Skip to main content

​
Auto-Freeze

Conto can automatically freeze agents when suspicious behavior is detected. When an agent is frozen, all its transactions are blocked until a human reviews and unfreezes it.

​
How It Works

After every transaction or policy evaluation, Conto checks the agent’s behavior against configurable thresholds. If a threshold is exceeded:
  • Auto-freeze enabled: The agent is immediately suspended, its wallets are frozen, and a CRITICAL alert is created.
  • Auto-freeze disabled (default): An alert is created for visibility, but the agent continues operating.

​
Trigger Types

TriggerWhat it detectsDefault threshold
CONSECUTIVE_VIOLATIONSRepeated policy denials5 consecutive violations
CONSECUTIVE_FAILURESRepeated transaction failures5 consecutive failures
SPEND_VELOCITYHourly spend rate vs. 30-day average3x the average
LARGE_TRANSACTION_ANOMALYSingle transaction much larger than average10x the average
TRUST_SCORE_BELOW_THRESHOLDAverage counterparty trust too lowBelow 0.2
TRUST_SCORE_DROPTrust score dropped significantly in 24h30% drop
RAPID_COUNTERPARTY_SWITCHINGToo many unique recipients in one hour10 unique recipients/hour
MANUALAdmin manually froze the agentN/A

​
Trigger Details

Spend Velocity compares the agent’s spend in the last hour against its average hourly spend over 30 days. Requires at least 5 historical transactions to activate. Large Transaction Anomaly compares the most recent transaction amount to the historical average. Requires at least 10 historical transactions. Rapid Counterparty Switching counts distinct toAddress values in the last hour. A sudden spike in new recipients can indicate compromised credentials.

​
Configuration

Configure thresholds per agent in the dashboard under Agents > [Agent] > Freeze Settings, or via the Admin SDK: 
// Via Admin SDK
await admin.agents.update(agentId, {
  autoFreezeEnabled: true,
  freezeConfig: {
    maxConsecutiveViolations: 3,
    maxConsecutiveFailures: 3,
    spendVelocityMultiplier: 2,
    largeTxMultiplier: 5,
    minTrustScore: 0.3,
    trustScoreDropThreshold: 0.2,
    maxNewCounterpartiesPerHour: 5,
  }
});

​
Configuration Fields

FieldTypeDefaultDescription
maxConsecutiveViolationsnumber5Freeze after N consecutive policy violations
maxConsecutiveFailuresnumber5Freeze after N consecutive transaction failures
spendVelocityMultipliernumber3Freeze when hourly spend exceeds Nx the 30-day average
largeTxMultipliernumber10Freeze when a single tx exceeds Nx the historical average
minTrustScorenumber0.2Freeze when average counterparty trust drops below this
trustScoreDropThresholdnumber0.3Freeze on a 30%+ trust score drop in 24h
maxNewCounterpartiesPerHournumber10Freeze when unique recipients per hour exceeds this

​
Freezing and Unfreezing

​
Manual Freeze

curl -X POST https://conto.finance/api/agents/AGENT_ID/freeze \
  -H "Authorization: Bearer $CONTO_ORG_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "reason": "Investigating unusual spending pattern",
    "freezeWallets": true
  }'

​
Manual Unfreeze

curl -X POST https://conto.finance/api/agents/AGENT_ID/unfreeze \
  -H "Authorization: Bearer $CONTO_ORG_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "reason": "Investigation complete, no issues found",
    "unfreezeWallets": true,
    "resetCounters": true
  }'
Setting resetCounters: true (the default) resets the consecutive violation and failure counters so the agent doesn’t immediately re-trigger after unfreezing.

​
What Happens When an Agent Is Frozen

  1. Agent status changes to SUSPENDED
  2. All linked wallets are optionally frozen (freezeWallets: true)
  3. A CRITICAL severity alert is created
  4. A freeze event is recorded in the audit log
  5. Webhooks fire (agent.frozen)
  6. All subsequent payment requests return a denial

​
Freeze History

View freeze events in the dashboard under Agents > [Agent] > Freeze History, or via the API: 
curl https://conto.finance/api/freeze-events?agentId=AGENT_ID \
  -H "Authorization: Bearer $CONTO_ORG_KEY"
Each freeze event records:
  • Trigger type and trigger data
  • Who initiated it (user or system)
  • Whether wallets were frozen
  • Resolution timestamp and notes (after unfreezing)