Skip to main content
A policy grants a specific agent a specific financial capability. It is not a general permission to use a wallet.

​
A bounded capability can include

  • agent and funding-source identity;
  • purpose or capability category;
  • provider, recipient, protocol, venue, asset, and network allowlists;
  • per-call and cumulative debit ceilings;
  • network-fee and non-principal-asset ceilings;
  • session, daily, or recurring windows;
  • reusable-scope limits and revocation version;
  • approval thresholds;
  • route and expiry requirements.

​
Decisions

​
Allow

The exact request is inside an active pre-authorized capability and budget. An allow decision is not portable to a changed recipient, amount, route, or expiry.

​
Ask

The request is potentially valid but requires independent approval—for example, because the provider is new, the value exceeds an automatic threshold, or the action is consequential.

​
Deny

The request is outside policy, malformed, stale, unsupported, over budget, or cannot be verified. The model cannot override the decision.

​
Budget accounting

Principal, network fees, and other asset debits should remain separate accounting entries. Reservation and final execution authority must update the applicable budget atomically so concurrent agents cannot overspend a shared limit. Unknown issuance or submission outcomes require reconciliation. They must never be treated as permission to issue, sign, or submit again blindly.