Policy schema

Policies decide whether an agent can spend. AllowKit evaluates every paid request against the active policy before payment is made, checking max per payment, daily/weekly caps, approved-service allowlist, approval threshold, pause state, and velocity rules. Every policy change creates a new revision so any past decision can be audited or rolled back.

policy.json

{
  "agentId": "researchbot-01",
  "dailyLimit": "5.00",
  "weeklyLimit": "25.00",
  "maxPerPayment": "0.25",
  "asset": "USDC",
  "approvedServices": [
    "risk-report-api",
    "market-data-mcp",
    "wallet-labels"
  ],
  "approvalRequiredAbove": "1.00",
  "blockUnknownRecipients": true,
  "alerts": ["telegram", "discord"]
}

Fields

Field	Type	Description
dailyLimit	string	Max asset amount spendable per rolling 24h.
weeklyLimit	string	Max asset amount spendable per rolling 7d.
maxPerPayment	string	Hard cap on a single payment.
asset	string	Settlement asset — USDC/SOL first, with USDT, PYUSD, and EURC planned.
approvedServices	string[]	Whitelist of service ids the agent may pay.
approvalRequiredAbove	string	Payments above this pause for human approval.
blockUnknownRecipients	boolean	Auto-block any service not on the list.
alerts	string[]	Where to notify: telegram | slack | discord | email.

Dry-run a policy decision without moving funds via POST /v1/policies/check.