Spending policies and budgets

A policy is a short text document attached to your workspace. The gateway evaluates it on the server, before the payment is taken, for every purchase by every wallet in the workspace. An agent can't skip it, and a model can't talk its way past it.

#The language

deny:
  category == "Adult"
  provider.reputation < 0.3
approval:
  price > 5
allow:
  provider.verified == true
  currency == "USD"

There are three kinds of section, and each line is field comparison value:

#Fields

Comparisons: == != < <= > >=. Put strings in quotes. # starts a comment. A line that refers to a field the purchase doesn't have never matches.

#Evaluation order

1. Deny rules. The first matching line refuses the purchase.
2. The workspace daily budget. If this purchase would take today's spending over the budget, it's refused.
3. Approval rules. The first matching line holds the purchase, unless a person has already approved this exact spend. See Approvals.
4. Allow rules. If any exist, at least one must match completely.
5. Otherwise the purchase is allowed.

#Adding a policy

In the console: Buyer → Policies → Add a rule, choose the section, and type one rule per line.

With the API:

curl -s -X POST https://api.zanora.dev/v1/policies -H "x-api-key: $WKEY" \
  -H 'content-type: application/json' \
  -d '{"document":"approval:\n  price > 5\ndeny:\n  provider.verified == false"}'

The response lists the parsed policies, each with its own id. A document with several sections becomes several policies.

Policies can't be edited. To change one, add the corrected version and then disable the old one. That keeps a record of which rules applied to which purchases.

#Daily budget

The workspace's dailyBudgetMinor, set at signup, caps total spending across all its wallets per UTC day. When a purchase would exceed it, the purchase is refused with POLICY_DENIED and matchedRule: "workspace.dailyBudget".

#Recipes

approval:
  price > 5

allow:
  provider.verified == true
  provider.reputation >= 0.6

deny:
  agentId == "experiments"
  price > 0.25

allow:
  provider.id == "prv_3652ec9e…"