isEditingMode
+			&& editorDraft.value?.scope === 'group'
+			&& editorDraft.value.ruleId === ruleId
+		const shouldCloseUserEditor = isEditingMode
+			&& editorDraft.value?.scope === 'user'
+			&& editorDraft.value.ruleId === ruleId
+
+		if (ruleId === 'system-default' || (inheritedSystemRuleId !== null && ruleId === inheritedSystemRuleId)) {
+			await policiesStore.saveSystemPolicy(policyKey, null as unknown as EffectivePolicyValue, false)
+			explicitSystemRule.value = null
+			highlightedRuleId.value = null
+			await policiesStore.fetchEffectivePolicies()
+			syncActiveSettingRuleCounts()
+			if (shouldCloseSystemEditor) {
+				cancelEditor()
+			}
+			return
+		}
+
+		const groupIndex = groupRules.value.findIndex((rule) => rule.id === ruleId)
+		if (groupIndex >= 0) {
+			const targetId = groupRules.value[groupIndex]?.targetId
+			if (targetId) {
+				await policiesStore.clearGroupPolicy(targetId, policyKey)
+			}
+			groupRules.value.splice(groupIndex, 1)
+			highlightedRuleId.value = null
+			await policiesStore.fetchEffectivePolicies()
+			syncActiveSettingRuleCounts()
+			if (shouldCloseGroupEditor) {
+				cancelEditor()
+			}
+			return
+		}
+
+		const userIndex = userRules.value.findIndex((rule) => rule.id === ruleId)
+		if (userIndex >= 0) {
+			const targetId = userRules.value[userIndex]?.targetId
+			if (targetId) {
+				await policiesStore.clearUserPolicyForUser(targetId, policyKey)
+			}
+			userRules.value.splice(userIndex, 1)
+			highlightedRuleId.value = null
+			await policiesStore.fetchEffectivePolicies()
+			syncActiveSettingRuleCounts()
+			if (shouldCloseUserEditor) {
+				cancelEditor()
+			}
+		}
+	}
+
+	return reactive({
+		activeDefinition,
+		editorDraft,
+		editorMode: editorMode as any,
+		inheritedSystemRule,
+		systemDefaultRule,
+		hasGlobalDefault,
+		effectiveSource,
+		policyResolutionMode,
+		summary,
+		visibleGroupRules,
+		visibleUserRules,
+		createGroupOverrideDisabledReason,
+		createUserOverrideDisabledReason,
+		visibleSettingSummaries,
+		highlightedRuleId: highlightedRuleId as any,
+		viewMode: viewMode as any,
+		availableTargets,
+		loadingTargets,
+		draftTargetLabel,
+		duplicateMessage: duplicateMessage as any,
+		canSaveDraft,
+		isDraftDirty,
+		openSetting,
+		closeSetting,
+		startEditor,
+		cancelEditor,
+		updateDraftValue,
+		updateDraftTarget,
+		updateDraftTargets,
+		updateDraftAllowOverride,
+		searchAvailableTargets,
+		setViewMode,
+		saveDraft,
+		removeRule,
+		resolveTargetLabel,
+	})
+}
diff --git a/src/views/Settings/Settings.vue b/src/views/Settings/Settings.vue
index 6bab780442..ae7f504d37 100644
--- a/src/views/Settings/Settings.vue
+++ b/src/views/Settings/Settings.vue
@@ -16,8 +16,7 @@
 		<ExpirationRules />
 		<Validation />
 		<CrlValidation />
-		<DocMDP />
-		<SignatureFlow />
+		<SettingsPolicyWorkbench />
 		<SigningMode v-if="false" />
 		<AllowedGroups />
 		<LegalInformation />
@@ -29,7 +28,6 @@
 		<Envelope />
 		<Reminders />
 		<TSA />
-		<Confetti />
 	</div>
 </template>
 
@@ -38,10 +36,8 @@ import AllowedGroups from './AllowedGroups.vue'
 import CertificateEngine from './CertificateEngine.vue'
 import ConfigureCheck from './ConfigureCheck.vue'
 import CollectMetadata from './CollectMetadata.vue'
-import Confetti from './Confetti.vue'
 import CrlValidation from './CrlValidation.vue'
 import DefaultUserFolder from './DefaultUserFolder.vue'
-import DocMDP from './DocMDP.vue'
 import DownloadBinaries from './DownloadBinaries.vue'
 import Envelope from './Envelope.vue'
 import ExpirationRules from './ExpirationRules.vue'
@@ -52,7 +48,7 @@ import Reminders from './Reminders.vue'
 import RootCertificateCfssl from './RootCertificateCfssl.vue'
 import RootCertificateOpenSsl from './RootCertificateOpenSsl.vue'
 import SignatureEngine from './SignatureEngine.vue'
-import SignatureFlow from './SignatureFlow.vue'
+import SettingsPolicyWorkbench from './PolicyWorkbench/RealPolicyWorkbench.vue'
 import SignatureHashAlgorithm from './SignatureHashAlgorithm.vue'
 import SignatureStamp from './SignatureStamp.vue'
 import SigningMode from './SigningMode.vue'
@@ -62,5 +58,30 @@ import Validation from './Validation.vue'
 
 defineOptions({
 	name: 'Settings',
+	components: {
+		AllowedGroups,
+		CertificateEngine,
+		ConfigureCheck,
+		CollectMetadata,
+		CrlValidation,
+		DefaultUserFolder,
+		DownloadBinaries,
+		Envelope,
+		ExpirationRules,
+		IdentificationDocuments,
+		IdentificationFactors,
+		LegalInformation,
+		Reminders,
+		RootCertificateCfssl,
+		RootCertificateOpenSsl,
+		SettingsPolicyWorkbench,
+		SignatureEngine,
+		SignatureHashAlgorithm,
+		SignatureStamp,
+		SigningMode,
+		SupportProject,
+		TSA,
+		Validation,
+	},
 })
 </script>
diff --git a/src/views/Settings/SignatureFlow.vue b/src/views/Settings/SignatureFlow.vue
deleted file mode 100644
index 585dce1946..0000000000
--- a/src/views/Settings/SignatureFlow.vue
+++ /dev/null
@@ -1,258 +0,0 @@
-<!--
-  - SPDX-FileCopyrightText: 2025 LibreCode coop and LibreCode contributors
-  - SPDX-License-Identifier: AGPL-3.0-or-later
--->
-<template>
-	<NcSettingsSection :name="t('libresign', 'Signing order')">
-		<NcNoteCard v-if="errorMessage" type="error">
-			{{ errorMessage }}
-		</NcNoteCard>
-
-		<div class="signature-flow-toggle">
-			<NcCheckboxRadioSwitch type="switch"
-				v-model="enabled"
-				:disabled="loading"
-				@update:modelValue="onToggleChange">
-				<span>{{ t('libresign', 'Set default signing order') }}</span>
-			</NcCheckboxRadioSwitch>
-			<span v-if="loading && !flowChanging" class="toggle-status">
-				<NcLoadingIcon :size="20" />
-			</span>
-			<span v-else-if="saved && !flowChanging" class="toggle-status">
-				<NcSavingIndicatorIcon :size="20" />
-			</span>
-			<span v-else-if="showErrorIcon && !flowChanging" class="toggle-status">
-				<NcSavingIndicatorIcon :size="20" error />
-			</span>
-		</div>
-
-		<div v-if="enabled" class="signature-flow-options">
-			<NcCheckboxRadioSwitch v-for="flow in availableFlows"
-				:key="flow.value"
-				type="radio"
-				v-model="selectedFlowValue"
-				:value="flow.value"
-				:disabled="loading"
-				name="signature_flow"
-				@update:modelValue="onFlowChange">
-				<div class="signature-flow-option">
-					<div class="signature-flow-option-content">
-						<strong>{{ flow.label }}</strong>
-						<p class="signature-flow-option-description">
-							{{ flow.description }}
-						</p>
-					</div>
-					<div v-if="selectedFlow?.value === flow.value" class="signature-flow-option-status">
-						<NcLoadingIcon v-if="loading && flowChanging" :size="20" />
-						<NcSavingIndicatorIcon v-else-if="saved && flowChanging" :size="20" />
-						<NcSavingIndicatorIcon v-else-if="showErrorIcon && flowChanging" :size="20" error />
-					</div>
-				</div>
-			</NcCheckboxRadioSwitch>
-		</div>
-	</NcSettingsSection>
-</template>
-
-<script setup lang="ts">
-import axios from '@nextcloud/axios'
-import { loadState } from '@nextcloud/initial-state'
-import { t } from '@nextcloud/l10n'
-import { generateOcsUrl } from '@nextcloud/router'
-import { computed, onMounted, ref } from 'vue'
-
-import NcCheckboxRadioSwitch from '@nextcloud/vue/components/NcCheckboxRadioSwitch'
-import NcLoadingIcon from '@nextcloud/vue/components/NcLoadingIcon'
-import NcNoteCard from '@nextcloud/vue/components/NcNoteCard'
-import NcSavingIndicatorIcon from '@nextcloud/vue/components/NcSavingIndicatorIcon'
-import NcSettingsSection from '@nextcloud/vue/components/NcSettingsSection'
-import type { operations } from '../../types/openapi/openapi-administration'
-
-defineOptions({
-	name: 'SignatureFlow',
-})
-
-type FlowOption = {
-	value: SignatureFlowMode
-	label: string
-	description: string
-}
-
-type SignatureFlowMode = 'none' | 'parallel' | 'ordered_numeric'
-
-type SignatureFlowRequestBody = operations['admin-set-signature-flow-config']['requestBody']['content']['application/json']
-type SignatureFlowErrorResponse =
-	| operations['admin-set-signature-flow-config']['responses'][400]['content']['application/json']
-	| operations['admin-set-signature-flow-config']['responses'][500]['content']['application/json']
-
-type SignatureFlowRequestError = {
-	response?: {
-		data?: SignatureFlowErrorResponse
-	}
-}
-
-const enabled = ref(false)
-const selectedFlow = ref<FlowOption | null>(null)
-const loading = ref(false)
-const errorMessage = ref('')
-const saved = ref(false)
-const showErrorIcon = ref(false)
-const flowChanging = ref(false)
-
-const availableFlows = computed<FlowOption[]>(() => [
-	{
-		value: 'parallel',
-		label: t('libresign', 'Simultaneous (Parallel)'),
-		description: t('libresign', 'All signers receive the document at the same time and can sign in any order.'),
-	},
-	{
-		value: 'ordered_numeric',
-		label: t('libresign', 'Sequential'),
-		description: t('libresign', 'Signers are organized by signing order number. Only those with the lowest pending order number can sign.'),
-	},
-])
-
-const selectedFlowValue = computed({
-	get() {
-		return selectedFlow.value?.value ?? availableFlows.value[0].value
-	},
-	set(value: string) {
-		selectedFlow.value = availableFlows.value.find(flow => flow.value === value) ?? availableFlows.value[0]
-	},
-})
-
-function loadConfig() {
-	try {
-		const mode = loadState<SignatureFlowMode>('libresign', 'signature_flow', 'none')
-
-		if (mode === 'none') {
-			enabled.value = false
-			selectedFlow.value = availableFlows.value[0]
-		} else {
-			enabled.value = true
-			selectedFlow.value = availableFlows.value.find(flow => flow.value === mode) ?? availableFlows.value[0]
-		}
-	} catch (error) {
-		console.error('Error loading signature flow configuration:', error)
-		errorMessage.value = t('libresign', 'Could not load configuration.')
-		enabled.value = false
-		selectedFlow.value = availableFlows.value[0]
-	}
-}
-
-function onToggleChange() {
-	errorMessage.value = ''
-	showErrorIcon.value = false
-	flowChanging.value = false
-	saveConfig()
-}
-
-function onFlowChange() {
-	errorMessage.value = ''
-	showErrorIcon.value = false
-	flowChanging.value = true
-	saveConfig()
-}
-
-function getErrorMessage(error: unknown): string | null {
-	const requestError = error as SignatureFlowRequestError
-	return requestError.response?.data?.ocs?.data?.error ?? null
-}
-
-async function saveConfig() {
-	loading.value = true
-	errorMessage.value = ''
-	saved.value = false
-	showErrorIcon.value = false
-
-	try {
-		const url = generateOcsUrl('apps/libresign/api/v1/admin/signature-flow/config')
-		const payload: SignatureFlowRequestBody = {
-			enabled: enabled.value,
-			mode: enabled.value ? (selectedFlow.value?.value ?? 'parallel') : null,
-		}
-		await axios.post(url, payload)
-
-		saved.value = true
-		setTimeout(() => {
-			saved.value = false
-			flowChanging.value = false
-		}, 3000)
-	} catch (error: unknown) {
-		console.error('Error saving signature flow configuration:', error)
-		errorMessage.value = getErrorMessage(error) ?? t('libresign', 'Error saving configuration.')
-		showErrorIcon.value = true
-	} finally {
-		loading.value = false
-	}
-}
-
-onMounted(() => {
-	loadConfig()
-})
-
-defineExpose({
-	enabled,
-	selectedFlow,
-	loading,
-	errorMessage,
-	saved,
-	showErrorIcon,
-	flowChanging,
-	availableFlows,
-	selectedFlowValue,
-	loadConfig,
-	onToggleChange,
-	onFlowChange,
-	saveConfig,
-})
-</script>
-
-<style lang="scss" scoped>
-.signature-flow-toggle {
-	margin-bottom: 1.5rem;
-	display: flex;
-	align-items: center;
-	gap: 0.5rem;
-
-	:deep(.checkbox-radio-switch) {
-		flex-shrink: 0;
-	}
-
-	.toggle-status {
-		display: flex;
-		align-items: center;
-		flex-shrink: 0;
-	}
-}
-
-.signature-flow-options {
-	margin-top: 0.5rem;
-	display: flex;
-	flex-direction: column;
-	gap: 0.5rem;
-
-	.signature-flow-option {
-		display: flex;
-		justify-content: space-between;
-		align-items: flex-start;
-		gap: 1rem;
-		width: 100%;
-
-		&-content {
-			flex: 1;
-		}
-
-		&-description {
-			margin: 0.25rem 0 0 0;
-			color: var(--color-text-maxcontrast);
-			font-size: 90%;
-		}
-
-		&-status {
-			flex-shrink: 0;
-			display: flex;
-			align-items: center;
-		}
-	}
-}
-</style>
diff --git a/src/views/Settings/Validation.vue b/src/views/Settings/Validation.vue
index 52f481db8b..66330c3fc0 100644
--- a/src/views/Settings/Validation.vue
+++ b/src/views/Settings/Validation.vue
@@ -19,34 +19,36 @@
 				{{ t('libresign', 'Add visible footer with signature details') }}
 			</NcCheckboxRadioSwitch>
 		</p>
-		<p v-if="addFooter">
-			<NcCheckboxRadioSwitch type="switch"
-				v-model="writeQrcodeOnFooter"
-				@update:model-value="onWriteQrcodeOnFooterChange">
-				{{ t('libresign', 'Write QR code on footer with validation URL') }}
-			</NcCheckboxRadioSwitch>
-		</p>
-		<p v-if="addFooter && writeQrcodeOnFooter">
-			{{ t('libresign', 'To validate the signature of the documents. Only change this value if you want to replace the default validation URL with a different one.') }}
-			<input id="validation_site"
-				ref="urlInput"
-				:placeholder="url"
-				type="text"
-				@input="saveValidationiUrl()"
-				@click="fillValidationUrl()"
-				@keypress.enter="validationUrlEnter()">
-		</p>
-		<p v-if="addFooter">
-			<NcCheckboxRadioSwitch type="switch"
-				v-model="customizeFooter"
-				@update:model-value="onCustomizeFooterChange">
-				{{ t('libresign', 'Customize footer template') }}
-			</NcCheckboxRadioSwitch>
-		</p>
-		<FooterTemplateEditor v-if="addFooter && customizeFooter"
-			:initial-is-default="isDefaultFooterTemplate"
-			ref="footerTemplateEditor"
-			@template-reset="onTemplateReset" />
+		<div v-if="addFooter" class="footer-settings">
+			<p>
+				<NcCheckboxRadioSwitch type="switch"
+					v-model="writeQrcodeOnFooter"
+					@update:model-value="onWriteQrcodeOnFooterChange">
+					{{ t('libresign', 'Write QR code on footer with validation URL') }}
+				</NcCheckboxRadioSwitch>
+			</p>
+			<p v-if="writeQrcodeOnFooter">
+				{{ t('libresign', 'To validate the signature of the documents. Only change this value if you want to replace the default validation URL with a different one.') }}
+				<input id="validation_site"
+					ref="urlInput"
+					:placeholder="url"
+					type="text"
+					@input="saveValidationiUrl()"
+					@click="fillValidationUrl()"
+					@keypress.enter="validationUrlEnter()">
+			</p>
+			<p>
+				<NcCheckboxRadioSwitch type="switch"
+					v-model="customizeFooter"
+					@update:model-value="onCustomizeFooterChange">
+					{{ t('libresign', 'Customize footer template') }}
+				</NcCheckboxRadioSwitch>
+			</p>
+			<FooterTemplateEditor v-if="customizeFooter"
+				:initial-is-default="isDefaultFooterTemplate"
+				ref="footerTemplateEditor"
+				@template-reset="onTemplateReset" />
+		</div>
 	</NcSettingsSection>
 </template>
 <script setup lang="ts">
@@ -181,7 +183,7 @@ async function onCustomizeFooterChange(value: boolean) {
 	await toggleSetting('footer_template_is_default', !value)
 	isDefaultFooterTemplate.value = !value
 	if (!value) {
-		footerTemplateEditor.value?.resetFooterTemplate()
+		await footerTemplateEditor.value?.resetFooterTemplate()
 	}
 }
 
diff --git a/tests/integration/features/account/signature.feature b/tests/integration/features/account/signature.feature
index 94d5a54345..6cb8852bf2 100644
--- a/tests/integration/features/account/signature.feature
+++ b/tests/integration/features/account/signature.feature
@@ -222,10 +222,10 @@ Feature: account/signature
     Then the response should have a status code 200
 
   Scenario: CRUD of signature element to guest
-    Given guest "guest@test.coop" exists
+    Given guest "signature-elements-guest@test.coop" exists
     And run the command "config:app:set guests whitelist --value=libresign" with result code 0
     And wait for 3 seconds
-    And as user "guest@test.coop"
+    And as user "signature-elements-guest@test.coop"
     When sending "post" to ocs "/apps/libresign/api/v1/signature/elements"
       | elements | [{"type":"signature","file":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNkYAAAAAYAAjCB0C8AAAAASUVORK5CYII="}}] |
     Then the response should have a status code 200
diff --git a/tests/integration/features/admin/initial_state.feature b/tests/integration/features/admin/initial_state.feature
index 70db1c0bde..9b02b0ae1a 100644
--- a/tests/integration/features/admin/initial_state.feature
+++ b/tests/integration/features/admin/initial_state.feature
@@ -1,81 +1,512 @@
 Feature: admin/initial_state
-  Scenario: Validate default initial state
+  Scenario: Default identify methods are exposed in admin initial state
     Given as user "admin"
-    And sending "delete" to ocs "/apps/provisioning_api/api/v1/config/apps/libresign/identify_methods"
+    And run the command "config:app:delete libresign identify_methods" with result code 0
     When sending "get" to "/settings/admin/libresign"
-    Then the response should contain the initial state "libresign-identify_methods" with the following values:
-      """
-      [
-        {"name":"account","friendly_name":"Account","enabled":true,"mandatory":true,"signatureMethods":{"clickToSign":{"enabled":false,"label":"Click to sign","name":"clickToSign"},"emailToken":{"enabled":false,"label":"Email token","name":"emailToken"},"password":{"enabled":true,"label":"Certificate with password","name":"password"}}},
-        {"name":"email","friendly_name":"Email","enabled":false,"mandatory":true,"can_create_account":true,"test_url":"/index.php/settings/admin/mailtest","signatureMethods":{"clickToSign":{"enabled":false,"label":"Click to sign","name":"clickToSign"},"emailToken":{"enabled":true,"label":"Email token","name":"emailToken"}}}
-      ]
-      """
+    Then the response should contain the initial state "libresign-identify_methods" json that match with:
+      | key                                     | value                                                                                                            |
+      | (jq)map(select(.name=="account"))      | (jq)length == 1 and .[0].enabled == true and .[0].mandatory == true and .[0].signatureMethods.password.enabled == true |
+      | (jq)map(select(.name=="email"))        | (jq)length == 1 and .[0].enabled == false and .[0].mandatory == true and .[0].can_create_account == true and .[0].signatureMethods.emailToken.enabled == true |
+
+  Scenario: Identify methods stored as invalid string can be normalized through the API contract
+    Given as user "admin"
+    And run the command "config:app:set libresign identify_methods --value=invalid --type=string" with result code 0
+    And sending "post" to ocs "/apps/provisioning_api/api/v1/config/apps/libresign/identify_methods"
+      | value | (string)[{"name":"account","fake":null}] |
+    And the response should have a status code 200
+    When sending "get" to "/settings/admin/libresign"
+    Then the response should contain the initial state "libresign-identify_methods" json that match with:
+      | key                                     | value                                                                                                            |
+      | (jq)map(select(.name=="account"))      | (jq)length == 1 and .[0].enabled == true and .[0].mandatory == true and .[0].signatureMethods.password.enabled == true |
+      | (jq)map(select(.name=="email"))        | (jq)length == 1 and .[0].enabled == false and .[0].mandatory == true and .[0].can_create_account == true and .[0].signatureMethods.emailToken.enabled == true |
 
-  Scenario: Update identify methods with string
+  Scenario Outline: Invalid identify methods updates preserve the default contract
     Given as user "admin"
-    And sending "delete" to ocs "/apps/provisioning_api/api/v1/config/apps/libresign/identify_methods"
+    And run the command "config:app:set libresign identify_methods --value=[] --type=array" with result code 0
     When sending "post" to ocs "/apps/provisioning_api/api/v1/config/apps/libresign/identify_methods"
-      | value | "invalid" |
+      | value | (string)<payload> |
     Then sending "get" to "/settings/admin/libresign"
-    And the response should contain the initial state "libresign-identify_methods" with the following values:
-      """
-      [
-        {"name":"account","friendly_name":"Account","enabled":true,"mandatory":true,"signatureMethods":{"clickToSign":{"enabled":false,"label":"Click to sign","name":"clickToSign"},"emailToken":{"enabled":false,"label":"Email token","name":"emailToken"},"password":{"enabled":true,"label":"Certificate with password","name":"password"}}},
-        {"name":"email","friendly_name":"Email","enabled":false,"mandatory":true,"can_create_account":true,"test_url":"/index.php/settings/admin/mailtest","signatureMethods":{"clickToSign":{"enabled":false,"label":"Click to sign","name":"clickToSign"},"emailToken":{"enabled":true,"label":"Email token","name":"emailToken"}}}
-      ]
-      """
+    And the response should contain the initial state "libresign-identify_methods" json that match with:
+      | key                                     | value                                                                                                            |
+      | (jq)map(select(.name=="account"))      | (jq)length == 1 and .[0].enabled == true and .[0].mandatory == true and .[0].signatureMethods.password.enabled == true |
+      | (jq)map(select(.name=="email"))        | (jq)length == 1 and .[0].enabled == false and .[0].mandatory == true and .[0].can_create_account == true and .[0].signatureMethods.emailToken.enabled == true |
+
+    Examples:
+      | payload                                 |
+      | [{"name":"account","fake":null}]   |
+      | [{"name":"account","enabled":"string"}] |
+      | [{"name":"email","test_url":"immutable"}] |
 
-  Scenario: Update identify methods with invalid keys
+  Scenario: Updated identify methods are exposed in admin initial state
     Given as user "admin"
-    And sending "delete" to ocs "/apps/provisioning_api/api/v1/config/apps/libresign/identify_methods"
+    And run the command "config:app:set libresign identify_methods --value=[] --type=array" with result code 0
     When sending "post" to ocs "/apps/provisioning_api/api/v1/config/apps/libresign/identify_methods"
-      | value | (string)[{"name":"account","fake":null}] |
+      | value | (string)[{"name":"account","enabled":true,"mandatory":true,"signatureMethods":{"clickToSign":{"enabled":true}}},{"name":"email","enabled":false,"mandatory":false}] |
     Then sending "get" to "/settings/admin/libresign"
-    And the response should contain the initial state "libresign-identify_methods" with the following values:
+    And the response should contain the initial state "libresign-identify_methods" json that match with:
+      | key                                 | value                                                                                                       |
+      | (jq)map(select(.name=="account"))  | (jq)length == 1 and .[0].signatureMethods.clickToSign.enabled == true and .[0].signatureMethods.password.enabled == false |
+      | (jq)map(select(.name=="email"))    | (jq)length == 1 and .[0].mandatory == false and .[0].signatureMethods.emailToken.enabled == true           |
+    And run the command "config:app:delete libresign identify_methods" with result code 0
+
+  Scenario: Stable default admin initial states are exposed
+    Given as user "admin"
+    And run the command "user:setting admin libresign policy_workbench_catalog_compact_view --delete" with result code 0
+    And run the command "user:setting admin libresign files_list_sorting_mode --delete" with result code 0
+    And run the command "user:setting admin libresign files_list_sorting_direction --delete" with result code 0
+    And run the command "user:setting admin libresign files_list_sorting_mode name" with result code 0
+    And run the command "user:setting admin libresign files_list_sorting_direction asc" with result code 0
+    And run the command "config:app:delete libresign signature_text_template" with result code 0
+    And run the command "config:app:delete libresign footer_template" with result code 0
+    And run the command "config:app:delete libresign config_path" with result code 0
+    And run the command "config:app:delete libresign tsa_password" with result code 0
+    And the following libresign app config is set
+      | certificate_engine                | openssl                  |
+      | certificate_policies_oid          |                          |
+      | collect_metadata                  | false                    |
+      | legal_information                 |                          |
+      | signature_background_type         | default                  |
+      | signature_font_size               | 20                       |
+      | signature_height                  | 100                      |
+      | signature_preview_zoom_level      | 100                      |
+      | footer_preview_zoom_level         | 100                      |
+      | footer_preview_width              | 595                      |
+      | footer_preview_height             | 100                      |
+      | signature_engine                  | JSignPdf                 |
+      | signature_render_mode             | GRAPHIC_AND_DESCRIPTION  |
+      | signature_width                   | 350                      |
+      | template_font_size                | 10                       |
+      | tsa_url                           |                          |
+      | tsa_policy_oid                    |                          |
+      | tsa_auth_type                     | none                     |
+      | tsa_username                      |                          |
+      | docmdp_level                      | 2                        |
+      | policy.signature_flow.system      | none                     |
+      | signing_mode                      | sync                     |
+      | worker_type                       | local                    |
+      | identification_documents          | false                    |
+      | approval_group                    | ["admin"]                |
+      | envelope_enabled                  | true                     |
+      | parallel_workers                  | 4                        |
+      | show_confetti_after_signing       | true                     |
+      | crl_external_validation_enabled   | true                     |
+    When sending "get" to "/settings/admin/libresign"
+    Then the response should contain the initial state "libresign-config" json that match with:
+      | key                                        | value |
+      | (jq).files_list_sorting_mode               | name  |
+      | (jq).files_list_sorting_direction          | asc   |
+      | (jq).policy_workbench_catalog_compact_view | false |
+      | (jq).identificationDocumentsFlow           | false |
+    And the response should contain the initial state "libresign-certificate_engine" with the following values:
       """
-      [
-        {"name":"account","friendly_name":"Account","enabled":true,"mandatory":true,"signatureMethods":{"clickToSign":{"enabled":false,"label":"Click to sign","name":"clickToSign"},"emailToken":{"enabled":false,"label":"Email token","name":"emailToken"},"password":{"enabled":true,"label":"Certificate with password","name":"password"}}},
-        {"name":"email","friendly_name":"Email","enabled":false,"mandatory":true,"can_create_account":true,"test_url":"/index.php/settings/admin/mailtest","signatureMethods":{"clickToSign":{"enabled":false,"label":"Click to sign","name":"clickToSign"},"emailToken":{"enabled":true,"label":"Email token","name":"emailToken"}}}
-      ]
+      openssl
+      """
+    And the response should contain the initial state "libresign-certificate_policies_oid" with the following values:
       """
 
-  Scenario: Update identify methods with inalid type as value
-    Given as user "admin"
-    And sending "delete" to ocs "/apps/provisioning_api/api/v1/config/apps/libresign/identify_methods"
-    When sending "post" to ocs "/apps/provisioning_api/api/v1/config/apps/libresign/identify_methods"
-      | value | (string)[{"name":"account","enabled":"string"}] |
-    Then sending "get" to "/settings/admin/libresign"
-    And the response should contain the initial state "libresign-identify_methods" with the following values:
       """
-      [
-        {"name":"account","friendly_name":"Account","enabled":true,"mandatory":true,"signatureMethods":{"clickToSign":{"enabled":false,"label":"Click to sign","name":"clickToSign"},"emailToken":{"enabled":false,"label":"Email token","name":"emailToken"},"password":{"enabled":true,"label":"Certificate with password","name":"password"}}},
-        {"name":"email","friendly_name":"Email","enabled":false,"mandatory":true,"can_create_account":true,"test_url":"/index.php/settings/admin/mailtest","signatureMethods":{"clickToSign":{"enabled":false,"label":"Click to sign","name":"clickToSign"},"emailToken":{"enabled":true,"label":"Email token","name":"emailToken"}}}
-      ]
+    And the response should contain the initial state "libresign-certificate_policies_cps" with the following values:
       """
 
-  Scenario: Update identify methods with property that can't be changed
+      """
+    And the response should contain the initial state "libresign-config_path" with the following values:
+      """
+
+      """
+    And the response should contain the initial state "libresign-default_signature_font_size" with the following values:
+      """
+      20
+      """
+    And the response should contain the initial state "libresign-default_signature_height" with the following values:
+      """
+      100
+      """
+    And the response should contain the initial state "libresign-default_signature_text_template" with the following values:
+      """
+      "Signed with LibreSign\n{{SignerCommonName}}\nIssuer: {{IssuerCommonName}}\nDate: {{ServerSignatureDate}}"
+      """
+    And the response should contain the initial state "libresign-default_signature_width" with the following values:
+      """
+      350
+      """
+    And the response should contain the initial state "libresign-default_template_font_size" with the following values:
+      """
+      10
+      """
+    And the response should contain the initial state "libresign-legal_information" with the following values:
+      """
+
+      """
+    And the response should contain the initial state "libresign-signature_available_variables" json that match with:
+      | key                                     | value |
+      | (jq)has("{{DocumentUUID}}")            | true  |
+      | (jq)has("{{IssuerCommonName}}")        | true  |
+      | (jq)has("{{ServerSignatureDate}}")     | true  |
+      | (jq)has("{{SignerCommonName}}")        | true  |
+      | (jq)has("{{SignerIP}}")                | false |
+    And the response should contain the initial state "libresign-signature_background_type" with the following values:
+      """
+      default
+      """
+    And the response should contain the initial state "libresign-signature_font_size" with the following values:
+      """
+      20
+      """
+    And the response should contain the initial state "libresign-signature_height" with the following values:
+      """
+      100
+      """
+    And the response should contain the initial state "libresign-signature_preview_zoom_level" with the following values:
+      """
+      100
+      """
+    And the response should contain the initial state "libresign-footer_preview_zoom_level" with the following values:
+      """
+      100
+      """
+    And the response should contain the initial state "libresign-footer_preview_width" with the following values:
+      """
+      595
+      """
+    And the response should contain the initial state "libresign-footer_preview_height" with the following values:
+      """
+      100
+      """
+    And the response should contain the initial state "libresign-footer_template_variables" json that match with:
+      | key                             | value                           |
+      | (jq).direction.type             | string                          |
+      | (jq).linkToSite.default         | https://libresign.coop          |
+      | (jq).signedBy.default           | Digitally signed by LibreSign.  |
+      | (jq).validateIn.default         | Validate in %s.                 |
+      | (jq).signers.type               | array                           |
+      | (jq).uuid.type                  | string                          |
+    And the response should contain the initial state "libresign-footer_template_is_default" with the following values:
+      """
+      true
+      """
+    And the response should contain the initial state "libresign-signature_engine" with the following values:
+      """
+      JSignPdf
+      """
+    And the response should contain the initial state "libresign-signature_render_mode" with the following values:
+      """
+      GRAPHIC_AND_DESCRIPTION
+      """
+    And the response should contain the initial state "libresign-signature_text_template" with the following values:
+      """
+      "Signed with LibreSign\n{{SignerCommonName}}\nIssuer: {{IssuerCommonName}}\nDate: {{ServerSignatureDate}}"
+      """
+    And the response should contain the initial state "libresign-signature_width" with the following values:
+      """
+      350
+      """
+    And the response should contain the initial state "libresign-template_font_size" with the following values:
+      """
+      10
+      """
+    And the response should contain the initial state "libresign-tsa_url" with the following values:
+      """
+
+      """
+    And the response should contain the initial state "libresign-tsa_policy_oid" with the following values:
+      """
+
+      """
+    And the response should contain the initial state "libresign-tsa_auth_type" with the following values:
+      """
+      none
+      """
+    And the response should contain the initial state "libresign-tsa_username" with the following values:
+      """
+
+      """
+    And the response should contain the initial state "libresign-tsa_password" with the following values:
+      """
+      "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022"
+      """
+    And the response should contain the initial state "libresign-docmdp_config" json that match with:
+      | key                       | value                                      |
+      | (jq).enabled              | true                                       |
+      | (jq).defaultLevel         | 2                                          |
+      | (jq).availableLevels      | (jq)length == 4 and map(.value) == [0,1,2,3] |
+    And the response should contain the initial state "libresign-effective_policies" json that match with:
+      | key                                             | value                                 |
+      | (jq).policies.signature_flow.policyKey         | signature_flow                        |
+      | (jq).policies.signature_flow.effectiveValue    | none                                  |
+      | (jq).policies.signature_flow.allowedValues     | ["none","parallel","ordered_numeric"] |
+    And the response should contain the initial state "libresign-signing_mode" with the following values:
+      """
+      sync
+      """
+    And the response should contain the initial state "libresign-worker_type" with the following values:
+      """
+      local
+      """
+    And the response should contain the initial state "libresign-identification_documents" with the following values:
+      """
+      false
+      """
+    And the response should contain the initial state "libresign-approval_group" with the following values:
+      """
+      ["admin"]
+      """
+    And the response should contain the initial state "libresign-envelope_enabled" with the following values:
+      """
+      true
+      """
+    And the response should contain the initial state "libresign-parallel_workers" with the following values:
+      """
+      "4"
+      """
+    And the response should contain the initial state "libresign-show_confetti_after_signing" with the following values:
+      """
+      true
+      """
+    And the response should contain the initial state "libresign-crl_external_validation_enabled" with the following values:
+      """
+      true
+      """
+    And run the command "user:setting admin libresign files_list_sorting_mode --delete" with result code 0
+    And run the command "user:setting admin libresign files_list_sorting_direction --delete" with result code 0
+
+  Scenario: Custom admin initial states are exposed
     Given as user "admin"
-    And sending "delete" to ocs "/apps/provisioning_api/api/v1/config/apps/libresign/identify_methods"
-    When sending "post" to ocs "/apps/provisioning_api/api/v1/config/apps/libresign/identify_methods"
-      | value | (string)[{"name":"email","test_url":"immutable"}] |
-    Then sending "get" to "/settings/admin/libresign"
-    And the response should contain the initial state "libresign-identify_methods" with the following values:
+    And the following libresign app config is set
+      | certificate_engine                | openssl                           |
+      | collect_metadata                  | false                             |
+      | config_path                       | /tmp                              |
+      | legal_information                 | Custom legal information          |
+      | signature_background_type         | deleted                           |
+      | signature_font_size               | 18.5                              |
+      | signature_height                  | 140                               |
+      | signature_preview_zoom_level      | 125                               |
+      | footer_preview_zoom_level         | 85                                |
+      | footer_preview_width              | 610                               |
+      | footer_preview_height             | 80                                |
+      | footer_template                   | Custom footer for {{ uuid }}      |
+      | signature_engine                  | PhpNative                         |
+      | signature_render_mode             | DESCRIPTION_ONLY                  |
+      | signature_text_template           | Issuer: {{IssuerCommonName}}      |
+      | signature_width                   | 420                               |
+      | template_font_size                | 12.5                              |
+      | tsa_url                           | https://tsa.example.test/tsr      |
+      | tsa_policy_oid                    | 1.2.3                             |
+      | tsa_auth_type                     | basic                             |
+      | tsa_username                      | signer                            |
+      | tsa_password                      | topsecret                         |
+      | docmdp_level                      | 0                                 |
+      | policy.signature_flow.system      | ordered_numeric                   |
+      | signing_mode                      | async                             |
+      | worker_type                       | external                          |
+      | identification_documents          | true                              |
+      | approval_group                    | ["admin","staff"]               |
+      | envelope_enabled                  | false                             |
+      | parallel_workers                  | 9                                 |
+      | show_confetti_after_signing       | false                             |
+      | crl_external_validation_enabled   | false                             |
+    And run the command "config:app:set libresign certificate_policies_oid --value=1.2.3.4.5 --type=string" with result code 0
+    When sending "get" to "/settings/admin/libresign"
+    Then the response should contain the initial state "libresign-config" json that match with:
+      | key                              | value |
+      | (jq).identificationDocumentsFlow | true  |
+    And the response should contain the initial state "libresign-certificate_engine" with the following values:
+      """
+      openssl
+      """
+    And the response should contain the initial state "libresign-certificate_policies_oid" with the following values:
+      """
+      1.2.3.4.5
+      """
+    And the response should contain the initial state "libresign-certificate_policies_cps" with the following values:
+      """
+
+      """
+    And the response should contain the initial state "libresign-config_path" with the following values:
+      """
+      "/tmp"
+      """
+    And the response should contain the initial state "libresign-legal_information" with the following values:
+      """
+      Custom legal information
+      """
+    And the response should contain the initial state "libresign-signature_text_parsed" with the following values:
+      """
+      Issuer: Acme Cooperative
+      """
+    And the response should contain the initial state "libresign-signature_background_type" with the following values:
+      """
+      deleted
+      """
+    And the response should contain the initial state "libresign-signature_font_size" with the following values:
+      """
+      18.5
+      """
+    And the response should contain the initial state "libresign-signature_height" with the following values:
+      """
+      140
+      """
+    And the response should contain the initial state "libresign-signature_preview_zoom_level" with the following values:
+      """
+      125
+      """
+    And the response should contain the initial state "libresign-footer_preview_zoom_level" with the following values:
+      """
+      85
+      """
+    And the response should contain the initial state "libresign-footer_preview_width" with the following values:
+      """
+      610
+      """
+    And the response should contain the initial state "libresign-footer_preview_height" with the following values:
+      """
+      80
+      """
+    And the response should contain the initial state "libresign-footer_template" with the following values:
+      """
+      Custom footer for {{ uuid }}
+      """
+    And the response should contain the initial state "libresign-footer_template_is_default" with the following values:
+      """
+      false
+      """
+    And the response should contain the initial state "libresign-signature_engine" with the following values:
+      """
+      PhpNative
+      """
+    And the response should contain the initial state "libresign-signature_render_mode" with the following values:
       """
-      [
-        {"name":"account","friendly_name":"Account","enabled":true,"mandatory":true,"signatureMethods":{"clickToSign":{"enabled":false,"label":"Click to sign","name":"clickToSign"},"emailToken":{"enabled":false,"label":"Email token","name":"emailToken"},"password":{"enabled":true,"label":"Certificate with password","name":"password"}}},
-        {"name":"email","friendly_name":"Email","enabled":false,"mandatory":true,"can_create_account":true,"test_url":"/index.php/settings/admin/mailtest","signatureMethods":{"clickToSign":{"enabled":false,"label":"Click to sign","name":"clickToSign"},"emailToken":{"enabled":true,"label":"Email token","name":"emailToken"}}}
-      ]
+      DESCRIPTION_ONLY
       """
+    And the response should contain the initial state "libresign-signature_text_template" with the following values:
+      """
+      Issuer: {{IssuerCommonName}}
+      """
+    And the response should contain the initial state "libresign-signature_width" with the following values:
+      """
+      420
+      """
+    And the response should contain the initial state "libresign-template_font_size" with the following values:
+      """
+      12.5
+      """
+    And the response should contain the initial state "libresign-tsa_url" with the following values:
+      """
+      "https:\/\/tsa.example.test\/tsr"
+      """
+    And the response should contain the initial state "libresign-tsa_policy_oid" with the following values:
+      """
+      1.2.3
+      """
+    And the response should contain the initial state "libresign-tsa_auth_type" with the following values:
+      """
+      basic
+      """
+    And the response should contain the initial state "libresign-tsa_username" with the following values:
+      """
+      signer
+      """
+    And the response should contain the initial state "libresign-tsa_password" with the following values:
+      """
+      topsecret
+      """
+    And the response should contain the initial state "libresign-docmdp_config" json that match with:
+      | key                       | value                                      |
+      | (jq).enabled              | false                                      |
+      | (jq).defaultLevel         | 0                                          |
+      | (jq).availableLevels      | (jq)length == 4 and map(.value) == [0,1,2,3] |
+    And the response should contain the initial state "libresign-effective_policies" json that match with:
+      | key                                             | value                                 |
+      | (jq).policies.signature_flow.policyKey         | signature_flow                        |
+      | (jq).policies.signature_flow.effectiveValue    | ordered_numeric                       |
+      | (jq).policies.signature_flow.allowedValues     | ["ordered_numeric"]                  |
+    And the response should contain the initial state "libresign-signing_mode" with the following values:
+      """
+      async
+      """
+    And the response should contain the initial state "libresign-worker_type" with the following values:
+      """
+      external
+      """
+    And the response should contain the initial state "libresign-identification_documents" with the following values:
+      """
+      true
+      """
+    And the response should contain the initial state "libresign-approval_group" with the following values:
+      """
+      ["admin","staff"]
+      """
+    And the response should contain the initial state "libresign-envelope_enabled" with the following values:
+      """
+      false
+      """
+    And the response should contain the initial state "libresign-parallel_workers" with the following values:
+      """
+      "9"
+      """
+    And the response should contain the initial state "libresign-show_confetti_after_signing" with the following values:
+      """
+      false
+      """
+    And the response should contain the initial state "libresign-crl_external_validation_enabled" with the following values:
+      """
+      false
+      """
+    And the following libresign app config is set
+      | certificate_engine                | openssl                  |
+      | certificate_policies_oid          |                          |
+      | collect_metadata                  | false                    |
+      | legal_information                 |                          |
+      | signature_background_type         | default                  |
+      | signature_font_size               | 20                       |
+      | signature_height                  | 100                      |
+      | signature_preview_zoom_level      | 100                      |
+      | footer_preview_zoom_level         | 100                      |
+      | footer_preview_width              | 595                      |
+      | footer_preview_height             | 100                      |
+      | signature_engine                  | JSignPdf                 |
+      | signature_render_mode             | GRAPHIC_AND_DESCRIPTION  |
+      | signature_width                   | 350                      |
+      | template_font_size                | 10                       |
+      | tsa_url                           |                          |
+      | tsa_policy_oid                    |                          |
+      | tsa_auth_type                     | none                     |
+      | tsa_username                      |                          |
+      | docmdp_level                      | 2                        |
+      | policy.signature_flow.system      | none                     |
+      | signing_mode                      | sync                     |
+      | worker_type                       | local                    |
+      | identification_documents          | false                    |
+      | approval_group                    | ["admin"]                |
+      | envelope_enabled                  | true                     |
+      | parallel_workers                  | 4                        |
+      | show_confetti_after_signing       | true                     |
+      | crl_external_validation_enabled   | true                     |
+    And run the command "config:app:delete libresign signature_text_template" with result code 0
+    And run the command "config:app:delete libresign footer_template" with result code 0
+    And run the command "config:app:delete libresign config_path" with result code 0
+    And run the command "config:app:delete libresign tsa_password" with result code 0
 
-  Scenario: Update identify methods and retrieve with success as initial state
+  Scenario: Invalid signature text template exposes parse error initial state
     Given as user "admin"
-    When sending "post" to ocs "/apps/provisioning_api/api/v1/config/apps/libresign/identify_methods"
-      | value | (string)[{"name":"account","enabled":true,"mandatory":true,"signatureMethods":{"clickToSign":{"enabled":true}}},{"name":"email","enabled":false,"mandatory":false}] |
-    Then sending "get" to "/settings/admin/libresign"
-    And the response should contain the initial state "libresign-identify_methods" with the following values:
+    And the following libresign app config is set
+      | signature_text_template | {% if true %}broken |
+    When sending "get" to "/settings/admin/libresign"
+    Then the response should contain the initial state "libresign-signature_text_parsed" with the following values:
+      """
+
+      """
+    And the response should contain the initial state "libresign-signature_text_template_error" with the following values:
       """
-      [
-        {"name":"account","friendly_name":"Account","enabled":true,"mandatory":true,"signatureMethods":{"clickToSign":{"enabled":true,"label":"Click to sign","name":"clickToSign"},"emailToken":{"enabled":false,"label":"Email token","name":"emailToken"},"password":{"enabled":false,"label":"Certificate with password","name":"password"}}},
-        {"name":"email","friendly_name":"Email","enabled":false,"mandatory":false,"can_create_account":true,"test_url":"/index.php/settings/admin/mailtest","signatureMethods":{"clickToSign":{"enabled":false,"label":"Click to sign","name":"clickToSign"},"emailToken":{"enabled":true,"label":"Email token","name":"emailToken"}}}
-      ]
+      Unexpected end of template .
       """
+    And run the command "config:app:delete libresign signature_text_template" with result code 0
+
+  Scenario: User preference is exposed in config initial state
+    Given as user "admin"
+    And run the command "user:setting admin libresign policy_workbench_catalog_compact_view --delete" with result code 0
+    When run the command "user:setting admin libresign policy_workbench_catalog_compact_view 1" with result code 0
+    Then sending "get" to "/settings/admin/libresign"
+    And the response should contain the initial state "libresign-config" json that match with:
+      | key                                        | value |
+      | (jq).policy_workbench_catalog_compact_view | true  |
+    And run the command "user:setting admin libresign policy_workbench_catalog_compact_view --delete" with result code 0
diff --git a/tests/integration/features/admin/policies.feature b/tests/integration/features/admin/policies.feature
new file mode 100644
index 0000000000..7893889ec5
--- /dev/null
+++ b/tests/integration/features/admin/policies.feature
@@ -0,0 +1,75 @@
+Feature: admin/policies
+  Scenario: Manage signature_flow policy layers through API
+    Given as user "admin"
+    And user "signer1" exists
+
+    When sending "delete" to ocs "/apps/libresign/api/v1/policies/user/admin/signature_flow"
+    Then the response should have a status code 200
+
+    When sending "delete" to ocs "/apps/libresign/api/v1/policies/group/admin/signature_flow"
+    Then the response should have a status code 200
+
+    When sending "post" to ocs "/apps/libresign/api/v1/policies/system/signature_flow"
+      | value              | ordered_numeric |
+      | allowChildOverride | true            |
+    Then the response should have a status code 200
+    And the response should be a JSON array with the following mandatory values
+      | key                                | value           |
+      | (jq).ocs.data.policy.policyKey     | signature_flow  |
+      | (jq).ocs.data.policy.sourceScope   | global          |
+      | (jq).ocs.data.policy.effectiveValue| ordered_numeric |
+
+    When sending "put" to ocs "/apps/libresign/api/v1/policies/group/admin/signature_flow"
+      | value              | ordered_numeric |
+      | allowChildOverride | true            |
+    Then the response should have a status code 200
+    And the response should be a JSON array with the following mandatory values
+      | key                                  | value           |
+      | (jq).ocs.data.policy.policyKey       | signature_flow  |
+      | (jq).ocs.data.policy.scope           | group           |
+      | (jq).ocs.data.policy.targetId        | admin           |
+      | (jq).ocs.data.policy.allowChildOverride | true         |
+
+    When sending "get" to ocs "/apps/libresign/api/v1/policies/group/admin/signature_flow"
+    Then the response should have a status code 200
+    And the response should be a JSON array with the following mandatory values
+      | key                                | value           |
+      | (jq).ocs.data.policy.policyKey     | signature_flow  |
+      | (jq).ocs.data.policy.scope         | group           |
+      | (jq).ocs.data.policy.targetId      | admin           |
+
+    When sending "put" to ocs "/apps/libresign/api/v1/policies/user/signer1/signature_flow"
+      | value | parallel |
+    Then the response should have a status code 200
+    And the response should be a JSON array with the following mandatory values
+      | key                            | value          |
+      | (jq).ocs.data.policy.policyKey | signature_flow |
+      | (jq).ocs.data.policy.scope     | user           |
+      | (jq).ocs.data.policy.targetId  | signer1        |
+      | (jq).ocs.data.policy.value     | parallel       |
+
+    Given as user "signer1"
+    When sending "get" to ocs "/apps/libresign/api/v1/policies/effective"
+    Then the response should have a status code 200
+    And the response should be a JSON array with the following mandatory values
+      | key                                                      | value    |
+      | (jq).ocs.data.policies.signature_flow.effectiveValue    | parallel |
+      | (jq).ocs.data.policies.signature_flow.sourceScope       | user     |
+
+    Given as user "admin"
+    When sending "delete" to ocs "/apps/libresign/api/v1/policies/user/signer1/signature_flow"
+    Then the response should have a status code 200
+
+    Given as user "signer1"
+    When sending "get" to ocs "/apps/libresign/api/v1/policies/effective"
+    Then the response should have a status code 200
+    And the response should be a JSON array with the following mandatory values
+      | key                                                      | value           |
+      | (jq).ocs.data.policies.signature_flow.effectiveValue    | ordered_numeric |
+
+    Given as user "admin"
+    When sending "delete" to ocs "/apps/libresign/api/v1/policies/group/admin/signature_flow"
+    Then the response should have a status code 200
+
+    When sending "post" to ocs "/apps/libresign/api/v1/policies/system/signature_flow"
+    Then the response should have a status code 200
diff --git a/tests/integration/features/sign/signed.feature b/tests/integration/features/sign/signed.feature
index 8ac1ff9d5c..d10ef68824 100644
--- a/tests/integration/features/sign/signed.feature
+++ b/tests/integration/features/sign/signed.feature
@@ -8,7 +8,6 @@ Feature: signed
     And run the command "libresign:install --use-local-cert --pdftk" with result code 0
     And run the command "libresign:configure:openssl --cn=Common\ Name --c=BR --o=Organization --st=State\ of\ Company --l=City\ Name --ou=Organization\ Unit" with result code 0
     And run the command "config:app:set libresign add_footer --value=true --type=boolean" with result code 0
-    And run the command "config:app:set libresign write_qrcode_on_footer --value=true --type=boolean" with result code 0
     And sending "post" to ocs "/apps/libresign/api/v1/admin/tsa"
       | tsa_url        | <TSA_URL> |
       | tsa_policy_oid | 1.2.3.4.1 |
diff --git a/tests/php/Unit/Controller/PageControllerTest.php b/tests/php/Unit/Controller/PageControllerTest.php
index aa5f6454a0..cfeaae6792 100644
--- a/tests/php/Unit/Controller/PageControllerTest.php
+++ b/tests/php/Unit/Controller/PageControllerTest.php
@@ -18,6 +18,7 @@
 use OCA\Libresign\Service\File\FileListService;
 use OCA\Libresign\Service\FileService;
 use OCA\Libresign\Service\IdentifyMethodService;
+use OCA\Libresign\Service\Policy\PolicyService;
 use OCA\Libresign\Service\RequestSignatureService;
 use OCA\Libresign\Service\SessionService;
 use OCA\Libresign\Service\SignerElementsService;
@@ -98,6 +99,9 @@ public function setUp(): void {
 			accountService: $this->accountService,
 			signFileService: $this->signFileService,
 			requestSignatureService: \OCP\Server::get(RequestSignatureService::class),
+			policyService: $this->createConfiguredMock(PolicyService::class, [
+				'resolveKnownPolicies' => [],
+			]),
 			signerElementsService: $this->signerElementsService,
 			l10n: $this->createMock(IL10N::class),
 			identifyMethodService: $this->createConfiguredMock(IdentifyMethodService::class, [
diff --git a/tests/php/Unit/Controller/PolicyControllerTest.php b/tests/php/Unit/Controller/PolicyControllerTest.php
new file mode 100644
index 0000000000..1b93fe90f7
--- /dev/null
+++ b/tests/php/Unit/Controller/PolicyControllerTest.php
@@ -0,0 +1,665 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Libresign\Tests\Unit\Controller;
+
+use OCA\Libresign\Controller\PolicyController;
+use OCA\Libresign\Service\Policy\Model\PolicyLayer;
+use OCA\Libresign\Service\Policy\Model\ResolvedPolicy;
+use OCA\Libresign\Service\Policy\PolicyService;
+use OCP\AppFramework\Http;
+use OCP\Group\ISubAdmin;
+use OCP\IGroup;
+use OCP\IGroupManager;
+use OCP\IL10N;
+use OCP\IRequest;
+use OCP\IUser;
+use OCP\IUserSession;
+use PHPUnit\Framework\MockObject\MockObject;
+use PHPUnit\Framework\TestCase;
+
+final class PolicyControllerTest extends TestCase {
+	private IRequest&MockObject $request;
+	private IL10N&MockObject $l10n;
+	private PolicyService&MockObject $policyService;
+	private IUserSession&MockObject $userSession;
+	private IGroupManager&MockObject $groupManager;
+	private ISubAdmin&MockObject $subAdmin;
+	private IUser&MockObject $currentUser;
+	private PolicyController $controller;
+
+	protected function setUp(): void {
+		$this->request = $this->createMock(IRequest::class);
+		$this->request
+			->method('getParam')
+			->willReturnCallback(static fn (string $key, mixed $default = null): mixed => $default);
+		$this->request
+			->method('getParams')
+			->willReturn([]);
+		$this->l10n = $this->createMock(IL10N::class);
+		$this->policyService = $this->createMock(PolicyService::class);
+		$this->userSession = $this->createMock(IUserSession::class);
+		$this->groupManager = $this->createMock(IGroupManager::class);
+		$this->subAdmin = $this->createMock(ISubAdmin::class);
+		$this->currentUser = $this->createMock(IUser::class);
+		$this->currentUser
+			->method('getUID')
+			->willReturn('admin');
+		$this->userSession
+			->method('getUser')
+			->willReturn($this->currentUser);
+
+		$this->controller = new PolicyController(
+			$this->request,
+			$this->l10n,
+			$this->policyService,
+			$this->userSession,
+			$this->groupManager,
+			$this->subAdmin,
+		);
+	}
+
+	public function testEffectiveReturnsResolvedSignatureFlowPolicy(): void {
+		$resolvedPolicy = (new ResolvedPolicy())
+			->setPolicyKey('signature_flow')
+			->setEffectiveValue('ordered_numeric')
+			->setSourceScope('group')
+			->setVisible(true)
+			->setEditableByCurrentActor(false)
+			->setAllowedValues(['ordered_numeric'])
+			->setCanSaveAsUserDefault(false)
+			->setCanUseAsRequestOverride(false)
+			->setPreferenceWasCleared(false)
+			->setBlockedBy('group');
+
+		$this->policyService
+			->expects($this->once())
+			->method('resolveKnownPolicies')
+			->willReturn([
+				'signature_flow' => $resolvedPolicy,
+			]);
+
+		$response = $this->controller->effective();
+
+		$this->assertSame(Http::STATUS_OK, $response->getStatus());
+		$this->assertSame([
+			'policies' => [
+				'signature_flow' => [
+					'policyKey' => 'signature_flow',
+					'effectiveValue' => 'ordered_numeric',
+					'sourceScope' => 'group',
+					'visible' => true,
+					'editableByCurrentActor' => false,
+					'allowedValues' => ['ordered_numeric'],
+					'canSaveAsUserDefault' => false,
+					'canUseAsRequestOverride' => false,
+					'preferenceWasCleared' => false,
+					'blockedBy' => 'group',
+				],
+			],
+		], $response->getData());
+	}
+
+	public function testSetSystemReturnsSavedResolvedPolicy(): void {
+		$resolvedPolicy = (new ResolvedPolicy())
+			->setPolicyKey('signature_flow')
+			->setEffectiveValue('ordered_numeric')
+			->setSourceScope('system')
+			->setVisible(true)
+			->setEditableByCurrentActor(true)
+			->setAllowedValues(['none', 'parallel', 'ordered_numeric'])
+			->setCanSaveAsUserDefault(true)
+			->setCanUseAsRequestOverride(false)
+			->setPreferenceWasCleared(false)
+			->setBlockedBy(null);
+
+		$this->l10n
+			->expects($this->once())
+			->method('t')
+			->with('Settings saved')
+			->willReturn('Settings saved');
+
+		$this->policyService
+			->expects($this->once())
+			->method('saveSystem')
+			->with('signature_flow', 'ordered_numeric', false)
+			->willReturn($resolvedPolicy);
+
+		$response = $this->controller->setSystem('signature_flow', 'ordered_numeric');
+
+		$this->assertSame(Http::STATUS_OK, $response->getStatus());
+		$this->assertSame([
+			'message' => 'Settings saved',
+			'policy' => [
+				'policyKey' => 'signature_flow',
+				'effectiveValue' => 'ordered_numeric',
+				'sourceScope' => 'system',
+				'visible' => true,
+				'editableByCurrentActor' => true,
+				'allowedValues' => ['none', 'parallel', 'ordered_numeric'],
+				'canSaveAsUserDefault' => true,
+				'canUseAsRequestOverride' => false,
+				'preferenceWasCleared' => false,
+				'blockedBy' => null,
+			],
+		], $response->getData());
+	}
+
+	public function testSetSystemForwardsAllowChildOverrideWhenProvided(): void {
+		$resolvedPolicy = (new ResolvedPolicy())
+			->setPolicyKey('signature_flow')
+			->setEffectiveValue('ordered_numeric')
+			->setSourceScope('system')
+			->setVisible(true)
+			->setEditableByCurrentActor(true)
+			->setAllowedValues([])
+			->setCanSaveAsUserDefault(true)
+			->setCanUseAsRequestOverride(true)
+			->setPreferenceWasCleared(false)
+			->setBlockedBy(null);
+
+		$this->l10n
+			->expects($this->once())
+			->method('t')
+			->with('Settings saved')
+			->willReturn('Settings saved');
+
+		$this->policyService
+			->expects($this->once())
+			->method('saveSystem')
+			->with('signature_flow', 'ordered_numeric', true)
+			->willReturn($resolvedPolicy);
+
+		$response = $this->controller->setSystem('signature_flow', 'ordered_numeric', true);
+
+		$this->assertSame(Http::STATUS_OK, $response->getStatus());
+	}
+
+	public function testSetSystemReturnsBadRequestWhenPolicyValueIsInvalid(): void {
+		$this->l10n
+			->expects($this->once())
+			->method('t')
+			->with('Invalid value for signature_flow')
+			->willReturn('Invalid value for signature_flow');
+
+		$this->policyService
+			->expects($this->once())
+			->method('saveSystem')
+			->with('signature_flow', 'banana', false)
+			->willThrowException(new \InvalidArgumentException('Invalid value for signature_flow'));
+
+		$response = $this->controller->setSystem('signature_flow', 'banana');
+
+		$this->assertSame(Http::STATUS_BAD_REQUEST, $response->getStatus());
+		$this->assertSame([
+			'error' => 'Invalid value for signature_flow',
+		], $response->getData());
+	}
+
+	public function testSetSystemBubblesUnexpectedExceptions(): void {
+		$this->policyService
+			->expects($this->once())
+			->method('saveSystem')
+			->with('signature_flow', 'ordered_numeric', false)
+			->willThrowException(new \RuntimeException('Unexpected policy failure'));
+
+		$this->expectException(\RuntimeException::class);
+		$this->expectExceptionMessage('Unexpected policy failure');
+
+		$this->controller->setSystem('signature_flow', 'ordered_numeric');
+	}
+
+	public function testSetUserPreferenceReturnsSavedResolvedPolicy(): void {
+		$resolvedPolicy = (new ResolvedPolicy())
+			->setPolicyKey('signature_flow')
+			->setEffectiveValue('parallel')
+			->setSourceScope('user')
+			->setVisible(true)
+			->setEditableByCurrentActor(true)
+			->setAllowedValues(['parallel', 'ordered_numeric'])
+			->setCanSaveAsUserDefault(true)
+			->setCanUseAsRequestOverride(true)
+			->setPreferenceWasCleared(false)
+			->setBlockedBy(null);
+
+		$this->l10n
+			->expects($this->once())
+			->method('t')
+			->with('Settings saved')
+			->willReturn('Settings saved');
+
+		$this->policyService
+			->expects($this->once())
+			->method('saveUserPreference')
+			->with('signature_flow', 'parallel')
+			->willReturn($resolvedPolicy);
+
+		$response = $this->controller->setUserPreference('signature_flow', 'parallel');
+
+		$this->assertSame(Http::STATUS_OK, $response->getStatus());
+		$this->assertSame('user', $response->getData()['policy']['sourceScope']);
+	}
+
+	public function testGetGroupReturnsStoredGroupPolicy(): void {
+		$this->groupManager
+			->method('isAdmin')
+			->with('admin')
+			->willReturn(true);
+
+		$this->policyService
+			->expects($this->once())
+			->method('getGroupPolicy')
+			->with('signature_flow', 'finance')
+			->willReturn((new PolicyLayer())
+				->setScope('group')
+				->setValue('parallel')
+				->setAllowChildOverride(true)
+				->setVisibleToChild(true)
+				->setAllowedValues([]));
+
+		$response = $this->controller->getGroup('finance', 'signature_flow');
+
+		$this->assertSame(Http::STATUS_OK, $response->getStatus());
+		$this->assertSame([
+			'policy' => [
+				'policyKey' => 'signature_flow',
+				'scope' => 'group',
+				'targetId' => 'finance',
+				'value' => 'parallel',
+				'allowChildOverride' => true,
+				'visibleToChild' => true,
+				'allowedValues' => [],
+			],
+		], $response->getData());
+	}
+
+	public function testSetGroupReturnsSavedGroupPolicy(): void {
+		$this->groupManager
+			->method('isAdmin')
+			->with('admin')
+			->willReturn(true);
+
+		$this->l10n
+			->expects($this->once())
+			->method('t')
+			->with('Settings saved')
+			->willReturn('Settings saved');
+
+		$this->policyService
+			->expects($this->once())
+			->method('saveGroupPolicy')
+			->with('signature_flow', 'finance', 'ordered_numeric', false)
+			->willReturn((new PolicyLayer())
+				->setScope('group')
+				->setValue('ordered_numeric')
+				->setAllowChildOverride(false)
+				->setVisibleToChild(true)
+				->setAllowedValues(['ordered_numeric']));
+
+		$response = $this->controller->setGroup('finance', 'signature_flow', 'ordered_numeric', false);
+
+		$this->assertSame(Http::STATUS_OK, $response->getStatus());
+		$this->assertSame('group', $response->getData()['policy']['scope']);
+		$this->assertSame('finance', $response->getData()['policy']['targetId']);
+	}
+
+	public function testSetGroupReadsBodyParamsFromRequest(): void {
+		$request = $this->createMock(IRequest::class);
+		$request
+			->method('getParam')
+			->willReturnCallback(static fn (string $key, mixed $default = null): mixed => $default);
+		$request
+			->method('getParams')
+			->willReturn([
+				'value' => 'ordered_numeric',
+				'allowChildOverride' => false,
+			]);
+		$controller = new PolicyController(
+			$request,
+			$this->l10n,
+			$this->policyService,
+			$this->userSession,
+			$this->groupManager,
+			$this->subAdmin,
+		);
+
+		$this->groupManager
+			->method('isAdmin')
+			->with('admin')
+			->willReturn(true);
+
+		$this->l10n
+			->expects($this->once())
+			->method('t')
+			->with('Settings saved')
+			->willReturn('Settings saved');
+
+		$this->policyService
+			->expects($this->once())
+			->method('saveGroupPolicy')
+			->with('signature_flow', 'finance', 'ordered_numeric', false)
+			->willReturn((new PolicyLayer())
+				->setScope('group')
+				->setValue('ordered_numeric')
+				->setAllowChildOverride(false)
+				->setVisibleToChild(true)
+				->setAllowedValues(['ordered_numeric']));
+
+		$response = $controller->setGroup('finance', 'signature_flow');
+
+		$this->assertSame(Http::STATUS_OK, $response->getStatus());
+		$this->assertSame('ordered_numeric', $response->getData()['policy']['value']);
+		$this->assertFalse($response->getData()['policy']['allowChildOverride']);
+	}
+
+	public function testSetGroupIgnoresStringAllowChildOverrideFromRequest(): void {
+		$request = $this->createMock(IRequest::class);
+		$request
+			->method('getParam')
+			->willReturnCallback(static fn (string $key, mixed $default = null): mixed => $default);
+		$request
+			->method('getParams')
+			->willReturn([
+				'value' => 'ordered_numeric',
+				'allowChildOverride' => 'true',
+			]);
+		$controller = new PolicyController(
+			$request,
+			$this->l10n,
+			$this->policyService,
+			$this->userSession,
+			$this->groupManager,
+			$this->subAdmin,
+		);
+
+		$this->groupManager
+			->method('isAdmin')
+			->with('admin')
+			->willReturn(true);
+
+		$this->l10n
+			->expects($this->once())
+			->method('t')
+			->with('Settings saved')
+			->willReturn('Settings saved');
+
+		$this->policyService
+			->expects($this->once())
+			->method('saveGroupPolicy')
+			->with('signature_flow', 'finance', 'ordered_numeric', false)
+			->willReturn((new PolicyLayer())
+				->setScope('group')
+				->setValue('ordered_numeric')
+				->setAllowChildOverride(false)
+				->setVisibleToChild(true)
+				->setAllowedValues(['ordered_numeric']));
+
+		$response = $controller->setGroup('finance', 'signature_flow');
+
+		$this->assertSame(Http::STATUS_OK, $response->getStatus());
+		$this->assertFalse($response->getData()['policy']['allowChildOverride']);
+	}
+
+	public function testGetGroupReturnsForbiddenWhenUserCannotManageTargetGroup(): void {
+		$this->userSession
+			->method('getUser')
+			->willReturn(null);
+		$this->l10n
+			->expects($this->once())
+			->method('t')
+			->with('Not allowed to manage this group policy')
+			->willReturn('Not allowed to manage this group policy');
+
+		$response = $this->controller->getGroup('finance', 'signature_flow');
+
+		$this->assertSame(Http::STATUS_FORBIDDEN, $response->getStatus());
+		$this->assertSame([
+			'error' => 'Not allowed to manage this group policy',
+		], $response->getData());
+	}
+
+	public function testSetGroupAllowsSubAdminOfTargetGroup(): void {
+		$group = $this->createMock(IGroup::class);
+		$this->groupManager
+			->method('isAdmin')
+			->with('admin')
+			->willReturn(false);
+		$this->groupManager
+			->method('get')
+			->with('finance')
+			->willReturn($group);
+		$this->subAdmin
+			->method('isSubAdminOfGroup')
+			->with($this->currentUser, $group)
+			->willReturn(true);
+
+		$this->l10n
+			->expects($this->once())
+			->method('t')
+			->with('Settings saved')
+			->willReturn('Settings saved');
+		$this->policyService
+			->expects($this->once())
+			->method('saveGroupPolicy')
+			->with('signature_flow', 'finance', 'parallel', true)
+			->willReturn((new PolicyLayer())
+				->setScope('group')
+				->setValue('parallel')
+				->setAllowChildOverride(true)
+				->setVisibleToChild(true)
+				->setAllowedValues(['parallel', 'ordered_numeric']));
+
+		$response = $this->controller->setGroup('finance', 'signature_flow', 'parallel', true);
+
+		$this->assertSame(Http::STATUS_OK, $response->getStatus());
+	}
+
+	public function testSetGroupBubblesUnexpectedExceptions(): void {
+		$this->groupManager
+			->method('isAdmin')
+			->with('admin')
+			->willReturn(true);
+
+		$this->policyService
+			->expects($this->once())
+			->method('saveGroupPolicy')
+			->with('signature_flow', 'finance', 'ordered_numeric', false)
+			->willThrowException(new \RuntimeException('Unexpected policy failure'));
+
+		$this->expectException(\RuntimeException::class);
+		$this->expectExceptionMessage('Unexpected policy failure');
+
+		$this->controller->setGroup('finance', 'signature_flow', 'ordered_numeric');
+	}
+
+	public function testClearGroupBubblesUnexpectedExceptions(): void {
+		$this->groupManager
+			->method('isAdmin')
+			->with('admin')
+			->willReturn(true);
+
+		$this->policyService
+			->expects($this->once())
+			->method('clearGroupPolicy')
+			->with('signature_flow', 'finance')
+			->willThrowException(new \RuntimeException('Unexpected policy failure'));
+
+		$this->expectException(\RuntimeException::class);
+		$this->expectExceptionMessage('Unexpected policy failure');
+
+		$this->controller->clearGroup('finance', 'signature_flow');
+	}
+
+	public function testSetUserPolicyForTargetUserReturnsSavedExplicitPolicy(): void {
+		$persistedPolicy = (new PolicyLayer())
+			->setScope('user')
+			->setValue('ordered_numeric');
+
+		$this->l10n
+			->expects($this->once())
+			->method('t')
+			->with('Settings saved')
+			->willReturn('Settings saved');
+
+		$this->policyService
+			->expects($this->once())
+			->method('saveUserPreferenceForUserId')
+			->with('signature_flow', 'user1', 'ordered_numeric')
+			->willReturn($persistedPolicy);
+
+		$response = $this->controller->setUserPolicyForUser('user1', 'signature_flow', 'ordered_numeric');
+
+		$this->assertSame(Http::STATUS_OK, $response->getStatus());
+		$this->assertSame('user', $response->getData()['policy']['scope']);
+		$this->assertSame('user1', $response->getData()['policy']['targetId']);
+		$this->assertSame('ordered_numeric', $response->getData()['policy']['value']);
+	}
+
+	public function testClearUserPolicyForTargetUserReturnsClearedExplicitPolicy(): void {
+		$this->l10n
+			->expects($this->once())
+			->method('t')
+			->with('Settings saved')
+			->willReturn('Settings saved');
+
+		$this->policyService
+			->expects($this->once())
+			->method('clearUserPreferenceForUserId')
+			->with('signature_flow', 'user1')
+			->willReturn(null);
+
+		$response = $this->controller->clearUserPolicyForUser('user1', 'signature_flow');
+
+		$this->assertSame(Http::STATUS_OK, $response->getStatus());
+		$this->assertSame('user', $response->getData()['policy']['scope']);
+		$this->assertSame('user1', $response->getData()['policy']['targetId']);
+		$this->assertNull($response->getData()['policy']['value']);
+	}
+
+	public function testSetUserPolicyForTargetUserReturnsBadRequestWhenServiceBlocksSave(): void {
+		$this->l10n
+			->expects($this->once())
+			->method('t')
+			->with('Saving a user preference is not allowed for signature_flow')
+			->willReturn('Saving a user preference is not allowed for signature_flow');
+
+		$this->policyService
+			->expects($this->once())
+			->method('saveUserPreferenceForUserId')
+			->with('signature_flow', 'user1', 'ordered_numeric')
+			->willThrowException(new \InvalidArgumentException('Saving a user preference is not allowed for signature_flow'));
+
+		$response = $this->controller->setUserPolicyForUser('user1', 'signature_flow', 'ordered_numeric');
+
+		$this->assertSame(Http::STATUS_BAD_REQUEST, $response->getStatus());
+		$this->assertSame([
+			'error' => 'Saving a user preference is not allowed for signature_flow',
+		], $response->getData());
+	}
+
+	public function testSetUserPreferenceBubblesUnexpectedExceptions(): void {
+		$this->policyService
+			->expects($this->once())
+			->method('saveUserPreference')
+			->with('signature_flow', 'parallel')
+			->willThrowException(new \RuntimeException('Unexpected policy failure'));
+
+		$this->expectException(\RuntimeException::class);
+		$this->expectExceptionMessage('Unexpected policy failure');
+
+		$this->controller->setUserPreference('signature_flow', 'parallel');
+	}
+
+	public function testSetUserPolicyForTargetUserBubblesUnexpectedExceptions(): void {
+		$this->policyService
+			->expects($this->once())
+			->method('saveUserPreferenceForUserId')
+			->with('signature_flow', 'user1', 'ordered_numeric')
+			->willThrowException(new \RuntimeException('Unexpected policy failure'));
+
+		$this->expectException(\RuntimeException::class);
+		$this->expectExceptionMessage('Unexpected policy failure');
+
+		$this->controller->setUserPolicyForUser('user1', 'signature_flow', 'ordered_numeric');
+	}
+
+	public function testClearUserPreferenceBubblesUnexpectedExceptions(): void {
+		$this->policyService
+			->expects($this->once())
+			->method('clearUserPreference')
+			->with('signature_flow')
+			->willThrowException(new \RuntimeException('Unexpected policy failure'));
+
+		$this->expectException(\RuntimeException::class);
+		$this->expectExceptionMessage('Unexpected policy failure');
+
+		$this->controller->clearUserPreference('signature_flow');
+	}
+
+	public function testClearUserPolicyForTargetUserBubblesUnexpectedExceptions(): void {
+		$this->policyService
+			->expects($this->once())
+			->method('clearUserPreferenceForUserId')
+			->with('signature_flow', 'user1')
+			->willThrowException(new \RuntimeException('Unexpected policy failure'));
+
+		$this->expectException(\RuntimeException::class);
+		$this->expectExceptionMessage('Unexpected policy failure');
+
+		$this->controller->clearUserPolicyForUser('user1', 'signature_flow');
+	}
+
+	public function testSetUserPreferenceReadsBodyParamsFromRequest(): void {
+		$request = $this->createMock(IRequest::class);
+		$request
+			->method('getParam')
+			->willReturnCallback(static fn (string $key, mixed $default = null): mixed => $default);
+		$request
+			->method('getParams')
+			->willReturn([
+				'value' => 'parallel',
+			]);
+		$controller = new PolicyController(
+			$request,
+			$this->l10n,
+			$this->policyService,
+			$this->userSession,
+			$this->groupManager,
+			$this->subAdmin,
+		);
+
+		$resolvedPolicy = (new ResolvedPolicy())
+			->setPolicyKey('signature_flow')
+			->setEffectiveValue('parallel')
+			->setSourceScope('user')
+			->setVisible(true)
+			->setEditableByCurrentActor(true)
+			->setAllowedValues(['parallel', 'ordered_numeric'])
+			->setCanSaveAsUserDefault(true)
+			->setCanUseAsRequestOverride(true)
+			->setPreferenceWasCleared(false)
+			->setBlockedBy(null);
+
+		$this->l10n
+			->expects($this->once())
+			->method('t')
+			->with('Settings saved')
+			->willReturn('Settings saved');
+
+		$this->policyService
+			->expects($this->once())
+			->method('saveUserPreference')
+			->with('signature_flow', 'parallel')
+			->willReturn($resolvedPolicy);
+
+		$response = $controller->setUserPreference('signature_flow');
+
+		$this->assertSame(Http::STATUS_OK, $response->getStatus());
+		$this->assertSame('parallel', $response->getData()['policy']['effectiveValue']);
+	}
+}
diff --git a/tests/php/Unit/Db/PermissionSetBindingTest.php b/tests/php/Unit/Db/PermissionSetBindingTest.php
new file mode 100644
index 0000000000..bf03d01227
--- /dev/null
+++ b/tests/php/Unit/Db/PermissionSetBindingTest.php
@@ -0,0 +1,41 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Libresign\Tests\Unit\Db;
+
+use OCA\Libresign\Db\PermissionSetBinding;
+use PHPUnit\Framework\TestCase;
+
+final class PermissionSetBindingTest extends TestCase {
+	public function testDefaultValuesAreEmpty(): void {
+		$binding = new PermissionSetBinding();
+
+		$this->assertSame('', $binding->getTargetType());
+		$this->assertSame('', $binding->getTargetId());
+	}
+
+	public function testSetCreatedAtAcceptsString(): void {
+		$binding = new PermissionSetBinding();
+
+		$binding->setCreatedAt('2026-03-17 12:00:00');
+
+		$this->assertInstanceOf(\DateTime::class, $binding->getCreatedAt());
+		$this->assertSame('2026-03-17 12:00:00', $binding->getCreatedAt()->format('Y-m-d H:i:s'));
+	}
+
+	public function testBindingStoresPermissionSetAndTarget(): void {
+		$binding = new PermissionSetBinding();
+		$binding->setPermissionSetId(42);
+		$binding->setTargetType('group');
+		$binding->setTargetId('finance');
+
+		$this->assertSame(42, $binding->getPermissionSetId());
+		$this->assertSame('group', $binding->getTargetType());
+		$this->assertSame('finance', $binding->getTargetId());
+	}
+}
diff --git a/tests/php/Unit/Db/PermissionSetTest.php b/tests/php/Unit/Db/PermissionSetTest.php
new file mode 100644
index 0000000000..1729b2b330
--- /dev/null
+++ b/tests/php/Unit/Db/PermissionSetTest.php
@@ -0,0 +1,95 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Libresign\Tests\Unit\Db;
+
+use OCA\Libresign\Db\PermissionSet;
+use PHPUnit\Framework\TestCase;
+
+final class PermissionSetTest extends TestCase {
+	public function testIsEnabledReturnsTrueByDefault(): void {
+		$permissionSet = new PermissionSet();
+
+		$this->assertTrue($permissionSet->isEnabled());
+		$this->assertSame([], $permissionSet->getDecodedPolicyJson());
+	}
+
+	public function testSetEnabledStoresBooleanAsFlag(): void {
+		$permissionSet = new PermissionSet();
+
+		$permissionSet->setEnabled(false);
+		$this->assertFalse($permissionSet->isEnabled());
+
+		$permissionSet->setEnabled(true);
+		$this->assertTrue($permissionSet->isEnabled());
+	}
+
+	public function testSetCreatedAtAndUpdatedAtAcceptStrings(): void {
+		$permissionSet = new PermissionSet();
+
+		$permissionSet->setCreatedAt('2026-03-17 10:00:00');
+		$permissionSet->setUpdatedAt('2026-03-17 11:00:00');
+
+		$this->assertInstanceOf(\DateTime::class, $permissionSet->getCreatedAt());
+		$this->assertInstanceOf(\DateTime::class, $permissionSet->getUpdatedAt());
+		$this->assertSame('2026-03-17 10:00:00', $permissionSet->getCreatedAt()->format('Y-m-d H:i:s'));
+		$this->assertSame('2026-03-17 11:00:00', $permissionSet->getUpdatedAt()->format('Y-m-d H:i:s'));
+	}
+
+	public function testPolicyJsonStoresStructuredPolicyData(): void {
+		$permissionSet = new PermissionSet();
+		$policyJson = [
+			'signature_flow' => [
+				'defaultValue' => ['type' => 'parallel'],
+				'allowChildOverride' => true,
+			],
+		];
+
+		$permissionSet->setPolicyJson($policyJson);
+
+		$this->assertSame($policyJson, $permissionSet->getDecodedPolicyJson());
+		$this->assertSame(json_encode($policyJson, JSON_THROW_ON_ERROR), $permissionSet->getPolicyJson());
+	}
+
+	public function testPolicyJsonIsDecodedWhenHydratingFromDatabaseRow(): void {
+		$permissionSet = PermissionSet::fromRow([
+			'id' => 7,
+			'name' => 'finance',
+			'description' => null,
+			'scope_type' => 'organization',
+			'enabled' => 1,
+			'priority' => 10,
+			'policy_json' => '{"signature_flow":{"defaultValue":"parallel","allowChildOverride":true}}',
+			'created_at' => '2026-03-17 10:00:00',
+			'updated_at' => '2026-03-17 11:00:00',
+		]);
+
+		$this->assertSame([
+			'signature_flow' => [
+				'defaultValue' => 'parallel',
+				'allowChildOverride' => true,
+			],
+		], $permissionSet->getDecodedPolicyJson());
+	}
+
+	public function testPolicyJsonFallsBackToEmptyArrayWhenLegacyValueIsInvalid(): void {
+		$permissionSet = PermissionSet::fromRow([
+			'id' => 8,
+			'name' => 'finance',
+			'description' => null,
+			'scope_type' => 'organization',
+			'enabled' => 1,
+			'priority' => 10,
+			'policy_json' => 'Array',
+			'created_at' => '2026-03-17 10:00:00',
+			'updated_at' => '2026-03-17 11:00:00',
+		]);
+
+		$this->assertSame([], $permissionSet->getDecodedPolicyJson());
+	}
+}
diff --git a/tests/php/Unit/Files/TemplateLoaderTest.php b/tests/php/Unit/Files/TemplateLoaderTest.php
index 28175e3197..82c727f3bb 100644
--- a/tests/php/Unit/Files/TemplateLoaderTest.php
+++ b/tests/php/Unit/Files/TemplateLoaderTest.php
@@ -15,10 +15,11 @@
 use OCA\Libresign\Service\AccountService;
 use OCA\Libresign\Service\DocMdp\ConfigService;
 use OCA\Libresign\Service\IdentifyMethodService;
+use OCA\Libresign\Service\Policy\Model\ResolvedPolicy;
+use OCA\Libresign\Service\Policy\PolicyService;
 use OCA\Libresign\Tests\Unit\TestCase;
 use OCP\App\IAppManager;
 use OCP\AppFramework\Services\IInitialState;
-use OCP\IAppConfig;
 use OCP\IRequest;
 use OCP\IUser;
 use OCP\IUserSession;
@@ -32,7 +33,7 @@ final class TemplateLoaderTest extends TestCase {
 	private ValidateHelper&MockObject $validateHelper;
 	private IdentifyMethodService&MockObject $identifyMethodService;
 	private CertificateEngineFactory&MockObject $certificateEngineFactory;
-	private IAppConfig&MockObject $appConfig;
+	private PolicyService&MockObject $policyService;
 	private IAppManager&MockObject $appManager;
 	private ConfigService&MockObject $docMdpConfigService;
 
@@ -44,7 +45,7 @@ public function setUp(): void {
 		$this->validateHelper = $this->createMock(ValidateHelper::class);
 		$this->identifyMethodService = $this->createMock(IdentifyMethodService::class);
 		$this->certificateEngineFactory = $this->createMock(CertificateEngineFactory::class);
-		$this->appConfig = $this->createMock(IAppConfig::class);
+		$this->policyService = $this->createMock(PolicyService::class);
 		$this->appManager = $this->createMock(IAppManager::class);
 		$this->docMdpConfigService = $this->createMock(ConfigService::class);
 	}
@@ -60,10 +61,6 @@ public function testGetInitialStatePayload(): void {
 			->method('getIdentifyMethodsSettings')
 			->willReturn([]);
 
-		$this->appConfig
-			->method('getValueString')
-			->willReturn('none');
-
 		$this->validateHelper
 			->method('canRequestSign');
 
@@ -72,6 +69,21 @@ public function testGetInitialStatePayload(): void {
 			->method('getUser')
 			->willReturn($user);
 
+		$this->policyService
+			->method('resolveKnownPolicies')
+			->willReturn([
+				'signature_flow'
+				=> (new ResolvedPolicy())
+					->setPolicyKey('signature_flow')
+					->setEffectiveValue('parallel')
+					->setSourceScope('group')
+					->setVisible(true)
+					->setEditableByCurrentActor(true)
+					->setAllowedValues(['parallel', 'ordered_numeric'])
+					->setCanSaveAsUserDefault(true)
+					->setCanUseAsRequestOverride(true)
+			]);
+
 		$docMdpConfig = [
 			'enabled' => true,
 			'defaultLevel' => 1,
@@ -87,7 +99,22 @@ public function testGetInitialStatePayload(): void {
 		$this->assertSame([
 			'certificate_ok' => true,
 			'identify_methods' => [],
-			'signature_flow' => 'none',
+			'effective_policies' => [
+				'policies' => [
+					'signature_flow' => [
+						'policyKey' => 'signature_flow',
+						'effectiveValue' => 'parallel',
+						'sourceScope' => 'group',
+						'visible' => true,
+						'editableByCurrentActor' => true,
+						'allowedValues' => ['parallel', 'ordered_numeric'],
+						'canSaveAsUserDefault' => true,
+						'canUseAsRequestOverride' => true,
+						'preferenceWasCleared' => false,
+						'blockedBy' => null,
+					],
+				],
+			],
 			'docmdp_config' => $docMdpConfig,
 			'can_request_sign' => true,
 		], $payload);
@@ -104,10 +131,6 @@ public function testGetInitialStatePayloadWhenCannotRequestSign(): void {
 			->method('getIdentifyMethodsSettings')
 			->willReturn([]);
 
-		$this->appConfig
-			->method('getValueString')
-			->willReturn('none');
-
 		$this->validateHelper
 			->method('canRequestSign')
 			->willThrowException(new \OCA\Libresign\Exception\LibresignException('no'));
@@ -117,6 +140,21 @@ public function testGetInitialStatePayloadWhenCannotRequestSign(): void {
 			->method('getUser')
 			->willReturn($user);
 
+		$this->policyService
+			->method('resolveKnownPolicies')
+			->willReturn([
+				'signature_flow'
+				=> (new ResolvedPolicy())
+					->setPolicyKey('signature_flow')
+					->setEffectiveValue('none')
+					->setSourceScope('system')
+					->setVisible(true)
+					->setEditableByCurrentActor(true)
+					->setAllowedValues(['none', 'parallel', 'ordered_numeric'])
+					->setCanSaveAsUserDefault(true)
+					->setCanUseAsRequestOverride(true)
+			]);
+
 		$this->docMdpConfigService
 			->method('getConfig')
 			->willReturn([]);
@@ -136,7 +174,7 @@ private function getLoader(): TemplateLoader {
 			$this->validateHelper,
 			$this->identifyMethodService,
 			$this->certificateEngineFactory,
-			$this->appConfig,
+			$this->policyService,
 			$this->appManager,
 			$this->docMdpConfigService,
 		);
diff --git a/tests/php/Unit/Handler/FooterHandlerTest.php b/tests/php/Unit/Handler/FooterHandlerTest.php
index 014a07c21e..ed0a1335e4 100644
--- a/tests/php/Unit/Handler/FooterHandlerTest.php
+++ b/tests/php/Unit/Handler/FooterHandlerTest.php
@@ -13,6 +13,10 @@
 use OCA\Libresign\Handler\FooterHandler;
 use OCA\Libresign\Handler\TemplateVariables;
 use OCA\Libresign\Service\File\Pdf\PdfMetadataExtractor;
+use OCA\Libresign\Service\Policy\Model\ResolvedPolicy;
+use OCA\Libresign\Service\Policy\PolicyService;
+use OCA\Libresign\Service\Policy\Provider\Footer\AddFooterPolicy;
+use OCA\Libresign\Service\Policy\Provider\Footer\SignatureFooterPolicyValue;
 use OCP\IAppConfig;
 use OCP\IL10N;
 use OCP\ITempManager;
@@ -25,6 +29,7 @@ final class FooterHandlerTest extends \OCA\Libresign\Tests\Unit\TestCase {
 	private IAppConfig $appConfig;
 	private PdfMetadataExtractor&MockObject $pdfMetadataExtractor;
 	private IURLGenerator&MockObject $urlGenerator;
+	private PolicyService&MockObject $policyService;
 	private IL10N $l10n;
 	private IFactory $l10nFactory;
 	private ITempManager $tempManager;
@@ -33,6 +38,23 @@ public function setUp(): void {
 		$this->appConfig = $this->getMockAppConfigWithReset();
 		$this->pdfMetadataExtractor = $this->createMock(PdfMetadataExtractor::class);
 		$this->urlGenerator = $this->createMock(IURLGenerator::class);
+		$this->policyService = $this->createMock(PolicyService::class);
+		$this->policyService
+			->method('resolve')
+			->willReturnCallback(function (string $policyKey): ResolvedPolicy {
+				$value = match ($policyKey) {
+					AddFooterPolicy::KEY => $this->appConfig->getValueString(Application::APP_ID, 'add_footer', '1'),
+					default => null,
+				};
+
+				return (new ResolvedPolicy())
+					->setPolicyKey($policyKey)
+					->setEffectiveValue($value)
+					->setSourceScope('system')
+					->setVisible(true)
+					->setEditableByCurrentActor(true)
+					->setAllowedValues([true, false]);
+			});
 		$this->tempManager = \OCP\Server::get(ITempManager::class);
 		$this->l10nFactory = \OCP\Server::get(IFactory::class);
 	}
@@ -46,13 +68,23 @@ private function getClass(): FooterHandler {
 			$this->l10n,
 			$this->l10nFactory,
 			$this->tempManager,
+			$this->policyService,
 			$templateVars,
 		);
 		return $this->footerHandler;
 	}
 
 	public function testGetFooterWithoutValidationSite(): void {
-		$this->appConfig->setValueBool(Application::APP_ID, 'add_footer', false);
+		$this->appConfig->setValueString(
+			Application::APP_ID,
+			'add_footer',
+			SignatureFooterPolicyValue::encode([
+				'enabled' => false,
+				'writeQrcodeOnFooter' => true,
+				'validationSite' => '',
+				'customizeFooterTemplate' => false,
+			]),
+		);
 		$dimensions = [['w' => 595, 'h' => 842]];
 		$this->l10n = $this->l10nFactory->get(Application::APP_ID);
 		$actual = $this->getClass()
@@ -64,6 +96,20 @@ public function testGetFooterWithoutValidationSite(): void {
 	#[DataProvider('dataGetFooterWithSuccess')]
 	public function testGetFooterWithSuccess(string $language, array $settings, array $expected): void {
 		foreach ($settings as $key => $value) {
+			if ($key === 'add_footer') {
+				$this->appConfig->setValueString(
+					Application::APP_ID,
+					'add_footer',
+					SignatureFooterPolicyValue::encode([
+						'enabled' => (bool)$value,
+						'writeQrcodeOnFooter' => true,
+						'validationSite' => '',
+						'customizeFooterTemplate' => false,
+					]),
+				);
+				continue;
+			}
+
 			switch (gettype($value)) {
 				case 'boolean':
 					$this->appConfig->setValueBool(Application::APP_ID, $key, $value);
@@ -92,7 +138,7 @@ public function testGetFooterWithSuccess(string $language, array $settings, arra
 				array_keys($expected),
 				$this->l10nFactory->getLanguageDirection($language)
 			);
-			if ($settings['write_qrcode_on_footer']) {
+			if (!empty($expected['qrcode'])) {
 				$this->assertNotEmpty($actual['qrcode'], 'Invalid qrcode content');
 				unset($actual['qrcode'], $expected['qrcode']);
 			}
@@ -113,7 +159,6 @@ public static function dataGetFooterWithSuccess(): array {
 				[
 					'add_footer' => true,
 					'validation_site' => 'http://test.coop',
-					'write_qrcode_on_footer' => true,
 					'footer_link_to_site' => 'https://libresign.coop',
 					'footer_signed_by' => 'Digital signed by LibreSign.',
 					'footer_validate_in' => 'Validate in %s.',
@@ -138,7 +183,6 @@ public static function dataGetFooterWithSuccess(): array {
 				[
 					'add_footer' => true,
 					'validation_site' => 'http://test.coop',
-					'write_qrcode_on_footer' => false,
 					'footer_link_to_site' => 'https://libresign.coop',
 					'footer_signed_by' => 'Digital signed by LibreSign.',
 					'footer_validate_in' => 'Validate in %s.',
@@ -159,7 +203,6 @@ public static function dataGetFooterWithSuccess(): array {
 				[
 					'add_footer' => true,
 					'validation_site' => 'http://test.coop',
-					'write_qrcode_on_footer' => false,
 					'footer_link_to_site' => 'https://libresign.coop',
 					'footer_signed_by' => 'Signé numériquement avec LibreSign.',
 					'footer_validate_in' => 'Validate in %s',
@@ -180,7 +223,6 @@ public static function dataGetFooterWithSuccess(): array {
 				[
 					'add_footer' => true,
 					'validation_site' => 'http://test.coop',
-					'write_qrcode_on_footer' => false,
 					'footer_link_to_site' => 'https://libresign.coop',
 					'footer_signed_by' => 'Το αρχείο υπάρχει',
 					'footer_validate_in' => 'Επικυρώστε στο %s.',
@@ -201,7 +243,6 @@ public static function dataGetFooterWithSuccess(): array {
 				[
 					'add_footer' => true,
 					'validation_site' => 'http://test.coop',
-					'write_qrcode_on_footer' => false,
 					'footer_link_to_site' => 'https://libresign.coop',
 					'footer_signed_by' => 'אין המלצות. נא להתחיל להקליד.',
 					'footer_validate_in' => 'אמת ב- %s.',
@@ -244,8 +285,16 @@ private function extractPdfContent(string $content, array $keys, string $directi
 	}
 
 	public function testGetFooterWithoutUuid(): void {
-		$this->appConfig->setValueBool(Application::APP_ID, 'add_footer', true);
-		$this->appConfig->setValueBool(Application::APP_ID, 'write_qrcode_on_footer', true);
+		$this->appConfig->setValueString(
+			Application::APP_ID,
+			'add_footer',
+			SignatureFooterPolicyValue::encode([
+				'enabled' => true,
+				'writeQrcodeOnFooter' => true,
+				'validationSite' => '',
+				'customizeFooterTemplate' => false,
+			]),
+		);
 		$this->appConfig->setValueString(Application::APP_ID, 'footer_template', '<div>{{ signedBy|raw }}</div>');
 
 		$dimensions = [['w' => 595, 'h' => 100]];
@@ -261,7 +310,16 @@ public function testGetFooterWithoutUuid(): void {
 	}
 
 	public function testCustomValidationSiteNotOverwritten(): void {
-		$this->appConfig->setValueBool(Application::APP_ID, 'add_footer', true);
+		$this->appConfig->setValueString(
+			Application::APP_ID,
+			'add_footer',
+			SignatureFooterPolicyValue::encode([
+				'enabled' => true,
+				'writeQrcodeOnFooter' => true,
+				'validationSite' => '',
+				'customizeFooterTemplate' => false,
+			]),
+		);
 		$this->appConfig->setValueString(Application::APP_ID, 'validation_site', 'https://default.site');
 		$this->appConfig->setValueString(Application::APP_ID, 'footer_template', '<div>{{ validationSite }}</div>');
 
@@ -333,8 +391,16 @@ public function testAccentedCharactersInFooterVariablesAreRenderedCorrectly(
 		array $expectedSubstrings,
 		array $forbiddenSubstrings,
 	): void {
-		$this->appConfig->setValueBool(Application::APP_ID, 'add_footer', true);
-		$this->appConfig->setValueBool(Application::APP_ID, 'write_qrcode_on_footer', false);
+		$this->appConfig->setValueString(
+			Application::APP_ID,
+			'add_footer',
+			SignatureFooterPolicyValue::encode([
+				'enabled' => true,
+				'writeQrcodeOnFooter' => true,
+				'validationSite' => '',
+				'customizeFooterTemplate' => false,
+			]),
+		);
 		$this->appConfig->deleteKey(Application::APP_ID, 'footer_template');
 
 		$dimensions = [['w' => 595, 'h' => 100]];
@@ -361,6 +427,38 @@ public function testAccentedCharactersInFooterVariablesAreRenderedCorrectly(
 		}
 	}
 
+	public function testPolicyCanDisableQrCodeRendering(): void {
+		$this->appConfig->setValueString(
+			Application::APP_ID,
+			'add_footer',
+			SignatureFooterPolicyValue::encode([
+				'enabled' => true,
+				'writeQrcodeOnFooter' => false,
+				'validationSite' => 'https://validation.example',
+				'customizeFooterTemplate' => false,
+			]),
+		);
+		$this->appConfig->setValueString(
+			Application::APP_ID,
+			'footer_template',
+			'<div>qrcode:{{ qrcode }} validateIn:{{ validationSite }}</div>',
+		);
+
+		$dimensions = [['w' => 595, 'h' => 100]];
+		$this->l10n = $this->l10nFactory->get(Application::APP_ID, 'en');
+
+		$pdf = $this->getClass()
+			->setTemplateVar('uuid', 'unit-test-uuid')
+			->getFooter($dimensions);
+
+		$this->assertNotEmpty($pdf);
+		$parser = new \Smalot\PdfParser\Parser();
+		$pdfParsed = $parser->parseContent($pdf);
+		$text = $pdfParsed->getText();
+		$this->assertStringContainsString('validateIn:https://validation.example/unit-test-uuid', str_replace(' ', '', $text));
+		$this->assertStringNotContainsString('iVBOR', $text);
+	}
+
 	public static function dataAccentedCharactersInFooter(): array {
 		return [
 			'French accents' => [
diff --git a/tests/php/Unit/Migration/Version18002Date20260410000000Test.php b/tests/php/Unit/Migration/Version18002Date20260410000000Test.php
new file mode 100644
index 0000000000..5e52dc8bce
--- /dev/null
+++ b/tests/php/Unit/Migration/Version18002Date20260410000000Test.php
@@ -0,0 +1,120 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Libresign\Tests\Unit\Migration;
+
+require_once __DIR__ . '/../../../../lib/Migration/Version18002Date20260410000000.php';
+
+use OCA\Libresign\AppInfo\Application;
+use OCA\Libresign\Migration\Version18002Date20260410000000;
+use OCA\Libresign\Service\Policy\Provider\Footer\SignatureFooterPolicyValue;
+use OCP\Exceptions\AppConfigTypeConflictException;
+use OCP\IAppConfig;
+use OCP\Migration\IOutput;
+use PHPUnit\Framework\MockObject\MockObject;
+use PHPUnit\Framework\TestCase;
+
+final class Version18002Date20260410000000Test extends TestCase {
+	private IAppConfig&MockObject $appConfig;
+
+	protected function setUp(): void {
+		parent::setUp();
+		$this->appConfig = $this->createMock(IAppConfig::class);
+	}
+
+	public function testMigratesLegacyFooterSettingsIntoStructuredPayload(): void {
+		$this->appConfig
+			->expects($this->exactly(4))
+			->method('getValueString')
+			->willReturnMap([
+				[Application::APP_ID, 'add_footer', '', '1'],
+				[Application::APP_ID, 'write_qrcode_on_footer', '', '0'],
+				[Application::APP_ID, 'validation_site', '', 'https://validator.example/base/'],
+				[Application::APP_ID, 'footer_template_is_default', '', '0'],
+			]);
+
+		$this->appConfig
+			->expects($this->once())
+			->method('deleteKey')
+			->with(Application::APP_ID, 'add_footer');
+
+		$this->appConfig
+			->expects($this->once())
+			->method('setValueString')
+			->with(
+				Application::APP_ID,
+				'add_footer',
+				SignatureFooterPolicyValue::encode([
+					'enabled' => true,
+					'writeQrcodeOnFooter' => false,
+					'validationSite' => 'https://validator.example/base/',
+					'customizeFooterTemplate' => true,
+				]),
+			);
+
+		$migration = new Version18002Date20260410000000($this->appConfig);
+		$migration->preSchemaChange($this->createMock(IOutput::class), static fn () => null, []);
+	}
+
+	public function testReadsLegacyBooleanWhenAddFooterHasTypedBoolValue(): void {
+		$this->appConfig
+			->expects($this->exactly(4))
+			->method('getValueString')
+			->willReturnCallback(static function (string $app, string $key, string $default): string {
+				if ($app !== Application::APP_ID) {
+					return $default;
+				}
+
+				if ($key === 'add_footer') {
+					throw new AppConfigTypeConflictException('bool stored');
+				}
+
+				if ($key === 'write_qrcode_on_footer') {
+					return '1';
+				}
+
+				if ($key === 'validation_site') {
+					return '';
+				}
+
+				if ($key === 'footer_template_is_default') {
+					return '1';
+				}
+
+				return $default;
+			});
+
+		$this->appConfig
+			->expects($this->once())
+			->method('getValueBool')
+			->with(Application::APP_ID, 'add_footer', true)
+			->willReturn(false);
+
+		$this->appConfig
+			->expects($this->once())
+			->method('deleteKey')
+			->with(Application::APP_ID, 'add_footer');
+
+		$this->appConfig
+			->expects($this->once())
+			->method('setValueString')
+			->with(
+				Application::APP_ID,
+				'add_footer',
+				SignatureFooterPolicyValue::encode([
+					'enabled' => false,
+					'writeQrcodeOnFooter' => true,
+					'validationSite' => '',
+					'customizeFooterTemplate' => false,
+				]),
+			);
+
+		$migration = new Version18002Date20260410000000($this->appConfig);
+		$migration->preSchemaChange($this->createMock(IOutput::class), static fn () => null, []);
+	}
+}
diff --git a/tests/php/Unit/Service/AccountServiceTest.php b/tests/php/Unit/Service/AccountServiceTest.php
index 040ac709f2..89ebf8e257 100644
--- a/tests/php/Unit/Service/AccountServiceTest.php
+++ b/tests/php/Unit/Service/AccountServiceTest.php
@@ -44,6 +44,7 @@
 use OCP\Files\IMimeTypeDetector;
 use OCP\Files\IRootFolder;
 use OCP\Files\NotFoundException;
+use OCP\Group\ISubAdmin;
 use OCP\IAppConfig;
 use OCP\IGroupManager;
 use OCP\IL10N;
@@ -77,6 +78,7 @@ final class AccountServiceTest extends \OCA\Libresign\Tests\Unit\TestCase {
 	private ValidateHelper&MockObject $validateHelper;
 	private IURLGenerator&MockObject $urlGenerator;
 	private IGroupManager&MockObject $groupManager;
+	private ISubAdmin&MockObject $subAdmin;
 	private IdDocsService&MockObject $idDocsService;
 	private SignerElementsService&MockObject $signerElementsService;
 	private UserElementMapper&MockObject $userElementMapper;
@@ -114,6 +116,7 @@ public function setUp(): void {
 		$this->urlGenerator = $this->createMock(IURLGenerator::class);
 		$this->pkcs12Handler = $this->createMock(Pkcs12Handler::class);
 		$this->groupManager = $this->createMock(IGroupManager::class);
+		$this->subAdmin = $this->createMock(ISubAdmin::class);
 		$this->idDocsService = $this->createMock(IdDocsService::class);
 		$this->signerElementsService = $this->createMock(SignerElementsService::class);
 		$this->userElementMapper = $this->createMock(UserElementMapper::class);
@@ -147,6 +150,7 @@ private function getService(): AccountService {
 			$this->urlGenerator,
 			$this->pkcs12Handler,
 			$this->groupManager,
+			$this->subAdmin,
 			$this->idDocsService,
 			$this->signerElementsService,
 			$this->userElementMapper,
@@ -179,6 +183,48 @@ public function testDeletePfxRevokesCertificatesWithReasonAndDeletesPfx(): void
 		$this->getService()->deletePfx($user);
 	}
 
+	public function testGetConfigSetsCanManageGroupPoliciesForSubAdmin(): void {
+		$user = $this->createMock(IUser::class);
+		$user->method('getUID')->willReturn('group-admin-user');
+
+		$this->groupManager->method('isAdmin')
+			->with('group-admin-user')
+			->willReturn(false);
+
+		$this->subAdmin->expects($this->once())
+			->method('isSubAdmin')
+			->with($user)
+			->willReturn(true);
+
+		$config = $this->getService()->getConfig($user);
+
+		$this->assertArrayHasKey('can_manage_group_policies', $config);
+		$this->assertTrue($config['can_manage_group_policies']);
+	}
+
+	public function testGetConfigIncludesPolicyWorkbenchCatalogCompactViewPreference(): void {
+		$user = $this->createMock(IUser::class);
+		$user->method('getUID')->willReturn('preference-user');
+
+		$this->userConfig
+			->expects($this->atLeastOnce())
+			->method('getValueString')
+			->willReturnCallback(static function (string $uid, string $appId, string $key, string $default = ''): string {
+				if ($uid === 'preference-user'
+					&& $appId === Application::APP_ID
+					&& $key === 'policy_workbench_catalog_compact_view') {
+					return '1';
+				}
+
+				return $default;
+			});
+
+		$config = $this->getService()->getConfig($user);
+
+		$this->assertArrayHasKey('policy_workbench_catalog_compact_view', $config);
+		$this->assertTrue($config['policy_workbench_catalog_compact_view']);
+	}
+
 	#[DataProvider('provideValidateCertificateDataCases')]
 	public function testValidateCertificateDataUsingDataProvider($arguments, $expectedErrorMessage):void {
 		if (is_callable($arguments)) {
diff --git a/tests/php/Unit/Service/FolderServiceTest.php b/tests/php/Unit/Service/FolderServiceTest.php
index 8a380ba500..d5a250a495 100644
--- a/tests/php/Unit/Service/FolderServiceTest.php
+++ b/tests/php/Unit/Service/FolderServiceTest.php
@@ -416,7 +416,7 @@ public function testGetFolderForFileUsesEnvelopeFolderWhenProvided(): void {
 
 		$userFolder = $this->createMock(Folder::class);
 		$userFolder->method('isUpdateable')->willReturn(true);
-		$userFolder->method('get')->willReturn($mockUserFolder);
+		$userFolder->method('getOrCreateFolder')->willReturn($mockUserFolder);
 		$this->root->method('getUserFolder')->willReturn($userFolder);
 
 		$service = $this->getInstance('testuser');
@@ -446,7 +446,7 @@ public function testGetFolderForFileCreatesNewFolderWhenNoEnvelopeId(): void {
 
 		$userFolder = $this->createMock(Folder::class);
 		$userFolder->method('isUpdateable')->willReturn(true);
-		$userFolder->method('get')->willReturn($mockUserFolder);
+		$userFolder->method('getOrCreateFolder')->willReturn($mockUserFolder);
 		$this->root->method('getUserFolder')->willReturn($userFolder);
 
 		$service = $this->getInstance('user1');
diff --git a/tests/php/Unit/Service/IdentifyMethod/AccountTest.php b/tests/php/Unit/Service/IdentifyMethod/AccountTest.php
index f1f974ebce..9c18580b94 100644
--- a/tests/php/Unit/Service/IdentifyMethod/AccountTest.php
+++ b/tests/php/Unit/Service/IdentifyMethod/AccountTest.php
@@ -191,6 +191,26 @@ public static function providerValidateToRequestSuccess(): array {
 		];
 	}
 
+	public function testGetSettingsDisablesAccountWhenAnotherMethodIsEnabled(): void {
+		$this->identifyService
+			->expects($this->exactly(2))
+			->method('getSavedSettings')
+			->willReturn([
+				[
+					'name' => 'email',
+					'enabled' => true,
+					'mandatory' => true,
+					'signatureMethods' => [
+						'emailToken' => ['enabled' => true],
+					],
+				],
+			]);
+
+		$settings = $this->getClass()->getSettings();
+
+		$this->assertFalse($settings['enabled']);
+	}
+
 	private function createSignatureMethod(string $name, bool $enabled): ISignatureMethod {
 		return new class($name, $enabled) implements ISignatureMethod {
 			private string $name;
@@ -220,19 +240,41 @@ public function toArray(): array {
 	}
 
 	private function createAccountWithMockSignatureMethods(array $signatureMethods): Account {
-		$accountMock = new class($this->identifyService, $this->userManager, $this->eventDispatcher, $this->identifyMethodMapper, $this->userSession, $this->urlGenerator, $this->root, $this->hasher, $this->timeFactory, $this->logger, $this->sessionService, $this->mailService, ) extends Account {
-			private array $mockSignatureMethods = [];
-
-			public function setMockSignatureMethods(array $methods): void {
-				$this->mockSignatureMethods = $methods;
+		return new class($this->identifyService, $this->userManager, $this->eventDispatcher, $this->identifyMethodMapper, $this->userSession, $this->urlGenerator, $this->root, $this->hasher, $this->timeFactory, $this->logger, $this->sessionService, $this->mailService, $signatureMethods) extends Account {
+			public function __construct(
+				IdentifyService $identifyService,
+				IUserManager $userManager,
+				IEventDispatcher $eventDispatcher,
+				IdentifyMethodMapper $identifyMethodMapper,
+				IUserSession $userSession,
+				IURLGenerator $urlGenerator,
+				IRootFolder $root,
+				IHasher $hasher,
+				ITimeFactory $timeFactory,
+				LoggerInterface $logger,
+				SessionService $sessionService,
+				MailService $mailService,
+				private array $mockSignatureMethods,
+			) {
+				parent::__construct(
+					$identifyService,
+					$userManager,
+					$eventDispatcher,
+					$identifyMethodMapper,
+					$userSession,
+					$urlGenerator,
+					$root,
+					$hasher,
+					$timeFactory,
+					$logger,
+					$sessionService,
+					$mailService,
+				);
 			}
 
 			public function getSignatureMethods(): array {
 				return $this->mockSignatureMethods;
 			}
 		};
-
-		$accountMock->setMockSignatureMethods($signatureMethods);
-		return $accountMock;
 	}
 }
diff --git a/tests/php/Unit/Service/IdentifyMethod/IdentifyServiceTest.php b/tests/php/Unit/Service/IdentifyMethod/IdentifyServiceTest.php
index e53b3184ee..4ba0b9c037 100644
--- a/tests/php/Unit/Service/IdentifyMethod/IdentifyServiceTest.php
+++ b/tests/php/Unit/Service/IdentifyMethod/IdentifyServiceTest.php
@@ -8,6 +8,7 @@
 
 namespace OCA\Libresign\Tests\Unit\Service\IdentifyMethod;
 
+use OCA\Libresign\AppInfo\Application;
 use OCA\Libresign\Db\File;
 use OCA\Libresign\Db\FileMapper;
 use OCA\Libresign\Db\IdentifyMethod;
@@ -153,4 +154,41 @@ public function testPropagateIdentifiedDateSkipsCurrentRequestAndUpdatesSiblings
 
 		$this->service->save($identifyMethod);
 	}
+
+	public function testGetSavedSettingsThrowsWhenStoredValueIsInvalid(): void {
+		$this->appConfig
+			->expects($this->once())
+			->method('clearCache')
+			->with(true);
+
+		$this->appConfig
+			->expects($this->once())
+			->method('getValueArray')
+			->with(Application::APP_ID, 'identify_methods', [])
+			->willThrowException(new \TypeError('Invalid app config value type'));
+
+		$this->logger
+			->expects($this->never())
+			->method('warning');
+
+		$this->expectException(\TypeError::class);
+		$this->service->getSavedSettings();
+	}
+
+	public function testGetSavedSettingsReloadsAppConfigBeforeReading(): void {
+		$expected = [['name' => 'account', 'enabled' => true]];
+
+		$this->appConfig
+			->expects($this->once())
+			->method('clearCache')
+			->with(true);
+
+		$this->appConfig
+			->expects($this->once())
+			->method('getValueArray')
+			->with(Application::APP_ID, 'identify_methods', [])
+			->willReturn($expected);
+
+		$this->assertSame($expected, $this->service->getSavedSettings());
+	}
 }
diff --git a/tests/php/Unit/Service/Policy/Model/PolicyContextTest.php b/tests/php/Unit/Service/Policy/Model/PolicyContextTest.php
new file mode 100644
index 0000000000..e0b629f88e
--- /dev/null
+++ b/tests/php/Unit/Service/Policy/Model/PolicyContextTest.php
@@ -0,0 +1,55 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Libresign\Tests\Unit\Service\Policy\Model;
+
+use OCA\Libresign\Service\Policy\Model\PolicyContext;
+use PHPUnit\Framework\TestCase;
+
+final class PolicyContextTest extends TestCase {
+	public function testGettersReturnDefaults(): void {
+		$context = new PolicyContext();
+
+		$this->assertNull($context->getUserId());
+		$this->assertSame([], $context->getGroups());
+		$this->assertSame([], $context->getCircles());
+		$this->assertNull($context->getActiveContext());
+		$this->assertSame([], $context->getRequestOverrides());
+		$this->assertSame([], $context->getActorCapabilities());
+	}
+
+	public function testSettersStoreValues(): void {
+		$context = new PolicyContext();
+		$activeContext = [
+			'type' => 'group',
+			'id' => 'finance',
+		];
+
+		$context
+			->setUserId('john')
+			->setGroups(['finance', 'legal'])
+			->setCircles(['board'])
+			->setActiveContext($activeContext)
+			->setRequestOverrides(['signature_flow' => 'parallel'])
+			->setActorCapabilities(['canManageOrganizationPolicies' => true]);
+
+		$this->assertSame('john', $context->getUserId());
+		$this->assertSame(['finance', 'legal'], $context->getGroups());
+		$this->assertSame(['board'], $context->getCircles());
+		$this->assertSame($activeContext, $context->getActiveContext());
+		$this->assertSame(['signature_flow' => 'parallel'], $context->getRequestOverrides());
+		$this->assertSame(['canManageOrganizationPolicies' => true], $context->getActorCapabilities());
+	}
+
+	public function testFromUserIdCreatesContextWithUserId(): void {
+		$context = PolicyContext::fromUserId('john');
+
+		$this->assertSame('john', $context->getUserId());
+		$this->assertSame([], $context->getGroups());
+	}
+}
diff --git a/tests/php/Unit/Service/Policy/Model/PolicyLayerTest.php b/tests/php/Unit/Service/Policy/Model/PolicyLayerTest.php
new file mode 100644
index 0000000000..601a8ea035
--- /dev/null
+++ b/tests/php/Unit/Service/Policy/Model/PolicyLayerTest.php
@@ -0,0 +1,43 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Libresign\Tests\Unit\Service\Policy\Model;
+
+use OCA\Libresign\Service\Policy\Model\PolicyLayer;
+use PHPUnit\Framework\TestCase;
+
+final class PolicyLayerTest extends TestCase {
+	public function testGettersReturnDefaults(): void {
+		$layer = new PolicyLayer();
+
+		$this->assertSame('', $layer->getScope());
+		$this->assertNull($layer->getValue());
+		$this->assertFalse($layer->isAllowChildOverride());
+		$this->assertTrue($layer->isVisibleToChild());
+		$this->assertSame([], $layer->getAllowedValues());
+		$this->assertSame([], $layer->getNotes());
+	}
+
+	public function testSettersStoreValues(): void {
+		$layer = new PolicyLayer();
+		$layer
+			->setScope('group')
+			->setValue(['type' => 'ordered_numeric'])
+			->setAllowChildOverride(true)
+			->setVisibleToChild(false)
+			->setAllowedValues([['type' => 'parallel'], ['type' => 'ordered_numeric']])
+			->setNotes(['reason' => 'organization-default']);
+
+		$this->assertSame('group', $layer->getScope());
+		$this->assertSame(['type' => 'ordered_numeric'], $layer->getValue());
+		$this->assertTrue($layer->isAllowChildOverride());
+		$this->assertFalse($layer->isVisibleToChild());
+		$this->assertSame([['type' => 'parallel'], ['type' => 'ordered_numeric']], $layer->getAllowedValues());
+		$this->assertSame(['reason' => 'organization-default'], $layer->getNotes());
+	}
+}
diff --git a/tests/php/Unit/Service/Policy/Model/PolicySpecTest.php b/tests/php/Unit/Service/Policy/Model/PolicySpecTest.php
new file mode 100644
index 0000000000..1a9a77d44d
--- /dev/null
+++ b/tests/php/Unit/Service/Policy/Model/PolicySpecTest.php
@@ -0,0 +1,78 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Libresign\Tests\Unit\Service\Policy\Model;
+
+use OCA\Libresign\Service\Policy\Model\PolicyContext;
+use OCA\Libresign\Service\Policy\Model\PolicySpec;
+use PHPUnit\Framework\TestCase;
+
+final class PolicySpecTest extends TestCase {
+	public function testDefaultStorageKeysFallbackToPolicyKey(): void {
+		$spec = new PolicySpec(
+			key: 'signature_flow',
+			defaultSystemValue: 'none',
+			allowedValues: ['none', 'parallel', 'ordered_numeric'],
+		);
+
+		$this->assertSame(PolicySpec::RESOLUTION_MODE_RESOLVED, $spec->resolutionMode());
+		$this->assertSame('signature_flow', $spec->getAppConfigKey());
+		$this->assertSame('policy.signature_flow', $spec->getUserPreferenceKey());
+	}
+
+	public function testResolutionModeMayBeConfiguredPerPolicy(): void {
+		$spec = new PolicySpec(
+			key: 'signature_flow',
+			defaultSystemValue: 'none',
+			allowedValues: ['none', 'parallel', 'ordered_numeric'],
+			resolutionMode: PolicySpec::RESOLUTION_MODE_VALUE_CHOICE,
+		);
+
+		$this->assertSame(PolicySpec::RESOLUTION_MODE_VALUE_CHOICE, $spec->resolutionMode());
+	}
+
+	public function testNormalizerAndValidatorAreApplied(): void {
+		$spec = new PolicySpec(
+			key: 'signature_flow',
+			defaultSystemValue: 'none',
+			allowedValues: ['none', 'parallel', 'ordered_numeric'],
+			normalizer: static fn (mixed $value): mixed => $value === 2 ? 'ordered_numeric' : $value,
+		);
+
+		$this->assertSame('ordered_numeric', $spec->normalizeValue(2));
+		$spec->validateValue('parallel', new PolicyContext());
+		$this->expectException(\InvalidArgumentException::class);
+		$spec->validateValue('invalid', new PolicyContext());
+	}
+
+	public function testAllowedValuesMayDependOnContext(): void {
+		$spec = new PolicySpec(
+			key: 'signature_flow',
+			defaultSystemValue: 'none',
+			allowedValues: static fn (PolicyContext $context): array => $context->getUserId() === 'john'
+				? ['parallel']
+				: ['none'],
+		);
+
+		$this->assertSame(['parallel'], $spec->allowedValues(PolicyContext::fromUserId('john')));
+		$this->assertSame(['none'], $spec->allowedValues(new PolicyContext()));
+	}
+
+	public function testValidationUsesProvidedContext(): void {
+		$spec = new PolicySpec(
+			key: 'signature_flow',
+			defaultSystemValue: 'none',
+			allowedValues: static fn (PolicyContext $context): array => $context->getUserId() === 'john' ? ['parallel'] : ['none'],
+		);
+
+		$spec->validateValue('parallel', PolicyContext::fromUserId('john'));
+
+		$this->expectException(\InvalidArgumentException::class);
+		$spec->validateValue('parallel', new PolicyContext());
+	}
+}
diff --git a/tests/php/Unit/Service/Policy/Model/ResolvedPolicyTest.php b/tests/php/Unit/Service/Policy/Model/ResolvedPolicyTest.php
new file mode 100644
index 0000000000..d9d9f992c6
--- /dev/null
+++ b/tests/php/Unit/Service/Policy/Model/ResolvedPolicyTest.php
@@ -0,0 +1,82 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Libresign\Tests\Unit\Service\Policy\Model;
+
+use OCA\Libresign\Service\Policy\Model\ResolvedPolicy;
+use PHPUnit\Framework\TestCase;
+
+final class ResolvedPolicyTest extends TestCase {
+	public function testGettersReturnDefaults(): void {
+		$policy = new ResolvedPolicy();
+
+		$this->assertSame('', $policy->getPolicyKey());
+		$this->assertNull($policy->getEffectiveValue());
+		$this->assertSame('', $policy->getSourceScope());
+		$this->assertFalse($policy->isVisible());
+		$this->assertFalse($policy->isEditableByCurrentActor());
+		$this->assertSame([], $policy->getAllowedValues());
+		$this->assertFalse($policy->canSaveAsUserDefault());
+		$this->assertFalse($policy->canUseAsRequestOverride());
+		$this->assertFalse($policy->wasPreferenceCleared());
+		$this->assertNull($policy->getBlockedBy());
+	}
+
+	public function testSettersStoreValues(): void {
+		$policy = new ResolvedPolicy();
+		$policy
+			->setPolicyKey('signature_flow')
+			->setEffectiveValue(['type' => 'parallel'])
+			->setSourceScope('group')
+			->setVisible(true)
+			->setEditableByCurrentActor(true)
+			->setAllowedValues([['type' => 'parallel'], ['type' => 'ordered_numeric']])
+			->setCanSaveAsUserDefault(true)
+			->setCanUseAsRequestOverride(true)
+			->setPreferenceWasCleared(true)
+			->setBlockedBy('system');
+
+		$this->assertSame('signature_flow', $policy->getPolicyKey());
+		$this->assertSame(['type' => 'parallel'], $policy->getEffectiveValue());
+		$this->assertSame('group', $policy->getSourceScope());
+		$this->assertTrue($policy->isVisible());
+		$this->assertTrue($policy->isEditableByCurrentActor());
+		$this->assertSame([['type' => 'parallel'], ['type' => 'ordered_numeric']], $policy->getAllowedValues());
+		$this->assertTrue($policy->canSaveAsUserDefault());
+		$this->assertTrue($policy->canUseAsRequestOverride());
+		$this->assertTrue($policy->wasPreferenceCleared());
+		$this->assertSame('system', $policy->getBlockedBy());
+	}
+
+	public function testToArrayExportsFrontendPayload(): void {
+		$policy = (new ResolvedPolicy())
+			->setPolicyKey('signature_flow')
+			->setEffectiveValue('parallel')
+			->setSourceScope('group')
+			->setVisible(true)
+			->setEditableByCurrentActor(true)
+			->setAllowedValues(['parallel', 'ordered_numeric'])
+			->setCanSaveAsUserDefault(true)
+			->setCanUseAsRequestOverride(false)
+			->setPreferenceWasCleared(true)
+			->setBlockedBy('group');
+
+		$this->assertSame([
+			'policyKey' => 'signature_flow',
+			'effectiveValue' => 'parallel',
+			'sourceScope' => 'group',
+			'visible' => true,
+			'editableByCurrentActor' => true,
+			'allowedValues' => ['parallel', 'ordered_numeric'],
+			'canSaveAsUserDefault' => true,
+			'canUseAsRequestOverride' => false,
+			'preferenceWasCleared' => true,
+			'blockedBy' => 'group',
+		], $policy->toArray());
+	}
+}
diff --git a/tests/php/Unit/Service/Policy/PolicyServiceTest.php b/tests/php/Unit/Service/Policy/PolicyServiceTest.php
new file mode 100644
index 0000000000..63fc953100
--- /dev/null
+++ b/tests/php/Unit/Service/Policy/PolicyServiceTest.php
@@ -0,0 +1,488 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Libresign\Tests\Unit\Service\Policy;
+
+use OCA\Libresign\Service\Policy\Model\PolicyLayer;
+use OCA\Libresign\Service\Policy\Model\ResolvedPolicy;
+use OCA\Libresign\Service\Policy\PolicyService;
+use OCA\Libresign\Service\Policy\Provider\DocMdp\DocMdpPolicy;
+use OCA\Libresign\Service\Policy\Provider\Footer\AddFooterPolicy;
+use OCA\Libresign\Service\Policy\Provider\Signature\SignatureFlowPolicy;
+use OCA\Libresign\Service\Policy\Runtime\PolicyContextFactory;
+use OCA\Libresign\Service\Policy\Runtime\PolicyRegistry;
+use OCA\Libresign\Service\Policy\Runtime\PolicySource;
+use OCP\IGroupManager;
+use OCP\IUser;
+use OCP\IUserManager;
+use OCP\IUserSession;
+use PHPUnit\Framework\MockObject\MockObject;
+use PHPUnit\Framework\TestCase;
+use Psr\Container\ContainerInterface;
+
+final class PolicyServiceTest extends TestCase {
+	private IUserManager&MockObject $userManager;
+	private IGroupManager&MockObject $groupManager;
+	private IUserSession&MockObject $userSession;
+	private PolicySource&MockObject $source;
+	private PolicyRegistry $registry;
+	private PolicyContextFactory $contextFactory;
+
+	protected function setUp(): void {
+		parent::setUp();
+		$this->userManager = $this->createMock(IUserManager::class);
+		$this->groupManager = $this->createMock(IGroupManager::class);
+		$this->userSession = $this->createMock(IUserSession::class);
+		$this->source = $this->createMock(PolicySource::class);
+		$container = $this->createMock(ContainerInterface::class);
+		$container
+			->method('get')
+			->willReturnCallback(static function (string $class): object {
+				return match ($class) {
+					AddFooterPolicy::class => new AddFooterPolicy(),
+					SignatureFlowPolicy::class => new SignatureFlowPolicy(),
+					DocMdpPolicy::class => new DocMdpPolicy(),
+					default => throw new \RuntimeException('Unexpected provider class: ' . $class),
+				};
+			});
+		$this->registry = new PolicyRegistry($container);
+		$this->contextFactory = new PolicyContextFactory($this->userManager, $this->groupManager, $this->userSession);
+	}
+
+	public function testResolveForUserIdUsesDocMdpGroupPolicyWhenSystemAllowsOverride(): void {
+		$user = $this->createMock(IUser::class);
+		$this->userManager
+			->expects($this->once())
+			->method('get')
+			->with('john')
+			->willReturn($user);
+
+		$this->groupManager
+			->expects($this->once())
+			->method('getUserGroupIds')
+			->with($user)
+			->willReturn(['finance']);
+
+		$this->source
+			->method('loadSystemPolicy')
+			->with(DocMdpPolicy::KEY)
+			->willReturn((new PolicyLayer())
+				->setScope('system')
+				->setValue(0)
+				->setAllowChildOverride(true)
+				->setVisibleToChild(true));
+
+		$this->source
+			->method('loadGroupPolicies')
+			->with(DocMdpPolicy::KEY, $this->callback(static function ($context): bool {
+				return $context->getUserId() === 'john' && $context->getGroups() === ['finance'];
+			}))
+			->willReturn([(new PolicyLayer())
+				->setScope('group')
+				->setValue(2)
+				->setAllowChildOverride(false)
+				->setVisibleToChild(true)
+				->setAllowedValues([2])]);
+
+		$this->source->method('loadCirclePolicies')->willReturn([]);
+		$this->source->method('loadUserPreference')->willReturn(null);
+		$this->source->method('loadRequestOverride')->willReturn(null);
+
+		$service = new PolicyService(
+			$this->contextFactory,
+			$this->source,
+			$this->registry,
+		);
+
+		$resolved = $service->resolveForUserId(DocMdpPolicy::KEY, 'john');
+
+		$this->assertSame(2, $resolved->getEffectiveValue());
+		$this->assertSame('group', $resolved->getSourceScope());
+		$this->assertFalse($resolved->canUseAsRequestOverride());
+	}
+
+	public function testResolveForUserIdBuildsContextWithGroupsAndRequestOverride(): void {
+		$user = $this->createMock(IUser::class);
+		$this->userManager
+			->expects($this->once())
+			->method('get')
+			->with('john')
+			->willReturn($user);
+
+		$this->groupManager
+			->expects($this->once())
+			->method('getUserGroupIds')
+			->with($user)
+			->willReturn(['finance']);
+
+		$this->source
+			->method('loadSystemPolicy')
+			->willReturn((new PolicyLayer())
+				->setScope('system')
+				->setValue('none')
+				->setAllowChildOverride(true)
+				->setVisibleToChild(true));
+
+		$this->source
+			->method('loadGroupPolicies')
+			->willReturn([(new PolicyLayer())
+				->setScope('group')
+				->setValue('parallel')
+				->setAllowChildOverride(true)
+				->setVisibleToChild(true)
+				->setAllowedValues(['parallel', 'ordered_numeric'])]);
+
+		$this->source->method('loadCirclePolicies')->willReturn([]);
+		$this->source->method('loadUserPreference')->willReturn(null);
+		$this->source
+			->method('loadRequestOverride')
+			->willReturn((new PolicyLayer())
+				->setScope('request')
+				->setValue('ordered_numeric'));
+
+		$service = new PolicyService(
+			$this->contextFactory,
+			$this->source,
+			$this->registry,
+		);
+
+		$resolved = $service->resolveForUserId(SignatureFlowPolicy::KEY, 'john', [SignatureFlowPolicy::KEY => 'ordered_numeric']);
+
+		$this->assertInstanceOf(ResolvedPolicy::class, $resolved);
+		$this->assertSame('ordered_numeric', $resolved->getEffectiveValue());
+		$this->assertSame('request', $resolved->getSourceScope());
+	}
+
+	public function testResolveForUserIdWithoutUserFallsBackToSystem(): void {
+		$this->userManager
+			->expects($this->once())
+			->method('get')
+			->with('ghost')
+			->willReturn(null);
+
+		$this->groupManager
+			->expects($this->never())
+			->method('getUserGroupIds');
+
+		$this->source
+			->method('loadSystemPolicy')
+			->willReturn((new PolicyLayer())
+				->setScope('system')
+				->setValue('parallel')
+				->setAllowChildOverride(false)
+				->setVisibleToChild(true)
+				->setAllowedValues(['parallel']));
+
+		$this->source->method('loadGroupPolicies')->willReturn([]);
+		$this->source->method('loadCirclePolicies')->willReturn([]);
+		$this->source->method('loadUserPreference')->willReturn(null);
+		$this->source->method('loadRequestOverride')->willReturn(null);
+
+		$service = new PolicyService(
+			$this->contextFactory,
+			$this->source,
+			$this->registry,
+		);
+
+		$resolved = $service->resolveForUserId(SignatureFlowPolicy::KEY, 'ghost');
+
+		$this->assertSame('parallel', $resolved->getEffectiveValue());
+		$this->assertSame('system', $resolved->getSourceScope());
+	}
+
+	public function testResolveUsesCurrentUserFromSession(): void {
+		$user = $this->createMock(IUser::class);
+		$user->method('getUID')->willReturn('john');
+
+		$this->userSession
+			->expects($this->once())
+			->method('getUser')
+			->willReturn($user);
+
+		$this->userManager
+			->expects($this->never())
+			->method('get')
+			->with('john');
+
+		$this->groupManager
+			->expects($this->once())
+			->method('getUserGroupIds')
+			->with($user)
+			->willReturn(['finance']);
+
+		$this->source
+			->method('loadSystemPolicy')
+			->willReturn((new PolicyLayer())
+				->setScope('system')
+				->setValue('none')
+				->setAllowChildOverride(true)
+				->setVisibleToChild(true));
+
+		$this->source
+			->method('loadGroupPolicies')
+			->willReturn([(new PolicyLayer())
+				->setScope('group')
+				->setValue('parallel')
+				->setAllowChildOverride(true)
+				->setVisibleToChild(true)
+				->setAllowedValues(['parallel', 'ordered_numeric'])]);
+
+		$this->source->method('loadCirclePolicies')->willReturn([]);
+		$this->source->method('loadUserPreference')->willReturn(null);
+		$this->source->method('loadRequestOverride')->willReturn(null);
+
+		$service = new PolicyService(
+			$this->contextFactory,
+			$this->source,
+			$this->registry,
+		);
+
+		$resolved = $service->resolve(SignatureFlowPolicy::KEY);
+
+		$this->assertInstanceOf(ResolvedPolicy::class, $resolved);
+		$this->assertSame('parallel', $resolved->getEffectiveValue());
+		$this->assertSame('group', $resolved->getSourceScope());
+	}
+
+	public function testSaveUserPreferenceForUserIdPersistsForTargetUser(): void {
+		$targetUser = $this->createMock(IUser::class);
+		$targetUser->method('getUID')->willReturn('user1');
+
+		$persistedPolicy = (new PolicyLayer())
+			->setScope('user')
+			->setValue('ordered_numeric');
+
+		$this->userManager
+			->expects($this->once())
+			->method('get')
+			->with('user1')
+			->willReturn($targetUser);
+
+		$this->groupManager
+			->expects($this->once())
+			->method('getUserGroupIds')
+			->with($targetUser)
+			->willReturn(['finance']);
+
+		$this->source
+			->expects($this->once())
+			->method('saveUserPreference')
+			->with(
+				SignatureFlowPolicy::KEY,
+				$this->callback(static function ($context): bool {
+					return $context->getUserId() === 'user1';
+				}),
+				'ordered_numeric',
+			);
+
+		$this->source
+			->method('loadSystemPolicy')
+			->willReturn((new PolicyLayer())
+				->setScope('system')
+				->setValue('parallel')
+				->setAllowChildOverride(true)
+				->setVisibleToChild(true));
+
+		$this->source->method('loadGroupPolicies')->willReturn([]);
+		$this->source->method('loadCirclePolicies')->willReturn([]);
+		$this->source
+			->method('loadUserPreference')
+			->willReturnOnConsecutiveCalls(null, $persistedPolicy);
+		$this->source->method('loadRequestOverride')->willReturn(null);
+
+		$service = new PolicyService(
+			$this->contextFactory,
+			$this->source,
+			$this->registry,
+		);
+
+		$policy = $service->saveUserPreferenceForUserId(SignatureFlowPolicy::KEY, 'user1', 'ordered_numeric');
+
+		$this->assertInstanceOf(PolicyLayer::class, $policy);
+		$this->assertSame($persistedPolicy, $policy);
+		$this->assertSame('ordered_numeric', $policy->getValue());
+		$this->assertSame('user', $policy->getScope());
+	}
+
+	public function testSaveUserPreferenceForUserIdAllowsSystemAdminBypassWhenGroupBlocksUsers(): void {
+		$targetUser = $this->createMock(IUser::class);
+		$targetUser->method('getUID')->willReturn('user1');
+
+		$persistedPolicy = (new PolicyLayer())
+			->setScope('user')
+			->setValue('ordered_numeric');
+
+		$actor = $this->createMock(IUser::class);
+		$actor->method('getUID')->willReturn('admin');
+		$this->userSession
+			->method('getUser')
+			->willReturn($actor);
+
+		$this->userManager
+			->expects($this->once())
+			->method('get')
+			->with('user1')
+			->willReturn($targetUser);
+
+		$this->groupManager
+			->expects($this->once())
+			->method('getUserGroupIds')
+			->with($targetUser)
+			->willReturn(['finance']);
+
+		$this->groupManager
+			->expects($this->once())
+			->method('isAdmin')
+			->with('admin')
+			->willReturn(true);
+
+		$this->source
+			->expects($this->once())
+			->method('saveUserPreference')
+			->with(
+				SignatureFlowPolicy::KEY,
+				$this->callback(static function ($context): bool {
+					return $context->getUserId() === 'user1';
+				}),
+				'ordered_numeric',
+			);
+
+		$this->source
+			->method('loadSystemPolicy')
+			->willReturn((new PolicyLayer())
+				->setScope('system')
+				->setValue('none')
+				->setAllowChildOverride(true)
+				->setVisibleToChild(true));
+
+		$this->source
+			->method('loadGroupPolicies')
+			->willReturn([(new PolicyLayer())
+				->setScope('group')
+				->setValue('ordered_numeric')
+				->setAllowChildOverride(false)
+				->setVisibleToChild(true)
+				->setAllowedValues(['ordered_numeric'])]);
+
+		$this->source->method('loadCirclePolicies')->willReturn([]);
+		$this->source
+			->method('loadUserPreference')
+			->willReturnOnConsecutiveCalls(null, $persistedPolicy);
+		$this->source->method('loadRequestOverride')->willReturn(null);
+
+		$service = new PolicyService(
+			$this->contextFactory,
+			$this->source,
+			$this->registry,
+		);
+
+		$policy = $service->saveUserPreferenceForUserId(SignatureFlowPolicy::KEY, 'user1', 'ordered_numeric');
+
+		$this->assertInstanceOf(PolicyLayer::class, $policy);
+		$this->assertSame($persistedPolicy, $policy);
+		$this->assertSame('ordered_numeric', $policy->getValue());
+		$this->assertSame('user', $policy->getScope());
+	}
+
+	public function testSaveUserPreferenceForUserIdBlocksNonAdminWhenGroupDisallowsUserOverrides(): void {
+		$targetUser = $this->createMock(IUser::class);
+		$targetUser->method('getUID')->willReturn('user1');
+
+		$actor = $this->createMock(IUser::class);
+		$actor->method('getUID')->willReturn('manager');
+		$this->userSession
+			->method('getUser')
+			->willReturn($actor);
+
+		$this->userManager
+			->expects($this->once())
+			->method('get')
+			->with('user1')
+			->willReturn($targetUser);
+
+		$this->groupManager
+			->expects($this->once())
+			->method('getUserGroupIds')
+			->with($targetUser)
+			->willReturn(['finance']);
+
+		$this->groupManager
+			->expects($this->once())
+			->method('isAdmin')
+			->with('manager')
+			->willReturn(false);
+
+		$this->source
+			->expects($this->never())
+			->method('saveUserPreference');
+
+		$this->source
+			->method('loadSystemPolicy')
+			->willReturn((new PolicyLayer())
+				->setScope('system')
+				->setValue('none')
+				->setAllowChildOverride(true)
+				->setVisibleToChild(true));
+
+		$this->source
+			->method('loadGroupPolicies')
+			->willReturn([(new PolicyLayer())
+				->setScope('group')
+				->setValue('ordered_numeric')
+				->setAllowChildOverride(false)
+				->setVisibleToChild(true)
+				->setAllowedValues(['ordered_numeric'])]);
+
+		$this->source->method('loadCirclePolicies')->willReturn([]);
+		$this->source->method('loadUserPreference')->willReturn(null);
+		$this->source->method('loadRequestOverride')->willReturn(null);
+
+		$service = new PolicyService(
+			$this->contextFactory,
+			$this->source,
+			$this->registry,
+		);
+
+		$this->expectException(\InvalidArgumentException::class);
+		$this->expectExceptionMessage('Saving a user preference is not allowed for signature_flow');
+
+		$service->saveUserPreferenceForUserId(SignatureFlowPolicy::KEY, 'user1', 'ordered_numeric');
+	}
+
+	public function testSaveSystemPersistsAllowChildOverrideWhenEnabled(): void {
+		$this->source
+			->expects($this->once())
+			->method('saveSystemPolicy')
+			->with(SignatureFlowPolicy::KEY, 'ordered_numeric', true);
+
+		$this->source
+			->method('loadSystemPolicy')
+			->willReturn((new PolicyLayer())
+				->setScope('system')
+				->setValue('ordered_numeric')
+				->setAllowChildOverride(true)
+				->setVisibleToChild(true)
+				->setAllowedValues([]));
+
+		$this->source->method('loadGroupPolicies')->willReturn([]);
+		$this->source->method('loadCirclePolicies')->willReturn([]);
+		$this->source->method('loadUserPreference')->willReturn(null);
+		$this->source->method('loadRequestOverride')->willReturn(null);
+
+		$service = new PolicyService(
+			$this->contextFactory,
+			$this->source,
+			$this->registry,
+		);
+
+		$resolved = $service->saveSystem(SignatureFlowPolicy::KEY, 'ordered_numeric', true);
+
+		$this->assertSame('ordered_numeric', $resolved->getEffectiveValue());
+		$this->assertSame('system', $resolved->getSourceScope());
+	}
+}
diff --git a/tests/php/Unit/Service/Policy/Provider/DocMdp/DocMdpPolicyTest.php b/tests/php/Unit/Service/Policy/Provider/DocMdp/DocMdpPolicyTest.php
new file mode 100644
index 0000000000..9c73f24b12
--- /dev/null
+++ b/tests/php/Unit/Service/Policy/Provider/DocMdp/DocMdpPolicyTest.php
@@ -0,0 +1,34 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Libresign\Tests\Unit\Service\Policy\Provider\DocMdp;
+
+use OCA\Libresign\Enum\DocMdpLevel;
+use OCA\Libresign\Service\Policy\Model\PolicyContext;
+use OCA\Libresign\Service\Policy\Provider\DocMdp\DocMdpPolicy;
+use PHPUnit\Framework\TestCase;
+
+final class DocMdpPolicyTest extends TestCase {
+	public function testProviderBuildsDocMdpDefinition(): void {
+		$provider = new DocMdpPolicy();
+		$this->assertSame([DocMdpPolicy::KEY], $provider->keys());
+		$definition = $provider->get(DocMdpPolicy::KEY);
+
+		$this->assertSame(DocMdpPolicy::KEY, $definition->key());
+		$this->assertSame(DocMdpLevel::NOT_CERTIFIED->value, $definition->defaultSystemValue());
+		$this->assertSame([0, 1, 2, 3], $definition->allowedValues(new PolicyContext()));
+	}
+
+	public function testProviderNormalizesDocMdpLevelValues(): void {
+		$provider = new DocMdpPolicy();
+		$definition = $provider->get(DocMdpPolicy::KEY);
+
+		$this->assertSame(2, $definition->normalizeValue(2));
+		$this->assertSame(DocMdpLevel::CERTIFIED_FORM_FILLING_AND_ANNOTATIONS->value, $definition->normalizeValue(DocMdpLevel::CERTIFIED_FORM_FILLING_AND_ANNOTATIONS));
+	}
+}
diff --git a/tests/php/Unit/Service/Policy/Provider/Footer/AddFooterPolicyTest.php b/tests/php/Unit/Service/Policy/Provider/Footer/AddFooterPolicyTest.php
new file mode 100644
index 0000000000..18ef17902f
--- /dev/null
+++ b/tests/php/Unit/Service/Policy/Provider/Footer/AddFooterPolicyTest.php
@@ -0,0 +1,64 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Libresign\Tests\Unit\Service\Policy\Provider\Footer;
+
+use OCA\Libresign\Service\Policy\Model\PolicyContext;
+use OCA\Libresign\Service\Policy\Provider\Footer\AddFooterPolicy;
+use OCA\Libresign\Service\Policy\Provider\Footer\SignatureFooterPolicyValue;
+use PHPUnit\Framework\TestCase;
+
+final class AddFooterPolicyTest extends TestCase {
+	public function testProviderBuildsAddFooterDefinition(): void {
+		$provider = new AddFooterPolicy();
+		$this->assertSame([AddFooterPolicy::KEY], $provider->keys());
+		$definition = $provider->get(AddFooterPolicy::KEY);
+
+		$this->assertSame(AddFooterPolicy::KEY, $definition->key());
+		$this->assertSame(
+			SignatureFooterPolicyValue::encode(SignatureFooterPolicyValue::defaults()),
+			$definition->defaultSystemValue(),
+		);
+		$this->assertSame([], $definition->allowedValues(new PolicyContext()));
+	}
+
+	public function testProviderNormalizesBooleanLikeValues(): void {
+		$provider = new AddFooterPolicy();
+		$definition = $provider->get(AddFooterPolicy::KEY);
+
+		$this->assertSame(
+			SignatureFooterPolicyValue::encode([
+				'enabled' => true,
+				'writeQrcodeOnFooter' => true,
+				'validationSite' => '',
+				'customizeFooterTemplate' => false,
+			]),
+			$definition->normalizeValue(true),
+		);
+
+		$this->assertSame(
+			SignatureFooterPolicyValue::encode([
+				'enabled' => false,
+				'writeQrcodeOnFooter' => true,
+				'validationSite' => '',
+				'customizeFooterTemplate' => false,
+			]),
+			$definition->normalizeValue('0'),
+		);
+
+		$this->assertSame(
+			SignatureFooterPolicyValue::encode([
+				'enabled' => true,
+				'writeQrcodeOnFooter' => false,
+				'validationSite' => 'https://validation.example',
+				'customizeFooterTemplate' => true,
+			]),
+			$definition->normalizeValue('{"enabled":true,"writeQrcodeOnFooter":false,"validationSite":"https://validation.example","customizeFooterTemplate":true}'),
+		);
+	}
+}
diff --git a/tests/php/Unit/Service/Policy/Provider/Footer/SignatureFooterPolicyValueTest.php b/tests/php/Unit/Service/Policy/Provider/Footer/SignatureFooterPolicyValueTest.php
new file mode 100644
index 0000000000..cc43c54e6e
--- /dev/null
+++ b/tests/php/Unit/Service/Policy/Provider/Footer/SignatureFooterPolicyValueTest.php
@@ -0,0 +1,57 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Libresign\Tests\Unit\Service\Policy\Provider\Footer;
+
+use OCA\Libresign\Service\Policy\Provider\Footer\SignatureFooterPolicyValue;
+use PHPUnit\Framework\TestCase;
+
+final class SignatureFooterPolicyValueTest extends TestCase {
+	public function testDefaultsAreStable(): void {
+		$this->assertSame([
+			'enabled' => true,
+			'writeQrcodeOnFooter' => true,
+			'validationSite' => '',
+			'customizeFooterTemplate' => false,
+		], SignatureFooterPolicyValue::defaults());
+	}
+
+	public function testNormalizeLegacyBooleanInput(): void {
+		$this->assertSame([
+			'enabled' => false,
+			'writeQrcodeOnFooter' => true,
+			'validationSite' => '',
+			'customizeFooterTemplate' => false,
+		], SignatureFooterPolicyValue::normalize('0'));
+	}
+
+	public function testNormalizeStructuredJsonInput(): void {
+		$normalized = SignatureFooterPolicyValue::normalize(
+			'{"enabled":true,"writeQrcodeOnFooter":false,"validationSite":"https://validation.example","customizeFooterTemplate":true}'
+		);
+
+		$this->assertSame([
+			'enabled' => true,
+			'writeQrcodeOnFooter' => false,
+			'validationSite' => 'https://validation.example',
+			'customizeFooterTemplate' => true,
+		], $normalized);
+	}
+
+	public function testEncodeReturnsCanonicalPayload(): void {
+		$this->assertSame(
+			'{"enabled":true,"writeQrcodeOnFooter":true,"validationSite":"","customizeFooterTemplate":false}',
+			SignatureFooterPolicyValue::encode([
+				'enabled' => true,
+				'writeQrcodeOnFooter' => true,
+				'validationSite' => '',
+				'customizeFooterTemplate' => false,
+			]),
+		);
+	}
+}
diff --git a/tests/php/Unit/Service/Policy/Provider/Signature/SignatureFlowPolicyTest.php b/tests/php/Unit/Service/Policy/Provider/Signature/SignatureFlowPolicyTest.php
new file mode 100644
index 0000000000..70aa741ba1
--- /dev/null
+++ b/tests/php/Unit/Service/Policy/Provider/Signature/SignatureFlowPolicyTest.php
@@ -0,0 +1,26 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Libresign\Tests\Unit\Service\Policy\Provider\Signature;
+
+use OCA\Libresign\Service\Policy\Model\PolicyContext;
+use OCA\Libresign\Service\Policy\Provider\Signature\SignatureFlowPolicy;
+use PHPUnit\Framework\TestCase;
+
+final class SignatureFlowPolicyTest extends TestCase {
+	public function testProviderBuildsSignatureFlowDefinition(): void {
+		$provider = new SignatureFlowPolicy();
+		$this->assertSame([SignatureFlowPolicy::KEY], $provider->keys());
+		$definition = $provider->get(SignatureFlowPolicy::KEY);
+
+		$this->assertSame(SignatureFlowPolicy::KEY, $definition->key());
+		$this->assertSame('none', $definition->defaultSystemValue());
+		$this->assertSame(['none', 'parallel', 'ordered_numeric'], $definition->allowedValues(new PolicyContext()));
+		$this->assertSame('ordered_numeric', $definition->normalizeValue('ordered_numeric'));
+	}
+}
diff --git a/tests/php/Unit/Service/Policy/Runtime/DefaultPolicyResolverTest.php b/tests/php/Unit/Service/Policy/Runtime/DefaultPolicyResolverTest.php
new file mode 100644
index 0000000000..6066350446
--- /dev/null
+++ b/tests/php/Unit/Service/Policy/Runtime/DefaultPolicyResolverTest.php
@@ -0,0 +1,302 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Libresign\Tests\Unit\Service\Policy\Runtime;
+
+use OCA\Libresign\Service\Policy\Contract\IPolicySource;
+use OCA\Libresign\Service\Policy\Model\PolicyContext;
+use OCA\Libresign\Service\Policy\Model\PolicyLayer;
+use OCA\Libresign\Service\Policy\Model\PolicySpec;
+use OCA\Libresign\Service\Policy\Runtime\DefaultPolicyResolver;
+use PHPUnit\Framework\TestCase;
+
+final class DefaultPolicyResolverTest extends TestCase {
+	public function testResolveUsesDefinitionDefaultWhenNoLayersExist(): void {
+		$resolver = new DefaultPolicyResolver(new InMemoryPolicySource());
+
+		$resolved = $resolver->resolve($this->getDefinition(), new PolicyContext());
+
+		$this->assertSame('none', $resolved->getEffectiveValue());
+		$this->assertSame('system', $resolved->getSourceScope());
+		$this->assertSame(['none', 'parallel', 'ordered_numeric'], $resolved->getAllowedValues());
+		$this->assertFalse($resolved->isEditableByCurrentActor());
+	}
+
+	public function testResolveAppliesGroupValueWhenSystemAllowsOverride(): void {
+		$source = new InMemoryPolicySource();
+		$source->systemLayer = (new PolicyLayer())
+			->setScope('system')
+			->setValue('none')
+			->setAllowChildOverride(true)
+			->setVisibleToChild(true);
+		$source->groupLayers = [
+			(new PolicyLayer())
+				->setScope('group')
+				->setValue('ordered_numeric')
+				->setAllowChildOverride(true)
+				->setVisibleToChild(true)
+				->setAllowedValues(['parallel', 'ordered_numeric']),
+		];
+
+		$resolver = new DefaultPolicyResolver($source);
+		$resolved = $resolver->resolve($this->getDefinition(), PolicyContext::fromUserId('john'));
+
+		$this->assertSame('ordered_numeric', $resolved->getEffectiveValue());
+		$this->assertSame('group', $resolved->getSourceScope());
+		$this->assertTrue($resolved->isEditableByCurrentActor());
+		$this->assertTrue($resolved->canSaveAsUserDefault());
+		$this->assertTrue($resolved->canUseAsRequestOverride());
+	}
+
+	public function testResolveClearsInvalidUserPreferenceWhenGroupBlocksOverride(): void {
+		$source = new InMemoryPolicySource();
+		$source->systemLayer = (new PolicyLayer())
+			->setScope('system')
+			->setValue('none')
+			->setAllowChildOverride(true)
+			->setVisibleToChild(true);
+		$source->groupLayers = [
+			(new PolicyLayer())
+				->setScope('group')
+				->setValue('parallel')
+				->setAllowChildOverride(false)
+				->setVisibleToChild(true)
+				->setAllowedValues(['parallel']),
+		];
+		$source->userPreference = (new PolicyLayer())
+			->setScope('user')
+			->setValue('ordered_numeric');
+
+		$resolver = new DefaultPolicyResolver($source);
+		$resolved = $resolver->resolve($this->getDefinition(), PolicyContext::fromUserId('john'));
+
+		$this->assertSame('parallel', $resolved->getEffectiveValue());
+		$this->assertSame('group', $resolved->getSourceScope());
+		$this->assertTrue($resolved->wasPreferenceCleared());
+		$this->assertFalse($resolved->canSaveAsUserDefault());
+		$this->assertFalse($resolved->canUseAsRequestOverride());
+		$this->assertSame('group', $resolved->getBlockedBy());
+		$this->assertTrue($source->userPreferenceCleared);
+	}
+
+	public function testResolveAppliesRequestOverrideWhenAllowed(): void {
+		$source = new InMemoryPolicySource();
+		$source->systemLayer = (new PolicyLayer())
+			->setScope('system')
+			->setValue('none')
+			->setAllowChildOverride(true)
+			->setVisibleToChild(true);
+		$source->groupLayers = [
+			(new PolicyLayer())
+				->setScope('group')
+				->setValue('parallel')
+				->setAllowChildOverride(true)
+				->setVisibleToChild(true)
+				->setAllowedValues(['parallel', 'ordered_numeric']),
+		];
+		$source->requestOverride = (new PolicyLayer())
+			->setScope('request')
+			->setValue('ordered_numeric');
+
+		$resolver = new DefaultPolicyResolver($source);
+		$resolved = $resolver->resolve($this->getDefinition(), PolicyContext::fromUserId('john'));
+
+		$this->assertSame('ordered_numeric', $resolved->getEffectiveValue());
+		$this->assertSame('request', $resolved->getSourceScope());
+		$this->assertTrue($resolved->canUseAsRequestOverride());
+		$this->assertNull($resolved->getBlockedBy());
+	}
+
+	public function testResolveValueChoiceUnionsConflictingGroupValues(): void {
+		$source = new InMemoryPolicySource();
+		$source->systemLayer = (new PolicyLayer())
+			->setScope('system')
+			->setValue('none')
+			->setAllowChildOverride(true)
+			->setVisibleToChild(true);
+		$source->groupLayers = [
+			(new PolicyLayer())
+				->setScope('group')
+				->setValue('ordered_numeric')
+				->setAllowChildOverride(false)
+				->setVisibleToChild(true)
+				->setAllowedValues(['ordered_numeric']),
+			(new PolicyLayer())
+				->setScope('group')
+				->setValue('parallel')
+				->setAllowChildOverride(false)
+				->setVisibleToChild(true)
+				->setAllowedValues(['parallel']),
+		];
+
+		$resolver = new DefaultPolicyResolver($source);
+		$resolved = $resolver->resolve($this->getValueChoiceDefinition(), PolicyContext::fromUserId('john'));
+
+		$this->assertSame('parallel', $resolved->getEffectiveValue());
+		$this->assertSame('group', $resolved->getSourceScope());
+		$this->assertSame(['parallel', 'ordered_numeric'], $resolved->getAllowedValues());
+		$this->assertTrue($resolved->isEditableByCurrentActor());
+		$this->assertTrue($resolved->canSaveAsUserDefault());
+		$this->assertTrue($resolved->canUseAsRequestOverride());
+	}
+
+	public function testResolveValueChoiceLetsCustomizableGroupBroadenFixedGroupChoice(): void {
+		$source = new InMemoryPolicySource();
+		$source->systemLayer = (new PolicyLayer())
+			->setScope('system')
+			->setValue('none')
+			->setAllowChildOverride(true)
+			->setVisibleToChild(true);
+		$source->groupLayers = [
+			(new PolicyLayer())
+				->setScope('group')
+				->setValue('ordered_numeric')
+				->setAllowChildOverride(false)
+				->setVisibleToChild(true)
+				->setAllowedValues(['ordered_numeric']),
+			(new PolicyLayer())
+				->setScope('group')
+				->setValue('ordered_numeric')
+				->setAllowChildOverride(true)
+				->setVisibleToChild(true)
+				->setAllowedValues([]),
+		];
+
+		$resolver = new DefaultPolicyResolver($source);
+		$resolved = $resolver->resolve($this->getValueChoiceDefinition(), PolicyContext::fromUserId('john'));
+
+		$this->assertSame('ordered_numeric', $resolved->getEffectiveValue());
+		$this->assertSame(['parallel', 'ordered_numeric'], $resolved->getAllowedValues());
+		$this->assertTrue($resolved->canUseAsRequestOverride());
+	}
+
+	public function testResolveDoesNotApplyGroupValueWhenSystemBlocksOverride(): void {
+		$source = new InMemoryPolicySource();
+		$source->systemLayer = (new PolicyLayer())
+			->setScope('system')
+			->setValue('ordered_numeric')
+			->setAllowChildOverride(false)
+			->setVisibleToChild(true)
+			->setAllowedValues(['ordered_numeric']);
+		$source->groupLayers = [
+			(new PolicyLayer())
+				->setScope('group')
+				->setValue('parallel')
+				->setAllowChildOverride(true)
+				->setVisibleToChild(true)
+				->setAllowedValues(['parallel', 'ordered_numeric']),
+		];
+
+		$resolver = new DefaultPolicyResolver($source);
+		$resolved = $resolver->resolve($this->getDefinition(), PolicyContext::fromUserId('john'));
+
+		$this->assertSame('ordered_numeric', $resolved->getEffectiveValue());
+		$this->assertSame('system', $resolved->getSourceScope());
+		$this->assertSame(['ordered_numeric'], $resolved->getAllowedValues());
+		$this->assertFalse($resolved->canUseAsRequestOverride());
+	}
+
+	public function testResolveIgnoresCircleLayersInCurrentPhase(): void {
+		$source = new InMemoryPolicySource();
+		$source->systemLayer = (new PolicyLayer())
+			->setScope('system')
+			->setValue('none')
+			->setAllowChildOverride(true)
+			->setVisibleToChild(true);
+		$source->groupLayers = [
+			(new PolicyLayer())
+				->setScope('group')
+				->setValue('parallel')
+				->setAllowChildOverride(true)
+				->setVisibleToChild(true),
+		];
+		$source->circleLayers = [
+			(new PolicyLayer())
+				->setScope('circle')
+				->setValue('ordered_numeric')
+				->setAllowChildOverride(true)
+				->setVisibleToChild(true),
+		];
+
+		$resolver = new DefaultPolicyResolver($source);
+		$resolved = $resolver->resolve($this->getDefinition(), PolicyContext::fromUserId('john'));
+
+		$this->assertSame('parallel', $resolved->getEffectiveValue());
+		$this->assertFalse($source->circlePoliciesLoaded);
+	}
+
+	private function getDefinition(): PolicySpec {
+		return new PolicySpec(
+			key: 'signature_flow',
+			defaultSystemValue: 'none',
+			allowedValues: ['none', 'parallel', 'ordered_numeric'],
+		);
+	}
+
+	private function getValueChoiceDefinition(): PolicySpec {
+		return new PolicySpec(
+			key: 'signature_flow',
+			defaultSystemValue: 'none',
+			allowedValues: ['none', 'parallel', 'ordered_numeric'],
+			resolutionMode: PolicySpec::RESOLUTION_MODE_VALUE_CHOICE,
+		);
+	}
+}
+
+final class InMemoryPolicySource implements IPolicySource {
+	public ?PolicyLayer $systemLayer = null;
+	/** @var list<PolicyLayer> */
+	public array $groupLayers = [];
+	/** @var list<PolicyLayer> */
+	public array $circleLayers = [];
+	public ?PolicyLayer $userPreference = null;
+	public ?PolicyLayer $requestOverride = null;
+	public bool $userPreferenceCleared = false;
+	public bool $circlePoliciesLoaded = false;
+
+	public function loadSystemPolicy(string $policyKey): ?PolicyLayer {
+		return $this->systemLayer;
+	}
+
+	public function loadGroupPolicies(string $policyKey, PolicyContext $context): array {
+		return $this->groupLayers;
+	}
+
+	public function loadGroupPolicyConfig(string $policyKey, string $groupId): ?PolicyLayer {
+		return $this->groupLayers[0] ?? null;
+	}
+
+	public function loadCirclePolicies(string $policyKey, PolicyContext $context): array {
+		$this->circlePoliciesLoaded = true;
+		return $this->circleLayers;
+	}
+
+	public function loadUserPreference(string $policyKey, PolicyContext $context): ?PolicyLayer {
+		return $this->userPreference;
+	}
+
+	public function loadRequestOverride(string $policyKey, PolicyContext $context): ?PolicyLayer {
+		return $this->requestOverride;
+	}
+
+	public function saveSystemPolicy(string $policyKey, mixed $value, bool $allowChildOverride = false): void {
+	}
+
+	public function saveGroupPolicy(string $policyKey, string $groupId, mixed $value, bool $allowChildOverride): void {
+	}
+
+	public function saveUserPreference(string $policyKey, PolicyContext $context, mixed $value): void {
+	}
+
+	public function clearGroupPolicy(string $policyKey, string $groupId): void {
+	}
+
+	public function clearUserPreference(string $policyKey, PolicyContext $context): void {
+		$this->userPreferenceCleared = true;
+	}
+}
diff --git a/tests/php/Unit/Service/Policy/Runtime/PolicyContextFactoryTest.php b/tests/php/Unit/Service/Policy/Runtime/PolicyContextFactoryTest.php
new file mode 100644
index 0000000000..a556533c90
--- /dev/null
+++ b/tests/php/Unit/Service/Policy/Runtime/PolicyContextFactoryTest.php
@@ -0,0 +1,73 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Libresign\Tests\Unit\Service\Policy\Runtime;
+
+use OCA\Libresign\Service\Policy\Runtime\PolicyContextFactory;
+use OCP\IGroupManager;
+use OCP\IUser;
+use OCP\IUserManager;
+use OCP\IUserSession;
+use PHPUnit\Framework\MockObject\MockObject;
+use PHPUnit\Framework\TestCase;
+
+final class PolicyContextFactoryTest extends TestCase {
+	private IUserManager&MockObject $userManager;
+	private IGroupManager&MockObject $groupManager;
+	private IUserSession&MockObject $userSession;
+
+	protected function setUp(): void {
+		parent::setUp();
+		$this->userManager = $this->createMock(IUserManager::class);
+		$this->groupManager = $this->createMock(IGroupManager::class);
+		$this->userSession = $this->createMock(IUserSession::class);
+	}
+
+	public function testForCurrentUserUsesSessionUser(): void {
+		$user = $this->createMock(IUser::class);
+		$user->method('getUID')->willReturn('john');
+
+		$this->userSession->expects($this->once())->method('getUser')->willReturn($user);
+		$this->groupManager->expects($this->once())->method('getUserGroupIds')->with($user)->willReturn(['finance']);
+
+		$factory = $this->getFactory();
+		$context = $factory->forCurrentUser(['signature_flow' => 'parallel'], ['type' => 'group', 'id' => 'finance']);
+
+		$this->assertSame('john', $context->getUserId());
+		$this->assertSame(['finance'], $context->getGroups());
+		$this->assertSame(['signature_flow' => 'parallel'], $context->getRequestOverrides());
+		$this->assertSame(['type' => 'group', 'id' => 'finance'], $context->getActiveContext());
+	}
+
+	public function testForUserIdLoadsUserWhenAvailable(): void {
+		$user = $this->createMock(IUser::class);
+		$this->userManager->expects($this->once())->method('get')->with('john')->willReturn($user);
+		$this->groupManager->expects($this->once())->method('getUserGroupIds')->with($user)->willReturn(['finance']);
+
+		$factory = $this->getFactory();
+		$context = $factory->forUserId('john');
+
+		$this->assertSame('john', $context->getUserId());
+		$this->assertSame(['finance'], $context->getGroups());
+	}
+
+	public function testForUserIdKeepsUserIdWithoutGroupsWhenUserDoesNotExist(): void {
+		$this->userManager->expects($this->once())->method('get')->with('ghost')->willReturn(null);
+		$this->groupManager->expects($this->never())->method('getUserGroupIds');
+
+		$factory = $this->getFactory();
+		$context = $factory->forUserId('ghost');
+
+		$this->assertSame('ghost', $context->getUserId());
+		$this->assertSame([], $context->getGroups());
+	}
+
+	private function getFactory(): PolicyContextFactory {
+		return new PolicyContextFactory($this->userManager, $this->groupManager, $this->userSession);
+	}
+}
diff --git a/tests/php/Unit/Service/Policy/Runtime/PolicyRegistryTest.php b/tests/php/Unit/Service/Policy/Runtime/PolicyRegistryTest.php
new file mode 100644
index 0000000000..866cf65d98
--- /dev/null
+++ b/tests/php/Unit/Service/Policy/Runtime/PolicyRegistryTest.php
@@ -0,0 +1,114 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Libresign\Tests\Unit\Service\Policy\Runtime;
+
+use OCA\Libresign\Service\Policy\Contract\IPolicyDefinition;
+use OCA\Libresign\Service\Policy\Contract\IPolicyDefinitionProvider;
+use OCA\Libresign\Service\Policy\Model\PolicyContext;
+use OCA\Libresign\Service\Policy\Model\PolicySpec;
+use OCA\Libresign\Service\Policy\Provider\DocMdp\DocMdpPolicy;
+use OCA\Libresign\Service\Policy\Provider\Footer\AddFooterPolicy;
+use OCA\Libresign\Service\Policy\Provider\Footer\SignatureFooterPolicyValue;
+use OCA\Libresign\Service\Policy\Provider\Signature\SignatureFlowPolicy;
+use OCA\Libresign\Service\Policy\Runtime\PolicyRegistry;
+use PHPUnit\Framework\TestCase;
+use Psr\Container\ContainerInterface;
+
+final class PolicyRegistryTest extends TestCase {
+	public function testRegistryReturnsSignatureFlowDefinition(): void {
+		$container = $this->createMock(ContainerInterface::class);
+		$container->method('get')->with(SignatureFlowPolicy::class)->willReturn(new SignatureFlowPolicy());
+		$registry = new PolicyRegistry($container);
+		$definition = $registry->get(SignatureFlowPolicy::KEY);
+
+		$this->assertSame(SignatureFlowPolicy::KEY, $definition->key());
+		$this->assertSame('none', $definition->defaultSystemValue());
+		$this->assertSame(['none', 'parallel', 'ordered_numeric'], $definition->allowedValues(new PolicyContext()));
+		$this->assertSame('ordered_numeric', $definition->normalizeValue('ordered_numeric'));
+	}
+
+	public function testRegistryReturnsDocMdpDefinition(): void {
+		$container = $this->createMock(ContainerInterface::class);
+		$container->method('get')->with(DocMdpPolicy::class)->willReturn(new DocMdpPolicy());
+		$registry = new PolicyRegistry($container);
+		$definition = $registry->get(DocMdpPolicy::KEY);
+
+		$this->assertSame(DocMdpPolicy::KEY, $definition->key());
+		$this->assertSame(0, $definition->defaultSystemValue());
+		$this->assertSame([0, 1, 2, 3], $definition->allowedValues(new PolicyContext()));
+		$this->assertSame(2, $definition->normalizeValue(2));
+	}
+
+	public function testRegistryReturnsAddFooterDefinition(): void {
+		$container = $this->createMock(ContainerInterface::class);
+		$container->method('get')->with(AddFooterPolicy::class)->willReturn(new AddFooterPolicy());
+		$registry = new PolicyRegistry($container);
+		$definition = $registry->get(AddFooterPolicy::KEY);
+
+		$this->assertSame(AddFooterPolicy::KEY, $definition->key());
+		$this->assertSame(
+			SignatureFooterPolicyValue::encode(SignatureFooterPolicyValue::defaults()),
+			$definition->defaultSystemValue(),
+		);
+		$this->assertSame([], $definition->allowedValues(new PolicyContext()));
+		$this->assertSame(
+			SignatureFooterPolicyValue::encode([
+				'enabled' => false,
+				'writeQrcodeOnFooter' => true,
+				'validationSite' => '',
+				'customizeFooterTemplate' => false,
+			]),
+			$definition->normalizeValue('0'),
+		);
+	}
+
+
+	public function testRegistryThrowsForUnknownPolicy(): void {
+		$this->expectException(\InvalidArgumentException::class);
+
+		$container = $this->createMock(ContainerInterface::class);
+		$container->method('get')->with(SignatureFlowPolicy::class)->willReturn(new SignatureFlowPolicy());
+		$registry = new PolicyRegistry($container);
+		$registry->get('unknown_policy');
+	}
+
+	public function testRegistryCachesDefinitionAfterFirstLookup(): void {
+		$provider = new CountingPolicyDefinitionProvider();
+		$container = $this->createMock(ContainerInterface::class);
+		$container->expects($this->once())
+			->method('get')
+			->with(SignatureFlowPolicy::class)
+			->willReturn($provider);
+		$registry = new PolicyRegistry($container);
+
+		$first = $registry->get(SignatureFlowPolicy::KEY);
+		$second = $registry->get(SignatureFlowPolicy::KEY);
+
+		$this->assertSame($first, $second);
+		$this->assertSame(1, $provider->calls);
+	}
+}
+
+final class CountingPolicyDefinitionProvider implements IPolicyDefinitionProvider {
+	public int $calls = 0;
+
+	public function keys(): array {
+		return [SignatureFlowPolicy::KEY];
+	}
+
+	public function get(string|\BackedEnum $policyKey): IPolicyDefinition {
+		++$this->calls;
+
+		return new PolicySpec(
+			key: SignatureFlowPolicy::KEY,
+			defaultSystemValue: 'none',
+			allowedValues: ['none', 'parallel', 'ordered_numeric'],
+		);
+	}
+}
diff --git a/tests/php/Unit/Service/Policy/Runtime/PolicySourceTest.php b/tests/php/Unit/Service/Policy/Runtime/PolicySourceTest.php
new file mode 100644
index 0000000000..f66f77c799
--- /dev/null
+++ b/tests/php/Unit/Service/Policy/Runtime/PolicySourceTest.php
@@ -0,0 +1,547 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Libresign\Tests\Unit\Service\Policy\Runtime;
+
+use OCA\Libresign\Db\PermissionSet;
+use OCA\Libresign\Db\PermissionSetBinding;
+use OCA\Libresign\Db\PermissionSetBindingMapper;
+use OCA\Libresign\Db\PermissionSetMapper;
+use OCA\Libresign\Service\Policy\Model\PolicyContext;
+use OCA\Libresign\Service\Policy\Provider\DocMdp\DocMdpPolicy;
+use OCA\Libresign\Service\Policy\Provider\Footer\AddFooterPolicy;
+use OCA\Libresign\Service\Policy\Provider\Signature\SignatureFlowPolicy;
+use OCA\Libresign\Service\Policy\Runtime\PolicyRegistry;
+use OCA\Libresign\Service\Policy\Runtime\PolicySource;
+use OCP\AppFramework\Db\DoesNotExistException;
+use OCP\AppFramework\Services\IAppConfig;
+use PHPUnit\Framework\MockObject\MockObject;
+use PHPUnit\Framework\TestCase;
+use Psr\Container\ContainerInterface;
+
+final class PolicySourceTest extends TestCase {
+	private IAppConfig&MockObject $appConfig;
+	private PermissionSetMapper&MockObject $permissionSetMapper;
+	private PermissionSetBindingMapper&MockObject $bindingMapper;
+	private PolicyRegistry $registry;
+
+	protected function setUp(): void {
+		parent::setUp();
+		$this->appConfig = $this->createMock(IAppConfig::class);
+		$this->permissionSetMapper = $this->createMock(PermissionSetMapper::class);
+		$this->bindingMapper = $this->createMock(PermissionSetBindingMapper::class);
+		$container = $this->createMock(ContainerInterface::class);
+		$container
+			->method('get')
+			->willReturnCallback(static function (string $class): object {
+				return match ($class) {
+					AddFooterPolicy::class => new AddFooterPolicy(),
+					SignatureFlowPolicy::class => new SignatureFlowPolicy(),
+					DocMdpPolicy::class => new DocMdpPolicy(),
+					default => throw new \RuntimeException('Unexpected provider class: ' . $class),
+				};
+			});
+		$this->registry = new PolicyRegistry($container);
+	}
+
+	public function testLoadSystemPolicyReturnsForcedLayerWhenAppConfigIsSet(): void {
+		$calls = 0;
+		$this->appConfig
+			->expects($this->once())
+			->method('hasAppKey')
+			->with('policy.signature_flow.system')
+			->willReturn(true);
+
+		$this->appConfig
+			->expects($this->exactly(2))
+			->method('getAppValueString')
+			->willReturnCallback(static function (string $key, string $default) use (&$calls): string {
+				$calls += 1;
+				if ($key === 'policy.signature_flow.system' && $default === 'none') {
+					return 'ordered_numeric';
+				}
+
+				if ($key === 'policy.signature_flow.system.allow_child_override' && $default === '0') {
+					return '0';
+				}
+
+				throw new \RuntimeException('Unexpected app config key request: ' . $key);
+			});
+
+		$source = $this->getSource();
+		$layer = $source->loadSystemPolicy('signature_flow');
+
+		$this->assertNotNull($layer);
+		$this->assertSame('global', $layer->getScope());
+		$this->assertSame('ordered_numeric', $layer->getValue());
+		$this->assertFalse($layer->isAllowChildOverride());
+		$this->assertSame(['ordered_numeric'], $layer->getAllowedValues());
+		$this->assertSame(2, $calls);
+	}
+
+	public function testLoadSystemPolicyReturnsInheritableLayerWhenAppConfigMatchesDefault(): void {
+		$this->appConfig
+			->expects($this->once())
+			->method('hasAppKey')
+			->with('policy.signature_flow.system')
+			->willReturn(false);
+
+		$this->appConfig
+			->expects($this->never())
+			->method('getAppValueString');
+
+		$source = $this->getSource();
+		$layer = $source->loadSystemPolicy('signature_flow');
+
+		$this->assertNotNull($layer);
+		$this->assertSame('none', $layer->getValue());
+		$this->assertSame('system', $layer->getScope());
+		$this->assertTrue($layer->isAllowChildOverride());
+		$this->assertSame([], $layer->getAllowedValues());
+	}
+
+	public function testLoadGroupPoliciesReturnsBoundPermissionSetForActiveGroup(): void {
+		$binding = new PermissionSetBinding();
+		$binding->setPermissionSetId(77);
+		$binding->setTargetType('group');
+		$binding->setTargetId('finance');
+
+		$permissionSet = new PermissionSet();
+		$permissionSet->setId(77);
+		$permissionSet->setPolicyJson([
+			'signature_flow' => [
+				'defaultValue' => 'ordered_numeric',
+				'allowChildOverride' => false,
+				'visibleToChild' => true,
+				'allowedValues' => ['ordered_numeric'],
+			],
+		]);
+
+		$this->bindingMapper
+			->expects($this->once())
+			->method('findByTargets')
+			->with('group', ['finance'])
+			->willReturn([$binding]);
+
+		$this->permissionSetMapper
+			->expects($this->once())
+			->method('findByIds')
+			->with([77])
+			->willReturn([$permissionSet]);
+
+		$context = PolicyContext::fromUserId('john')
+			->setGroups(['finance'])
+			->setActiveContext(['type' => 'group', 'id' => 'finance']);
+
+		$source = $this->getSource();
+		$layers = $source->loadGroupPolicies('signature_flow', $context);
+
+		$this->assertCount(1, $layers);
+		$this->assertSame('group', $layers[0]->getScope());
+		$this->assertSame('ordered_numeric', $layers[0]->getValue());
+		$this->assertFalse($layers[0]->isAllowChildOverride());
+		$this->assertSame(['ordered_numeric'], $layers[0]->getAllowedValues());
+	}
+
+	public function testLoadUserPreferenceReturnsLayerFromUserConfig(): void {
+		$this->appConfig
+			->expects($this->once())
+			->method('getUserValue')
+			->with('john', 'policy.signature_flow', '')
+			->willReturn('parallel');
+
+		$source = $this->getSource();
+		$layer = $source->loadUserPreference('signature_flow', PolicyContext::fromUserId('john'));
+
+		$this->assertNotNull($layer);
+		$this->assertSame('user', $layer->getScope());
+		$this->assertSame('parallel', $layer->getValue());
+	}
+
+	public function testSaveUserPreferenceNormalizesAndPersistsUserConfigValue(): void {
+		$this->appConfig
+			->expects($this->once())
+			->method('setUserValue')
+			->with('john', 'policy.signature_flow', 'ordered_numeric');
+
+		$source = $this->getSource();
+		$source->saveUserPreference('signature_flow', PolicyContext::fromUserId('john'), 'ordered_numeric');
+	}
+
+	public function testClearUserPreferenceDeletesUserConfig(): void {
+		$this->appConfig
+			->expects($this->once())
+			->method('deleteUserValue')
+			->with('john', 'policy.signature_flow');
+
+		$source = $this->getSource();
+		$source->clearUserPreference('signature_flow', PolicyContext::fromUserId('john'));
+	}
+
+	public function testSaveSystemPolicyDeletesAppConfigWhenValueMatchesDefault(): void {
+		$deletedKeys = [];
+		$this->appConfig
+			->expects($this->exactly(2))
+			->method('deleteAppValue')
+			->willReturnCallback(static function (string $key) use (&$deletedKeys): bool {
+				$deletedKeys[] = $key;
+				return true;
+			});
+
+		$source = $this->getSource();
+		$source->saveSystemPolicy('signature_flow', 'none');
+
+		$this->assertSame(['policy.signature_flow.system', 'policy.signature_flow.system.allow_child_override'], $deletedKeys);
+	}
+
+	public function testSaveSystemPolicyPersistsExplicitDefaultWhenAllowChildOverrideIsTrue(): void {
+		$savedValues = [];
+		$this->appConfig
+			->expects($this->exactly(2))
+			->method('setAppValueString')
+			->willReturnCallback(static function (string $key, string $value) use (&$savedValues): bool {
+				$savedValues[$key] = $value;
+				return true;
+			});
+
+		$this->appConfig
+			->expects($this->never())
+			->method('deleteAppValue');
+
+		$source = $this->getSource();
+		$source->saveSystemPolicy('signature_flow', 'none', true);
+
+		$this->assertSame([
+			'policy.signature_flow.system' => 'none',
+			'policy.signature_flow.system.allow_child_override' => '1',
+		], $savedValues);
+	}
+
+	public function testSaveSystemPolicyNormalizesAndPersistsAppConfigValue(): void {
+		$savedValues = [];
+		$this->appConfig
+			->expects($this->exactly(2))
+			->method('setAppValueString')
+			->willReturnCallback(static function (string $key, string $value) use (&$savedValues): bool {
+				$savedValues[$key] = $value;
+				return true;
+			});
+
+		$source = $this->getSource();
+		$source->saveSystemPolicy('signature_flow', 'ordered_numeric', true);
+
+		$this->assertSame([
+			'policy.signature_flow.system' => 'ordered_numeric',
+			'policy.signature_flow.system.allow_child_override' => '1',
+		], $savedValues);
+	}
+
+	public function testLoadSystemPolicyRespectsPersistedAllowChildOverride(): void {
+		$calls = 0;
+		$this->appConfig
+			->expects($this->once())
+			->method('hasAppKey')
+			->with('policy.signature_flow.system')
+			->willReturn(true);
+
+		$this->appConfig
+			->expects($this->exactly(2))
+			->method('getAppValueString')
+			->willReturnCallback(static function (string $key, string $default) use (&$calls): string {
+				$calls += 1;
+				if ($key === 'policy.signature_flow.system' && $default === 'none') {
+					return 'ordered_numeric';
+				}
+
+				if ($key === 'policy.signature_flow.system.allow_child_override' && $default === '0') {
+					return '1';
+				}
+
+				throw new \RuntimeException('Unexpected app config key request: ' . $key);
+			});
+
+		$source = $this->getSource();
+		$layer = $source->loadSystemPolicy('signature_flow');
+
+		$this->assertNotNull($layer);
+		$this->assertSame('ordered_numeric', $layer->getValue());
+		$this->assertSame('global', $layer->getScope());
+		$this->assertTrue($layer->isAllowChildOverride());
+		$this->assertSame([], $layer->getAllowedValues());
+		$this->assertSame(2, $calls);
+	}
+
+	public function testLoadSystemPolicyTreatsPersistedDefaultAsExplicitWhenAllowChildOverrideIsSet(): void {
+		$this->appConfig
+			->expects($this->once())
+			->method('hasAppKey')
+			->with('policy.signature_flow.system')
+			->willReturn(true);
+
+		$this->appConfig
+			->expects($this->exactly(2))
+			->method('getAppValueString')
+			->willReturnCallback(static function (string $key, string $default): string {
+				if ($key === 'policy.signature_flow.system' && $default === 'none') {
+					return 'none';
+				}
+
+				if ($key === 'policy.signature_flow.system.allow_child_override' && $default === '0') {
+					return '1';
+				}
+
+				throw new \RuntimeException('Unexpected app config key request: ' . $key);
+			});
+
+		$source = $this->getSource();
+		$layer = $source->loadSystemPolicy('signature_flow');
+
+		$this->assertNotNull($layer);
+		$this->assertSame('none', $layer->getValue());
+		$this->assertSame('global', $layer->getScope());
+		$this->assertTrue($layer->isAllowChildOverride());
+		$this->assertSame([], $layer->getAllowedValues());
+	}
+
+	public function testLoadSystemPolicyReturnsDocMdpLayerFromTypedIntConfig(): void {
+		$this->appConfig
+			->expects($this->once())
+			->method('hasAppKey')
+			->with('docmdp_level')
+			->willReturn(true);
+
+		$this->appConfig
+			->expects($this->once())
+			->method('getAppValueInt')
+			->with('docmdp_level', 0)
+			->willReturn(2);
+
+		$this->appConfig
+			->expects($this->once())
+			->method('getAppValueString')
+			->willReturnCallback(static function (string $key, string $default): string {
+				if ($key === 'docmdp_level.allow_child_override' && $default === '0') {
+					return '0';
+				}
+
+				throw new \RuntimeException('Unexpected app config key request: ' . $key);
+			});
+
+		$source = $this->getSource();
+		$layer = $source->loadSystemPolicy(DocMdpPolicy::KEY);
+
+		$this->assertNotNull($layer);
+		$this->assertSame('global', $layer->getScope());
+		$this->assertSame(2, $layer->getValue());
+		$this->assertFalse($layer->isAllowChildOverride());
+		$this->assertSame([2], $layer->getAllowedValues());
+	}
+
+	public function testSaveSystemPolicyPersistsDocMdpLevelAsTypedInt(): void {
+		$this->appConfig
+			->expects($this->once())
+			->method('setAppValueInt')
+			->with('docmdp_level', 2)
+			->willReturn(true);
+
+		$this->appConfig
+			->expects($this->once())
+			->method('setAppValueString')
+			->with('docmdp_level.allow_child_override', '0')
+			->willReturn(true);
+
+		$source = $this->getSource();
+		$source->saveSystemPolicy(DocMdpPolicy::KEY, 2, false);
+	}
+
+	public function testLoadGroupPolicyConfigReturnsBoundPolicyLayer(): void {
+		$binding = new PermissionSetBinding();
+		$binding->setPermissionSetId(77);
+		$binding->setTargetType('group');
+		$binding->setTargetId('finance');
+
+		$permissionSet = new PermissionSet();
+		$permissionSet->setId(77);
+		$permissionSet->setPolicyJson([
+			'signature_flow' => [
+				'defaultValue' => 'parallel',
+				'allowChildOverride' => true,
+				'visibleToChild' => true,
+				'allowedValues' => [],
+			],
+		]);
+
+		$this->bindingMapper
+			->expects($this->once())
+			->method('getByTarget')
+			->with('group', 'finance')
+			->willReturn($binding);
+
+		$this->permissionSetMapper
+			->expects($this->once())
+			->method('getById')
+			->with(77)
+			->willReturn($permissionSet);
+
+		$source = $this->getSource();
+		$layer = $source->loadGroupPolicyConfig('signature_flow', 'finance');
+
+		$this->assertNotNull($layer);
+		$this->assertSame('group', $layer->getScope());
+		$this->assertSame('parallel', $layer->getValue());
+		$this->assertTrue($layer->isAllowChildOverride());
+	}
+
+	public function testSaveGroupPolicyCreatesPermissionSetAndBinding(): void {
+		$this->bindingMapper
+			->expects($this->once())
+			->method('getByTarget')
+			->with('group', 'finance')
+			->willThrowException(new DoesNotExistException('missing'));
+
+		$this->permissionSetMapper
+			->expects($this->once())
+			->method('insert')
+			->with($this->callback(function (PermissionSet $permissionSet): bool {
+				$this->assertSame('group', $permissionSet->getScopeType());
+				$this->assertSame('group:finance', $permissionSet->getName());
+				$this->assertSame([
+					'signature_flow' => [
+						'defaultValue' => 'ordered_numeric',
+						'allowChildOverride' => false,
+						'visibleToChild' => true,
+						'allowedValues' => ['ordered_numeric'],
+					],
+				], $permissionSet->getDecodedPolicyJson());
+				return true;
+			}))
+			->willReturnCallback(static function (PermissionSet $permissionSet): PermissionSet {
+				$permissionSet->setId(77);
+				return $permissionSet;
+			});
+
+		$this->bindingMapper
+			->expects($this->once())
+			->method('insert')
+			->with($this->callback(function (PermissionSetBinding $binding): bool {
+				$this->assertSame(77, $binding->getPermissionSetId());
+				$this->assertSame('group', $binding->getTargetType());
+				$this->assertSame('finance', $binding->getTargetId());
+				return true;
+			}));
+
+		$source = $this->getSource();
+		$source->saveGroupPolicy('signature_flow', 'finance', 'ordered_numeric', false);
+	}
+
+	public function testSaveGroupPolicyCreatesDocMdpPermissionSetWithNormalizedLevel(): void {
+		$this->bindingMapper
+			->expects($this->once())
+			->method('getByTarget')
+			->with('group', 'finance')
+			->willThrowException(new DoesNotExistException('missing'));
+
+		$this->permissionSetMapper
+			->expects($this->once())
+			->method('insert')
+			->with($this->callback(function (PermissionSet $permissionSet): bool {
+				$this->assertSame('group', $permissionSet->getScopeType());
+				$this->assertSame('group:finance', $permissionSet->getName());
+				$this->assertSame([
+					'docmdp' => [
+						'defaultValue' => 3,
+						'allowChildOverride' => false,
+						'visibleToChild' => true,
+						'allowedValues' => [3],
+					],
+				], $permissionSet->getDecodedPolicyJson());
+				return true;
+			}))
+			->willReturnCallback(static function (PermissionSet $permissionSet): PermissionSet {
+				$permissionSet->setId(91);
+				return $permissionSet;
+			});
+
+		$this->bindingMapper
+			->expects($this->once())
+			->method('insert')
+			->with($this->callback(function (PermissionSetBinding $binding): bool {
+				$this->assertSame(91, $binding->getPermissionSetId());
+				$this->assertSame('group', $binding->getTargetType());
+				$this->assertSame('finance', $binding->getTargetId());
+				return true;
+			}));
+
+		$source = $this->getSource();
+		$source->saveGroupPolicy(DocMdpPolicy::KEY, 'finance', 3, false);
+	}
+
+	public function testClearGroupPolicyDeletesBindingAndPermissionSetWhenItIsTheLastPolicy(): void {
+		$binding = new PermissionSetBinding();
+		$binding->setPermissionSetId(77);
+		$binding->setTargetType('group');
+		$binding->setTargetId('finance');
+
+		$permissionSet = new PermissionSet();
+		$permissionSet->setId(77);
+		$permissionSet->setPolicyJson([
+			'signature_flow' => [
+				'defaultValue' => 'parallel',
+				'allowChildOverride' => true,
+				'visibleToChild' => true,
+				'allowedValues' => [],
+			],
+		]);
+
+		$this->bindingMapper
+			->expects($this->once())
+			->method('getByTarget')
+			->with('group', 'finance')
+			->willReturn($binding);
+
+		$this->permissionSetMapper
+			->expects($this->once())
+			->method('getById')
+			->with(77)
+			->willReturn($permissionSet);
+
+		$this->bindingMapper
+			->expects($this->once())
+			->method('delete')
+			->with($binding);
+
+		$this->permissionSetMapper
+			->expects($this->once())
+			->method('delete')
+			->with($permissionSet);
+
+		$source = $this->getSource();
+		$source->clearGroupPolicy('signature_flow', 'finance');
+	}
+
+	public function testLoadRequestOverrideReturnsLayerFromContext(): void {
+		$source = $this->getSource();
+		$context = PolicyContext::fromUserId('john')
+			->setRequestOverrides(['signature_flow' => 'ordered_numeric']);
+
+		$layer = $source->loadRequestOverride('signature_flow', $context);
+
+		$this->assertNotNull($layer);
+		$this->assertSame('request', $layer->getScope());
+		$this->assertSame('ordered_numeric', $layer->getValue());
+	}
+
+	private function getSource(): PolicySource {
+		return new PolicySource(
+			$this->appConfig,
+			$this->permissionSetMapper,
+			$this->bindingMapper,
+			$this->registry,
+		);
+	}
+}
diff --git a/tests/php/Unit/Service/RequestSignatureServiceTest.php b/tests/php/Unit/Service/RequestSignatureServiceTest.php
index 3cfa29968c..db95a4cefe 100644
--- a/tests/php/Unit/Service/RequestSignatureServiceTest.php
+++ b/tests/php/Unit/Service/RequestSignatureServiceTest.php
@@ -17,6 +17,8 @@
 use OCA\Libresign\Db\IdentifyMethodMapper;
 use OCA\Libresign\Db\SignRequest;
 use OCA\Libresign\Db\SignRequestMapper;
+use OCA\Libresign\Enum\DocMdpLevel;
+use OCA\Libresign\Enum\SignatureFlow;
 use OCA\Libresign\Exception\LibresignException;
 use OCA\Libresign\Handler\DocMdpHandler;
 use OCA\Libresign\Helper\FileUploadHelper;
@@ -30,6 +32,10 @@
 use OCA\Libresign\Service\FileStatusService;
 use OCA\Libresign\Service\FolderService;
 use OCA\Libresign\Service\IdentifyMethodService;
+use OCA\Libresign\Service\Policy\Model\ResolvedPolicy;
+use OCA\Libresign\Service\Policy\PolicyService;
+use OCA\Libresign\Service\Policy\Provider\DocMdp\DocMdpPolicy;
+use OCA\Libresign\Service\Policy\Provider\Signature\SignatureFlowPolicy;
 use OCA\Libresign\Service\RequestSignatureService;
 use OCA\Libresign\Service\SequentialSigningService;
 use OCA\Libresign\Service\SignRequest\SignRequestService;
@@ -77,6 +83,7 @@ final class RequestSignatureServiceTest extends \OCA\Libresign\Tests\Unit\TestCa
 	private EnvelopeFileRelocator&MockObject $envelopeFileRelocator;
 	private FileUploadHelper&MockObject $uploadHelper;
 	private SignRequestService&MockObject $signRequestService;
+	private PolicyService&MockObject $policyService;
 
 	public function setUp(): void {
 		parent::setUp();
@@ -111,6 +118,7 @@ public function setUp(): void {
 		$this->envelopeFileRelocator = $this->createMock(EnvelopeFileRelocator::class);
 		$this->uploadHelper = $this->createMock(FileUploadHelper::class);
 		$this->signRequestService = $this->createMock(SignRequestService::class);
+		$this->policyService = $this->createMock(PolicyService::class);
 	}
 
 	private function getService(array $methods = []): RequestSignatureService|MockObject {
@@ -142,6 +150,7 @@ private function getService(array $methods = []): RequestSignatureService|MockOb
 					$this->envelopeFileRelocator,
 					$this->uploadHelper,
 					$this->signRequestService,
+					$this->policyService,
 				])
 				->onlyMethods($methods)
 				->getMock();
@@ -173,6 +182,7 @@ private function getService(array $methods = []): RequestSignatureService|MockOb
 			$this->envelopeFileRelocator,
 			$this->uploadHelper,
 			$this->signRequestService,
+			$this->policyService,
 		);
 	}
 
@@ -477,6 +487,7 @@ public function testDeleteIdentifyMethodIfNotExitsKeepsMatchingIdentifyMethods()
 				$this->envelopeFileRelocator,
 				$this->uploadHelper,
 				$this->signRequestService,
+				$this->policyService,
 			])
 			->onlyMethods(['unassociateToUser'])
 			->getMock();
@@ -549,6 +560,7 @@ public function testDeleteIdentifyMethodIfNotExitsRemovesMissingIdentifyMethods(
 				$this->envelopeFileRelocator,
 				$this->uploadHelper,
 				$this->signRequestService,
+				$this->policyService,
 			])
 			->onlyMethods(['unassociateToUser'])
 			->getMock();
@@ -833,4 +845,358 @@ public function testSaveEnvelopeExtractsFileDescriptorFromNestedFilesArrayItems(
 		$this->assertSame($envelope, $result['envelope']);
 		$this->assertCount(2, $result['files']);
 	}
+
+	public function testSetSignatureFlowPrefersPayloadOverGlobalConfig(): void {
+		$file = new \OCA\Libresign\Db\File();
+		$this->policyService
+			->expects($this->once())
+			->method('resolveForUser')
+			->with(SignatureFlowPolicy::KEY, null, [SignatureFlowPolicy::KEY => SignatureFlow::PARALLEL->value])
+			->willReturn($this->createResolvedPolicy(SignatureFlow::PARALLEL->value));
+
+		self::invokePrivate($this->getService(), 'setSignatureFlow', [
+			$file,
+			['signatureFlow' => SignatureFlow::PARALLEL->value],
+		]);
+
+		$this->assertSame(SignatureFlow::PARALLEL, $file->getSignatureFlowEnum());
+	}
+
+	public function testSetSignatureFlowUsesGlobalConfigWhenPayloadMissing(): void {
+		$file = new \OCA\Libresign\Db\File();
+		$this->policyService
+			->expects($this->once())
+			->method('resolveForUser')
+			->with(SignatureFlowPolicy::KEY, null, [])
+			->willReturn($this->createResolvedPolicy(SignatureFlow::ORDERED_NUMERIC->value));
+
+		self::invokePrivate($this->getService(), 'setSignatureFlow', [
+			$file,
+			[],
+		]);
+
+		$this->assertSame(SignatureFlow::ORDERED_NUMERIC, $file->getSignatureFlowEnum());
+	}
+
+	public function testSetSignatureFlowDefaultsToNoneWithoutPayloadOrGlobalConfig(): void {
+		$file = new \OCA\Libresign\Db\File();
+		$this->policyService
+			->expects($this->once())
+			->method('resolveForUser')
+			->with(SignatureFlowPolicy::KEY, null, [])
+			->willReturn($this->createResolvedPolicy(SignatureFlow::NONE->value));
+
+		self::invokePrivate($this->getService(), 'setSignatureFlow', [
+			$file,
+			[],
+		]);
+
+		$this->assertSame(SignatureFlow::NONE, $file->getSignatureFlowEnum());
+	}
+
+	public function testSetSignatureFlowThrowsWhenRequestOverrideIsBlocked(): void {
+		$file = new \OCA\Libresign\Db\File();
+		$this->policyService
+			->expects($this->once())
+			->method('resolveForUser')
+			->with(SignatureFlowPolicy::KEY, null, [SignatureFlowPolicy::KEY => SignatureFlow::PARALLEL->value])
+			->willReturn($this->createResolvedPolicy(
+				SignatureFlow::ORDERED_NUMERIC->value,
+				sourceScope: 'group',
+				canUseAsRequestOverride: false,
+				blockedBy: 'group',
+			));
+
+		$this->expectException(LibresignException::class);
+		$this->expectExceptionCode(422);
+
+		self::invokePrivate($this->getService(), 'setSignatureFlow', [
+			$file,
+			['signatureFlow' => SignatureFlow::PARALLEL->value],
+		]);
+	}
+
+	public function testSetSignatureFlowStoresResolvedPolicySnapshotInMetadata(): void {
+		$file = new \OCA\Libresign\Db\File();
+		$this->policyService
+			->expects($this->once())
+			->method('resolveForUser')
+			->with(SignatureFlowPolicy::KEY, null, [])
+			->willReturn($this->createResolvedPolicy(
+				SignatureFlow::ORDERED_NUMERIC->value,
+				sourceScope: 'group',
+			));
+
+		self::invokePrivate($this->getService(), 'setSignatureFlow', [
+			$file,
+			[],
+		]);
+
+		$this->assertSame(SignatureFlow::ORDERED_NUMERIC, $file->getSignatureFlowEnum());
+		$this->assertSame([
+			'policy_snapshot' => [
+				'signature_flow' => [
+					'effectiveValue' => SignatureFlow::ORDERED_NUMERIC->value,
+					'sourceScope' => 'group',
+				],
+			],
+		], $file->getMetadata());
+	}
+
+	public function testUpdateSignatureFlowIfAllowedForcesGlobalConfigOverFileValue(): void {
+		$file = new \OCA\Libresign\Db\File();
+		$file->setUserId('john');
+		$file->setSignatureFlowEnum(SignatureFlow::PARALLEL);
+		$this->policyService
+			->expects($this->once())
+			->method('resolveForUserId')
+			->with(SignatureFlowPolicy::KEY, 'john', [SignatureFlowPolicy::KEY => SignatureFlow::PARALLEL->value])
+			->willReturn($this->createResolvedPolicy(SignatureFlow::ORDERED_NUMERIC->value));
+
+		$this->fileService
+			->expects($this->once())
+			->method('update')
+			->with($this->identicalTo($file));
+
+		self::invokePrivate($this->getService(), 'updateSignatureFlowIfAllowed', [
+			$file,
+			['signatureFlow' => SignatureFlow::PARALLEL->value],
+		]);
+
+		$this->assertSame(SignatureFlow::ORDERED_NUMERIC, $file->getSignatureFlowEnum());
+	}
+
+	public function testUpdateSignatureFlowIfAllowedUsesPayloadWhenGlobalConfigNotForced(): void {
+		$file = new \OCA\Libresign\Db\File();
+		$file->setUserId('john');
+		$file->setSignatureFlowEnum(SignatureFlow::NONE);
+		$this->policyService
+			->expects($this->once())
+			->method('resolveForUserId')
+			->with(SignatureFlowPolicy::KEY, 'john', [SignatureFlowPolicy::KEY => SignatureFlow::PARALLEL->value])
+			->willReturn($this->createResolvedPolicy(SignatureFlow::PARALLEL->value));
+
+		$this->fileService
+			->expects($this->once())
+			->method('update')
+			->with($this->identicalTo($file));
+
+		self::invokePrivate($this->getService(), 'updateSignatureFlowIfAllowed', [
+			$file,
+			['signatureFlow' => SignatureFlow::PARALLEL->value],
+		]);
+
+		$this->assertSame(SignatureFlow::PARALLEL, $file->getSignatureFlowEnum());
+	}
+
+	public function testUpdateSignatureFlowIfAllowedThrowsWhenRequestOverrideIsBlocked(): void {
+		$file = new \OCA\Libresign\Db\File();
+		$file->setUserId('john');
+		$file->setSignatureFlowEnum(SignatureFlow::NONE);
+		$this->policyService
+			->expects($this->once())
+			->method('resolveForUserId')
+			->with(SignatureFlowPolicy::KEY, 'john', [SignatureFlowPolicy::KEY => SignatureFlow::PARALLEL->value])
+			->willReturn($this->createResolvedPolicy(
+				SignatureFlow::ORDERED_NUMERIC->value,
+				sourceScope: 'group',
+				canUseAsRequestOverride: false,
+				blockedBy: 'group',
+			));
+
+		$this->fileService
+			->expects($this->never())
+			->method('update');
+
+		$this->expectException(LibresignException::class);
+		$this->expectExceptionCode(422);
+
+		self::invokePrivate($this->getService(), 'updateSignatureFlowIfAllowed', [
+			$file,
+			['signatureFlow' => SignatureFlow::PARALLEL->value],
+		]);
+	}
+
+	public function testUpdateSignatureFlowIfAllowedKeepsCurrentValueWithoutPayloadOrForcedGlobal(): void {
+		$file = new \OCA\Libresign\Db\File();
+		$file->setUserId('john');
+		$file->setSignatureFlowEnum(SignatureFlow::PARALLEL);
+		$file->setMetadata([
+			'policy_snapshot' => [
+				'signature_flow' => [
+					'effectiveValue' => SignatureFlow::PARALLEL->value,
+					'sourceScope' => 'system',
+				],
+			],
+		]);
+		$this->policyService
+			->expects($this->once())
+			->method('resolveForUserId')
+			->with(SignatureFlowPolicy::KEY, 'john', [])
+			->willReturn($this->createResolvedPolicy(SignatureFlow::PARALLEL->value));
+
+		$this->fileService
+			->expects($this->never())
+			->method('update');
+
+		self::invokePrivate($this->getService(), 'updateSignatureFlowIfAllowed', [
+			$file,
+			[],
+		]);
+
+		$this->assertSame(SignatureFlow::PARALLEL, $file->getSignatureFlowEnum());
+	}
+
+	public function testUpdateSignatureFlowIfAllowedStoresResolvedPolicySnapshotWhenMissing(): void {
+		$file = new \OCA\Libresign\Db\File();
+		$file->setUserId('john');
+		$file->setSignatureFlowEnum(SignatureFlow::PARALLEL);
+		$this->policyService
+			->expects($this->once())
+			->method('resolveForUserId')
+			->with(SignatureFlowPolicy::KEY, 'john', [])
+			->willReturn($this->createResolvedPolicy(
+				SignatureFlow::PARALLEL->value,
+				sourceScope: 'group',
+			));
+
+		$this->fileService
+			->expects($this->once())
+			->method('update')
+			->with($this->identicalTo($file));
+
+		self::invokePrivate($this->getService(), 'updateSignatureFlowIfAllowed', [
+			$file,
+			[],
+		]);
+
+		$this->assertSame([
+			'policy_snapshot' => [
+				'signature_flow' => [
+					'effectiveValue' => SignatureFlow::PARALLEL->value,
+					'sourceScope' => 'group',
+				],
+			],
+		], $file->getMetadata());
+	}
+
+	public function testSetDocMdpLevelUsesResolvedPolicyValue(): void {
+		$file = new \OCA\Libresign\Db\File();
+		$this->policyService
+			->expects($this->once())
+			->method('resolveForUser')
+			->with(DocMdpPolicy::KEY, null, [])
+			->willReturn($this->createResolvedPolicy(
+				2,
+				policyKey: DocMdpPolicy::KEY,
+			));
+
+		self::invokePrivate($this->getService(), 'setDocMdpLevelFromPolicy', [
+			$file,
+			[],
+		]);
+
+		$this->assertSame(DocMdpLevel::CERTIFIED_FORM_FILLING, $file->getDocmdpLevelEnum());
+	}
+
+	public function testSetDocMdpLevelStoresResolvedPolicySnapshotInMetadata(): void {
+		$file = new \OCA\Libresign\Db\File();
+		$this->policyService
+			->expects($this->once())
+			->method('resolveForUser')
+			->with(DocMdpPolicy::KEY, null, [DocMdpPolicy::KEY => 3])
+			->willReturn($this->createResolvedPolicy(
+				3,
+				sourceScope: 'group',
+				policyKey: DocMdpPolicy::KEY,
+			));
+
+		self::invokePrivate($this->getService(), 'setDocMdpLevelFromPolicy', [
+			$file,
+			['docmdpLevel' => '3'],
+		]);
+
+		$this->assertSame([
+			'policy_snapshot' => [
+				'docmdp' => [
+					'effectiveValue' => 3,
+					'sourceScope' => 'group',
+				],
+			],
+		], $file->getMetadata());
+	}
+
+	public function testUpdateDocMdpLevelFromPolicyUpdatesFileWhenEffectiveValueChanges(): void {
+		$file = new \OCA\Libresign\Db\File();
+		$file->setUserId('john');
+		$file->setDocmdpLevelEnum(DocMdpLevel::NOT_CERTIFIED);
+
+		$this->policyService
+			->expects($this->once())
+			->method('resolveForUserId')
+			->with(DocMdpPolicy::KEY, 'john', [DocMdpPolicy::KEY => 1])
+			->willReturn($this->createResolvedPolicy(
+				1,
+				policyKey: DocMdpPolicy::KEY,
+			));
+
+		$this->fileService
+			->expects($this->once())
+			->method('update')
+			->with($this->identicalTo($file));
+
+		self::invokePrivate($this->getService(), 'updateDocMdpLevelFromPolicy', [
+			$file,
+			['docmdpLevel' => 1],
+		]);
+
+		$this->assertSame(DocMdpLevel::CERTIFIED_NO_CHANGES_ALLOWED, $file->getDocmdpLevelEnum());
+	}
+
+	public function testUpdateDocMdpLevelFromPolicyDoesNotPersistWhenNothingChangedAndSnapshotExists(): void {
+		$file = new \OCA\Libresign\Db\File();
+		$file->setUserId('john');
+		$file->setDocmdpLevelEnum(DocMdpLevel::CERTIFIED_FORM_FILLING);
+		$file->setMetadata([
+			'policy_snapshot' => [
+				'docmdp' => [
+					'effectiveValue' => 2,
+					'sourceScope' => 'system',
+				],
+			],
+		]);
+
+		$this->policyService
+			->expects($this->once())
+			->method('resolveForUserId')
+			->with(DocMdpPolicy::KEY, 'john', [])
+			->willReturn($this->createResolvedPolicy(
+				2,
+				policyKey: DocMdpPolicy::KEY,
+			));
+
+		$this->fileService
+			->expects($this->never())
+			->method('update');
+
+		self::invokePrivate($this->getService(), 'updateDocMdpLevelFromPolicy', [
+			$file,
+			[],
+		]);
+	}
+
+	private function createResolvedPolicy(
+		mixed $effectiveValue,
+		string $sourceScope = 'system',
+		bool $canUseAsRequestOverride = true,
+		?string $blockedBy = null,
+		string $policyKey = 'signature_flow',
+	): ResolvedPolicy {
+		return (new ResolvedPolicy())
+			->setPolicyKey($policyKey)
+			->setEffectiveValue($effectiveValue)
+			->setSourceScope($sourceScope)
+			->setCanUseAsRequestOverride($canUseAsRequestOverride)
+			->setBlockedBy($blockedBy);
+	}
 }
diff --git a/tests/php/Unit/Service/SignFileServiceTest.php b/tests/php/Unit/Service/SignFileServiceTest.php
index f39bfdf37a..665939eb2c 100644
--- a/tests/php/Unit/Service/SignFileServiceTest.php
+++ b/tests/php/Unit/Service/SignFileServiceTest.php
@@ -9,7 +9,6 @@
  * SPDX-License-Identifier: AGPL-3.0-or-later
  */
 
-use bovigo\vfs\vfsStream;
 use DateTime;
 use OC\User\NoUserException;
 use OCA\Libresign\BackgroundJob\SignSingleFileJob;
@@ -1568,7 +1567,7 @@ public function testSetVisibleElements(
 				throw new NotFoundException();
 			});
 
-		vfsStream::setup('home');
+		\bovigo\vfs\vfsStream::setup('home');
 		$this->tempManager->method('getTemporaryFile')
 			->willReturnCallback(function ($postFix) {
 				preg_match('/.*(\d+).*/', $postFix, $matches);
@@ -2664,6 +2663,150 @@ public static function cleanupUnsignedSignedFileProvider(): array {
 		];
 	}
 
+	public function testCreateSignedFileRunsAsOwnerAndRestoresSession(): void {
+		$service = $this->getService();
+
+		$currentUser = $this->createMock(\OCP\IUser::class);
+		$currentUser->method('getUID')->willReturn('signer1');
+
+		$owner = $this->createMock(\OCP\IUser::class);
+		$owner->method('getUID')->willReturn('admin');
+
+		$originalFile = $this->createMock(\OCP\Files\File::class);
+		$originalFile->method('getExtension')->willReturn('pdf');
+		$originalFile->method('getPath')->willReturn('/admin/files/LibreSign/Document.pdf');
+		$originalFile->method('getOwner')->willReturn($owner);
+		$originalFile->method('getParentId')->willReturn(101);
+
+		$libreSignFile = new File();
+		$libreSignFile->setId(61);
+		$service->setLibreSignFile($libreSignFile);
+
+		$createdFile = $this->createMock(\OCP\Files\File::class);
+		$parentFolder = $this->createMock(\OCP\Files\Folder::class);
+		$parentFolder->expects($this->once())
+			->method('newFile')
+			->with('Document.signed_61.pdf', 'signed-content')
+			->willReturn($createdFile);
+
+		$userFolder = $this->createMock(\OCP\Files\Folder::class);
+		$userFolder->expects($this->once())
+			->method('getFirstNodeById')
+			->with(101)
+			->willReturn($parentFolder);
+
+		$this->root->expects($this->once())
+			->method('getUserFolder')
+			->with('admin')
+			->willReturn($userFolder);
+
+		$this->userSession->expects($this->once())
+			->method('getUser')
+			->willReturn($currentUser);
+		$this->userSession->expects($this->exactly(2))
+			->method('setVolatileActiveUser')
+			->with($this->callback(static function ($user) use ($owner, $currentUser): bool {
+				static $calls = 0;
+				$calls++;
+
+				return match ($calls) {
+					1 => $user === $owner,
+					2 => $user === $currentUser,
+					default => false,
+				};
+			}));
+
+		$result = self::invokePrivate($service, 'createSignedFile', [$originalFile, 'signed-content']);
+
+		$this->assertSame($createdFile, $result);
+	}
+
+	public function testSignSequentiallyRunsEngineSignAsOwnerAndRestoresSession(): void {
+		$service = $this->getService([
+			'validateDocMdpAllowsSignatures',
+			'getEngine',
+			'computeHash',
+			'updateSignRequest',
+			'updateLibreSignFile',
+			'dispatchSignedEvent',
+		]);
+
+		$currentUser = $this->createMock(\OCP\IUser::class);
+		$currentUser->method('getUID')->willReturn('signer1');
+
+		$owner = $this->createMock(\OCP\IUser::class);
+		$owner->method('getUID')->willReturn('admin');
+
+		$fileToSign = $this->createMock(\OCP\Files\File::class);
+		$fileToSign->method('getOwner')->willReturn($owner);
+
+		$signedFile = $this->createMock(\OCP\Files\File::class);
+		$signedFile->method('getId')->willReturn(77);
+
+		$engine = $this->createMock(SignEngineHandler::class);
+		$engine->expects($this->once())
+			->method('sign')
+			->willReturn($signedFile);
+		$engine->expects($this->once())
+			->method('getLastSignedDate')
+			->willReturn(new DateTime('2026-04-02T03:11:54+00:00'));
+
+		$libreSignFile = new File();
+		$libreSignFile->setId(61);
+		$libreSignFile->setStatus(FileStatus::ABLE_TO_SIGN->value);
+
+		$signRequest = new SignRequest();
+		$signRequest->setId(62);
+
+		$service->setLibreSignFile($libreSignFile);
+		$service->setSignRequest($signRequest);
+
+		$service->expects($this->once())
+			->method('validateDocMdpAllowsSignatures');
+		$service->expects($this->exactly(2))
+			->method('getEngine')
+			->willReturnCallback(function () use ($service, $fileToSign, $engine) {
+				$fileToSignProperty = new \ReflectionProperty(SignFileService::class, 'fileToSign');
+				$fileToSignProperty->setValue($service, $fileToSign);
+				return $engine;
+			});
+		$service->expects($this->once())
+			->method('computeHash')
+			->with($signedFile)
+			->willReturn('hash');
+		$service->expects($this->once())
+			->method('updateSignRequest')
+			->with('hash');
+		$service->expects($this->once())
+			->method('updateLibreSignFile')
+			->with($libreSignFile, 77, 'hash');
+		$service->expects($this->once())
+			->method('dispatchSignedEvent');
+
+		$this->userSession->expects($this->once())
+			->method('getUser')
+			->willReturn($currentUser);
+		$this->userSession->expects($this->exactly(2))
+			->method('setVolatileActiveUser')
+			->with($this->callback(static function ($user) use ($owner, $currentUser): bool {
+				static $calls = 0;
+				$calls++;
+
+				return match ($calls) {
+					1 => $user === $owner,
+					2 => $user === $currentUser,
+					default => false,
+				};
+			}));
+
+		$result = self::invokePrivate($service, 'signSequentially', [[[
+			'file' => $libreSignFile,
+			'signRequest' => $signRequest,
+		]]]);
+
+		$this->assertInstanceOf(DateTime::class, $result);
+	}
+
 	#[DataProvider('cleanupUnsignedSignedFileProvider')]
 	public function testCleanupUnsignedSignedFile(bool $hasFile, ?\Exception $deleteException): void {
 		$service = $this->getService();
diff --git a/tests/php/Unit/Settings/AdminTest.php b/tests/php/Unit/Settings/AdminTest.php
index cb2ba6a64e..36b03408f2 100644
--- a/tests/php/Unit/Settings/AdminTest.php
+++ b/tests/php/Unit/Settings/AdminTest.php
@@ -10,15 +10,18 @@
 
 use OCA\Libresign\AppInfo\Application;
 use OCA\Libresign\Handler\CertificateEngine\CertificateEngineFactory;
+use OCA\Libresign\Service\AccountService;
 use OCA\Libresign\Service\CertificatePolicyService;
 use OCA\Libresign\Service\DocMdp\ConfigService as DocMdpConfigService;
 use OCA\Libresign\Service\FooterService;
 use OCA\Libresign\Service\IdentifyMethodService;
+use OCA\Libresign\Service\Policy\PolicyService;
 use OCA\Libresign\Service\SignatureBackgroundService;
 use OCA\Libresign\Service\SignatureTextService;
 use OCA\Libresign\Settings\Admin;
 use OCP\AppFramework\Services\IInitialState;
 use OCP\IAppConfig;
+use OCP\IUserSession;
 use PHPUnit\Framework\MockObject\MockObject;
 
 /**
@@ -27,6 +30,8 @@
 final class AdminTest extends \OCA\Libresign\Tests\Unit\TestCase {
 	private Admin $admin;
 	private IInitialState&MockObject $initialState;
+	private AccountService&MockObject $accountService;
+	private IUserSession&MockObject $userSession;
 	private IdentifyMethodService&MockObject $identifyMethodService;
 	private CertificateEngineFactory&MockObject $certificateEngineFactory;
 	private CertificatePolicyService&MockObject $certificatePolicyService;
@@ -35,8 +40,11 @@ final class AdminTest extends \OCA\Libresign\Tests\Unit\TestCase {
 	private SignatureBackgroundService&MockObject $signatureBackgroundService;
 	private FooterService&MockObject $footerService;
 	private DocMdpConfigService&MockObject $docMdpConfigService;
+	private PolicyService&MockObject $policyService;
 	public function setUp(): void {
 		$this->initialState = $this->createMock(IInitialState::class);
+		$this->accountService = $this->createMock(AccountService::class);
+		$this->userSession = $this->createMock(IUserSession::class);
 		$this->identifyMethodService = $this->createMock(IdentifyMethodService::class);
 		$this->certificateEngineFactory = $this->createMock(CertificateEngineFactory::class);
 		$this->certificatePolicyService = $this->createMock(CertificatePolicyService::class);
@@ -45,8 +53,11 @@ public function setUp(): void {
 		$this->signatureBackgroundService = $this->createMock(SignatureBackgroundService::class);
 		$this->footerService = $this->createMock(FooterService::class);
 		$this->docMdpConfigService = $this->createMock(DocMdpConfigService::class);
+		$this->policyService = $this->createMock(PolicyService::class);
 		$this->admin = new Admin(
 			$this->initialState,
+			$this->accountService,
+			$this->userSession,
 			$this->identifyMethodService,
 			$this->certificateEngineFactory,
 			$this->certificatePolicyService,
@@ -55,6 +66,7 @@ public function setUp(): void {
 			$this->signatureBackgroundService,
 			$this->footerService,
 			$this->docMdpConfigService,
+			$this->policyService,
 		);
 	}