AgentPolicyEnvelope (v1)

14-axis policy envelope evaluated by @glideco/policy-engine on every agent tool call.

The policy envelope is the multisig-governed permission boundary every agent operates inside. Issued at install time, attached to every grant JWT, evaluated server-side on every tool invocation.

Canonical URL

https://glide.co/schemas/agent-banking/v1/agent-policy-envelope.json

14 axes

These are the field names evaluated by @glideco/policy-engine. The runtime source controls enforcement; some descriptions in the published schema still reflect older assumptions.

Axis	Input required	Empty-array semantic
chain_allowlist	request.counterparty.chain	deny when counterparty is present
amount_cap_cents_per_tx	request.amount_cents	n/a (number)
amount_cap_cents_per_day	velocity_context.amount_cents_spent_today	n/a (number)
amount_cap_cents_lifetime	velocity_context.amount_cents_spent_lifetime	n/a (number)
step_up_amount_cents	request.amount_cents	n/a (soft trigger)
counterparty_allowlist	request.counterparty	open (any counterparty allowed)
mcc_blocklist	request.mcc	no-op
mcc_allowlist	request.mcc	open (any MCC allowed)
geo_allowlist	request.geo	open (any geo allowed)
time_window_start	request.requested_at_unix	n/a (optional)
time_window_end	request.requested_at_unix	n/a (optional)
velocity_max_txs_per_hour	velocity_context.txs_in_last_hour	n/a (number)
velocity_max_txs_per_day	velocity_context.txs_in_last_day	n/a (number)
velocity_multiple_of_baseline_threshold	velocity_context.txs_in_last_hour + velocity_context.baseline_txs_per_hour	n/a (number)

chain_allowlist: [] + a counterparty present → deny. This is the one axis that defaults to deny rather than open when empty, because chain restriction is a required posture for any agent that can transact.

Enforcement

The evaluator returns allow, allow_with_step_up or deny. The application supplies current policy and velocity data and enforces the result before requesting signing or settlement. Provider-native controls and application checks are separate layers; the schema alone does not prove that every axis is enforced by a wallet provider.

Example

{
  "policy_id": "11111111-1111-4111-8111-111111111111",
  "vault_id": "22222222-2222-4222-8222-222222222222",
  "policy_version": 1,
  "amount_cap_cents_per_tx": 50000,
  "amount_cap_cents_per_day": 200000,
  "step_up_amount_cents": 100000,
  "counterparty_allowlist": [
    {
      "address": "0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045",
      "chain": "base",
      "token": "USDC"
    }
  ],
  "velocity_max_txs_per_hour": 5,
  "velocity_max_txs_per_day": 20,
  "chain_allowlist": [
    "base",
    "sol"
  ],
  "geo_allowlist": [
    "US",
    "GB"
  ],
  "mcc_allowlist": [],
  "mcc_blocklist": [
    "7995"
  ],
  "created_at": "2026-04-25T00:00:00.000Z",
  "updated_at": "2026-04-25T00:00:00.000Z"
}

policy_version

Every envelope carries a monotonic policy_version counter. Mid-flight policy changes (signer rotation, tier change) advance it; in-flight tool calls compare against current and raise PolicyStaleError on mismatch (F5 IRON RULE).

Relation to skill policy templates

SkillManifest ships a policyTemplate that’s a strict subset of AgentPolicyEnvelope. Skill defaults map to the runtime envelope fields shown above.

The principal can tighten any axis at install time. Loosening above the package default requires editing the policy template + a fresh install.

Reading list

• Money-safety contracts — F5 (atomic policy_version on signer rotation).
• SkillManifest — how skills consume the envelope.
• Authoring a skill — 4-tier policy preset pattern.