Advanced Policies

Use advanced rules when simple spend limits, time windows, and counterparty controls are not enough. Most teams should start with Policy Overview, then add only the controls their agent actually needs.

Rule shape

{
  "ruleType": "MAX_AMOUNT",
  "operator": "LTE",
  "value": "500",
  "action": "ALLOW"
}

Field	Purpose
`ruleType`	What the rule evaluates
`operator`	How the request value is compared
`value`	String value, or JSON encoded object/array
`action`	`ALLOW`, `DENY`, or `REQUIRE_APPROVAL`

Operators

Operator	Meaning
`EQUALS`, `NOT_EQUALS`	Exact match or mismatch
`GREATER_THAN`, `GTE`, `LESS_THAN`, `LTE`	Numeric comparison
`IN`, `IN_LIST`, `NOT_IN`, `NOT_IN_LIST`	List membership
`BETWEEN`, `NOT_BETWEEN`	Range comparison

Supported Rule Types

Category	Rule types
Amount limits	`MAX_AMOUNT`, `DAILY_LIMIT`, `WEEKLY_LIMIT`, `MONTHLY_LIMIT`, `BUDGET_CAP`
Approval	`REQUIRE_APPROVAL_ABOVE`
Time	`TIME_WINDOW`, `DAY_OF_WEEK`, `DATE_RANGE`, `BLACKOUT_PERIOD`
Category	`ALLOWED_CATEGORIES`, `BLOCKED_CATEGORIES`
Counterparty	`ALLOWED_COUNTERPARTIES`, `BLOCKED_COUNTERPARTIES`, `TRUST_SCORE`, `COUNTERPARTY_STATUS`
Contract controls	`CONTRACT_ALLOWLIST`
Velocity	`VELOCITY_LIMIT`
Geographic	`GEOGRAPHIC_RESTRICTION`
x402	`X402_MAX_PER_REQUEST`, `X402_PRICE_CEILING`, `X402_ALLOWED_SERVICES`, `X402_MAX_PER_SERVICE`
MPP	`MPP_MAX_PER_REQUEST`, `MPP_MAX_SESSION_DEPOSIT`, `MPP_SESSION_BUDGET`, `MPP_MAX_CONCURRENT_SESSIONS`

Rule Patterns

Require review above a threshold

{
  "name": "Approval Over 500",
  "policyType": "APPROVAL_THRESHOLD",
  "rules": [
    {
      "ruleType": "REQUIRE_APPROVAL_ABOVE",
      "operator": "GREATER_THAN",
      "value": "500",
      "action": "REQUIRE_APPROVAL"
    }
  ]
}

A policy decision that requires approval always creates a request in Alerts & Approvals. If no custom workflow matches, one review from an organization Owner, Admin, or Manager is required. A final approval automatically submits the payment for Conto-managed wallets and links the chain receipt from the approval review. External and smart-contract wallets retain their manual execution requirements.

Request a scoped policy change

An agent with an admin SDK key can request a specific policy change without editing the policy directly. Use POST /api/sdk/policies/exceptions with the policies:exceptions scope, then use GET /api/sdk/policies/exceptions to track it.

curl -X POST https://conto.finance/api/sdk/policies/exceptions \
  -H "Authorization: Bearer $CONTO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "type": "spend_limit",
    "reason": "The annual vendor renewal is due this week.",
    "priority": "high",
    "details": {
      "policyId": "policy_123",
      "requestedLimit": 750,
      "amount": 600
    }
  }'

The response preserves the original exceptionId, uppercase type, and uppercase status fields for existing integrations. It also includes id, normalizedType, normalizedStatus, and statusLabel for applications that want stable customer-facing values:

{
  "id": "exception_123",
  "exceptionId": "exception_123",
  "type": "INCREASE_SPEND_LIMIT",
  "normalizedType": "spend_limit",
  "title": "Spending limit request",
  "reason": "The annual vendor renewal is due this week.",
  "priority": "high",
  "severity": "HIGH",
  "status": "PENDING",
  "normalizedStatus": "pending",
  "statusLabel": "Pending review",
  "reviewUrl": "/alerts"
}

normalizedStatus is one of pending, in_review, resolved, or dismissed. List responses include the same items under both exceptions and the additive requests alias. Customer-supplied reason, priority, and validated details are returned. title and severity are stable values derived from the request type and priority; operational alert copy and metadata are not part of this API. Creating a request does not change a policy by itself; review it in Alerts & Approvals.

Limit transaction velocity

{
  "name": "Hourly Velocity Limit",
  "policyType": "VELOCITY",
  "rules": [
    {
      "ruleType": "VELOCITY_LIMIT",
      "operator": "LTE",
      "value": "{\"maxCount\": 10, \"period\": \"HOUR\"}",
      "action": "ALLOW"
    }
  ]
}

Restrict by category

{
  "name": "Approved Categories",
  "policyType": "CATEGORY",
  "rules": [
    {
      "ruleType": "ALLOWED_CATEGORIES",
      "operator": "IN_LIST",
      "value": "[\"infrastructure\", \"ai_services\", \"marketing\"]",
      "action": "ALLOW"
    }
  ]
}

Geographic Restrictions OFAC

Use GEOGRAPHIC_RESTRICTION with ISO country codes when a policy needs explicit country gates. Sanctions screening can still block high-risk recipients even when no geographic rule is attached.

{
  "ruleType": "GEOGRAPHIC_RESTRICTION",
  "operator": "IN_LIST",
  "value": "[\"CU\", \"IR\", \"KP\", \"SY\", \"RU\"]",
  "action": "DENY"
}

Contract Allowlist

{
  "name": "Approved Protocols",
  "policyType": "CONTRACT_ALLOWLIST",
  "rules": [
    {
      "ruleType": "CONTRACT_ALLOWLIST",
      "operator": "IN_LIST",
      "value": "{\"protocols\": [\"uniswap\", \"aave\"], \"categories\": [\"DEX\", \"LENDING\"]}",
      "action": "ALLOW"
    }
  ]
}

For contract controls, include targetContractAddress in the payment request so Conto can evaluate the rule against the intended contract interaction. If a rule uses protocol names or categories, register the organization’s known contract classifications through the authenticated contract registry:

GET /api/contract-registry lists entries and supports category, limit, and offset
POST /api/contract-registry saves an address with optional chainId, label, protocolName, and protocolCategory
GET, PATCH, or DELETE /api/contract-registry/{address} reads, updates, or removes one entry

The address is the stable entry identifier. Registry responses return the customer-managed classification fields for that address. Registry changes require policy write permission and are recorded in the organization’s audit history.

x402 Protocol Rules

{
  "name": "x402 API Guardrails",
  "policyType": "COMPOSITE",
  "rules": [
    {
      "ruleType": "X402_MAX_PER_REQUEST",
      "operator": "LTE",
      "value": "0.10",
      "action": "ALLOW"
    },
    {
      "ruleType": "X402_ALLOWED_SERVICES",
      "operator": "IN_LIST",
      "value": "[\"api.example.com\", \"data.provider.io\"]",
      "action": "ALLOW"
    }
  ]
}

MPP Protocol Rules

{
  "name": "MPP Session Guardrails",
  "policyType": "COMPOSITE",
  "rules": [
    {
      "ruleType": "MPP_MAX_SESSION_DEPOSIT",
      "operator": "LTE",
      "value": "25",
      "action": "ALLOW"
    },
    {
      "ruleType": "MPP_MAX_CONCURRENT_SESSIONS",
      "operator": "LTE",
      "value": "3",
      "action": "ALLOW"
    }
  ]
}

Budget Allocations

Use BUDGET_CAP when a wallet or agent needs a bounded allowance for a period, project, or category.

{
  "ruleType": "BUDGET_CAP",
  "operator": "LTE",
  "value": "{\"amount\": 2500, \"period\": \"MONTHLY\", \"category\": \"infrastructure\"}",
  "action": "ALLOW"
}

Expiration Policies

Use DATE_RANGE for temporary permissions and BLACKOUT_PERIOD for known no-spend windows.

{
  "ruleType": "DATE_RANGE",
  "operator": "BETWEEN",
  "value": "{\"start\": \"2026-07-01\", \"end\": \"2026-07-31\"}",
  "action": "ALLOW"
}

Built-in screening

Conto can combine configurable policies with sanctions and trust checks. Use Trust Scoring for counterparty-aware controls and Trust & Risk Providers for provider setup.

Spend limits

Common amount and budget controls

Time windows

Business hours and blackout windows

Counterparties

Recipient allowlists, blocklists, and trust rules

Recipes

Copy-paste policy setup snippets

Start

Products

Build

Guides

Reference

Changelog

Advanced Policies

Advanced Policies

Rule shape

Operators

Supported Rule Types

Rule Patterns

Require review above a threshold

Request a scoped policy change

Limit transaction velocity

Restrict by category

Geographic Restrictions OFAC

Contract Allowlist

x402 Protocol Rules

MPP Protocol Rules

Budget Allocations

Expiration Policies

Built-in screening

Spend limits

Time windows

Counterparties

Recipes

​Advanced Policies

​Rule shape

​Operators

​Supported Rule Types

​Rule Patterns

​Require review above a threshold

​Request a scoped policy change

​Limit transaction velocity

​Restrict by category

​Geographic Restrictions OFAC

​Contract Allowlist

​x402 Protocol Rules

​MPP Protocol Rules

​Budget Allocations

​Expiration Policies

​Built-in screening

​Related

Spend limits

Time windows

Counterparties

Recipes

Advanced Policies

Rule shape

Operators

Supported Rule Types

Rule Patterns

Require review above a threshold

Request a scoped policy change

Limit transaction velocity

Restrict by category

Geographic Restrictions OFAC

Contract Allowlist

x402 Protocol Rules

MPP Protocol Rules

Budget Allocations

Expiration Policies

Built-in screening

Related