> ## Documentation Index
> Fetch the complete documentation index at: https://docs.base.org/llms.txt
> Use this file to discover all available pages before exploring further.

# IPolicyRegistry.updateAllowlist

> Sets membership of a batch of accounts in an ALLOWLIST policy.

## Signature

```solidity IPolicyRegistry.sol theme={null}
function updateAllowlist(uint64 policyId, bool allowed, address[] calldata accounts) external;
```

| Field               | Value                                    |
| ------------------- | ---------------------------------------- |
| Selector            | `0x3388fb5b`                             |
| Canonical signature | `updateAllowlist(uint64,bool,address[])` |

## Description

Sets each address in `accounts` to `allowed` (add or remove) in an `ALLOWLIST` policy. The change takes effect on the next `isAuthorized` call against this policy. Every token and composite that references `policyId` sees the updated membership immediately, no second write on the token is needed.

Membership batches are capped by the registry, currently at 64 accounts. A larger batch reverts `BatchSizeTooLarge(maxBatchSize)`, which carries the limit.

## Parameters

| Name       | Type        | Description                                                |
| ---------- | ----------- | ---------------------------------------------------------- |
| `policyId` | `uint64`    | The allowlist policy to update.                            |
| `allowed`  | `bool`      | `true` to add accounts to the set; `false` to remove them. |
| `accounts` | `address[]` | Accounts to update. Maximum 64 per call.                   |

## Reverts

| Error                             | Condition                                    |
| --------------------------------- | -------------------------------------------- |
| `Unauthorized()`                  | Caller is not the current policy admin.      |
| `PolicyNotFound()`                | `policyId` does not exist in the registry.   |
| `IncompatiblePolicyType()`        | The policy exists but is not an `ALLOWLIST`. |
| `BatchSizeTooLarge(maxBatchSize)` | `accounts.length` exceeds 64.                |

## Events

Emits `AllowlistUpdated(policyId, updater, allowed, accounts)` on success.

## Access Control

Callable only by the current admin of `policyId`. Any other caller reverts `Unauthorized`.

## Example

```solidity Add accounts to an allowlist theme={null}
address[] memory accounts = new address[](2);
accounts[0] = alice;
accounts[1] = bob;
IPolicyRegistry(registry).updateAllowlist(kycId, true, accounts);
```

After this call, `isAuthorized(kycId, alice)` and `isAuthorized(kycId, bob)` return `true`. Any token or composite policy already pointing at `kycId` reflects this without a separate `updatePolicy` call on the token.

To remove an account, pass `false`:

```solidity Remove an account from an allowlist theme={null}
address[] memory removed = new address[](1);
removed[0] = alice;
IPolicyRegistry(registry).updateAllowlist(kycId, false, removed);
```

<Note>
  Only the current admin of a policy can call `updateAllowlist`. If you need a different party to manage membership, use `stageUpdateAdmin` and `finalizeUpdateAdmin` to transfer administration first.
</Note>