> ## Documentation Index
> Fetch the complete documentation index at: https://conto.finance/docs/llms.txt
> Use this file to discover all available pages before exploring further.
# Advanced Policies
> Reference for advanced Conto policy rules, operators, and common rule patterns.
# Advanced Policies
Use advanced rules when simple spend limits, time windows, and counterparty controls are not enough.
Most teams should start with [Policy Overview](/docs/policies/overview), then add only the controls their
agent actually needs.
## Rule shape
```json theme={null}
{
"ruleType": "MAX_AMOUNT",
"operator": "LTE",
"value": "500",
"action": "ALLOW"
}
```
| Field | Purpose |
| ---------- | ------------------------------------------ |
| `ruleType` | What the rule evaluates |
| `operator` | How the request value is compared |
| `value` | String value, or JSON encoded object/array |
| `action` | `ALLOW`, `DENY`, or `REQUIRE_APPROVAL` |
## Operators
| Operator | Meaning |
| ----------------------------------------- | ----------------------- |
| `EQUALS`, `NOT_EQUALS` | Exact match or mismatch |
| `GREATER_THAN`, `GTE`, `LESS_THAN`, `LTE` | Numeric comparison |
| `IN`, `IN_LIST`, `NOT_IN`, `NOT_IN_LIST` | List membership |
| `BETWEEN`, `NOT_BETWEEN` | Range comparison |
## Supported Rule Types
| Category | Rule types |
| ----------------- | ----------------------------------------------------------------------------------------------------- |
| Amount limits | `MAX_AMOUNT`, `DAILY_LIMIT`, `WEEKLY_LIMIT`, `MONTHLY_LIMIT`, `BUDGET_CAP` |
| Approval | `REQUIRE_APPROVAL_ABOVE` |
| Time | `TIME_WINDOW`, `DAY_OF_WEEK`, `DATE_RANGE`, `BLACKOUT_PERIOD` |
| Category | `ALLOWED_CATEGORIES`, `BLOCKED_CATEGORIES` |
| Counterparty | `ALLOWED_COUNTERPARTIES`, `BLOCKED_COUNTERPARTIES`, `TRUST_SCORE`, `COUNTERPARTY_STATUS` |
| Contract controls | `CONTRACT_ALLOWLIST` |
| Velocity | `VELOCITY_LIMIT` |
| Geographic | `GEOGRAPHIC_RESTRICTION` |
| x402 | `X402_MAX_PER_REQUEST`, `X402_PRICE_CEILING`, `X402_ALLOWED_SERVICES`, `X402_MAX_PER_SERVICE` |
| MPP | `MPP_MAX_PER_REQUEST`, `MPP_MAX_SESSION_DEPOSIT`, `MPP_SESSION_BUDGET`, `MPP_MAX_CONCURRENT_SESSIONS` |
## Rule Patterns
### Require review above a threshold
```json theme={null}
{
"name": "Approval Over 500",
"policyType": "APPROVAL_THRESHOLD",
"rules": [
{
"ruleType": "REQUIRE_APPROVAL_ABOVE",
"operator": "GREATER_THAN",
"value": "500",
"action": "REQUIRE_APPROVAL"
}
]
}
```
A policy decision that requires approval always creates a request in **Alerts & Approvals**. If no
custom workflow matches, one review from an organization Owner, Admin, or Manager is required. A
final approval automatically submits the payment for Conto-managed wallets and links the chain
receipt from the approval review. External and smart-contract wallets retain their manual
execution requirements.
### Request a scoped policy change
An agent with an admin SDK key can request a specific policy change without editing the policy
directly. Use `POST /api/sdk/policies/exceptions` with the `policies:exceptions` scope, then use
`GET /api/sdk/policies/exceptions` to track it.
```bash theme={null}
curl -X POST https://conto.finance/api/sdk/policies/exceptions \
-H "Authorization: Bearer $CONTO_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"type": "spend_limit",
"reason": "The annual vendor renewal is due this week.",
"priority": "high",
"details": {
"policyId": "policy_123",
"requestedLimit": 750,
"amount": 600
}
}'
```
The response preserves the original `exceptionId`, uppercase `type`, and uppercase `status` fields
for existing integrations. It also includes `id`, `normalizedType`, `normalizedStatus`, and
`statusLabel` for applications that want stable customer-facing values:
```json theme={null}
{
"id": "exception_123",
"exceptionId": "exception_123",
"type": "INCREASE_SPEND_LIMIT",
"normalizedType": "spend_limit",
"title": "Spending limit request",
"reason": "The annual vendor renewal is due this week.",
"priority": "high",
"severity": "HIGH",
"status": "PENDING",
"normalizedStatus": "pending",
"statusLabel": "Pending review",
"reviewUrl": "/alerts"
}
```
`normalizedStatus` is one of `pending`, `in_review`, `resolved`, or `dismissed`. List responses
include the same items under both `exceptions` and the additive `requests` alias. Customer-supplied
reason, priority, and validated details are returned. `title` and `severity` are stable values
derived from the request type and priority; operational alert copy and metadata are not part of this
API. Creating a request does not change a policy by itself; review it in **Alerts & Approvals**.
### Limit transaction velocity
```json theme={null}
{
"name": "Hourly Velocity Limit",
"policyType": "VELOCITY",
"rules": [
{
"ruleType": "VELOCITY_LIMIT",
"operator": "LTE",
"value": "{\"maxCount\": 10, \"period\": \"HOUR\"}",
"action": "ALLOW"
}
]
}
```
### Restrict by category
```json theme={null}
{
"name": "Approved Categories",
"policyType": "CATEGORY",
"rules": [
{
"ruleType": "ALLOWED_CATEGORIES",
"operator": "IN_LIST",
"value": "[\"infrastructure\", \"ai_services\", \"marketing\"]",
"action": "ALLOW"
}
]
}
```
### Geographic Restrictions OFAC
Use `GEOGRAPHIC_RESTRICTION` with ISO country codes when a policy needs explicit country gates.
Sanctions screening can still block high-risk recipients even when no geographic rule is attached.
```json theme={null}
{
"ruleType": "GEOGRAPHIC_RESTRICTION",
"operator": "IN_LIST",
"value": "[\"CU\", \"IR\", \"KP\", \"SY\", \"RU\"]",
"action": "DENY"
}
```
### Contract Allowlist
```json theme={null}
{
"name": "Approved Protocols",
"policyType": "CONTRACT_ALLOWLIST",
"rules": [
{
"ruleType": "CONTRACT_ALLOWLIST",
"operator": "IN_LIST",
"value": "{\"protocols\": [\"uniswap\", \"aave\"], \"categories\": [\"DEX\", \"LENDING\"]}",
"action": "ALLOW"
}
]
}
```
For contract controls, include `targetContractAddress` in the payment request so Conto can evaluate
the rule against the intended contract interaction.
If a rule uses protocol names or categories, register the organization's known contract
classifications through the authenticated contract registry:
* `GET /api/contract-registry` lists entries and supports `category`, `limit`, and `offset`
* `POST /api/contract-registry` saves an address with optional `chainId`, `label`, `protocolName`,
and `protocolCategory`
* `GET`, `PATCH`, or `DELETE /api/contract-registry/{address}` reads, updates, or removes one entry
The address is the stable entry identifier. Registry responses return the customer-managed
classification fields for that address. Registry changes require policy write permission and are
recorded in the organization's audit history.
### x402 Protocol Rules
```json theme={null}
{
"name": "x402 API Guardrails",
"policyType": "COMPOSITE",
"rules": [
{
"ruleType": "X402_MAX_PER_REQUEST",
"operator": "LTE",
"value": "0.10",
"action": "ALLOW"
},
{
"ruleType": "X402_ALLOWED_SERVICES",
"operator": "IN_LIST",
"value": "[\"api.example.com\", \"data.provider.io\"]",
"action": "ALLOW"
}
]
}
```
### MPP Protocol Rules
```json theme={null}
{
"name": "MPP Session Guardrails",
"policyType": "COMPOSITE",
"rules": [
{
"ruleType": "MPP_MAX_SESSION_DEPOSIT",
"operator": "LTE",
"value": "25",
"action": "ALLOW"
},
{
"ruleType": "MPP_MAX_CONCURRENT_SESSIONS",
"operator": "LTE",
"value": "3",
"action": "ALLOW"
}
]
}
```
### Budget Allocations
Use `BUDGET_CAP` when a wallet or agent needs a bounded allowance for a period, project, or
category.
```json theme={null}
{
"ruleType": "BUDGET_CAP",
"operator": "LTE",
"value": "{\"amount\": 2500, \"period\": \"MONTHLY\", \"category\": \"infrastructure\"}",
"action": "ALLOW"
}
```
### Expiration Policies
Use `DATE_RANGE` for temporary permissions and `BLACKOUT_PERIOD` for known no-spend windows.
```json theme={null}
{
"ruleType": "DATE_RANGE",
"operator": "BETWEEN",
"value": "{\"start\": \"2026-07-01\", \"end\": \"2026-07-31\"}",
"action": "ALLOW"
}
```
## Built-in screening
Conto can combine configurable policies with sanctions and trust checks. Use
[Trust Scoring](/docs/guides/trust-scoring) for counterparty-aware controls and
[Trust & Risk Providers](/docs/integrations/trust-providers) for provider setup.
## Related
Common amount and budget controls
Business hours and blackout windows
Recipient allowlists, blocklists, and trust rules
Copy-paste policy setup snippets