Docs

Valta Docs

Spending Policies

Dashboard: /dashboard/spending-policies (sidebar: "Policies").

A spending policy is enforced by Valta's backend — not by the AI model. The model cannot override a policy by claiming urgency or authority. Rules are evaluated in code before any financial action executes.

Spending Policies govern an agent with a funded Valta wallet — Valta holds the money, so a limit here is a real, enforced control. If your agent has no Valta wallet at all and you just want to cap its own external API spend (OpenAI, Anthropic, etc.), that's a different, lighter feature — see Valta Cap.

Policy fields

FieldTypeDescription
maxPerTransactionnumberHard cap on any single financial action, in USDC. Any action above this amount is blocked outright — no approval path.
dailyLimitnumberMaximum cumulative spend in a 24-hour window. Resets at midnight UTC.
monthlyLimitnumberMaximum spend across a calendar month.
requireApprovalAbovenumberActions at or above this amount pause the run and wait for human approval via the dashboard or API. Must be ≤ maxPerTransaction.
blockedCategoriesstring[]Categories the agent is never permitted to transact with. Built-in values: gambling, adult, crypto_exchange.
allowedDomainsstring[]If set, the agent can only make calls to these domains. Any other domain is blocked. Leave unset to allow all (within other restrictions).
blockedDomainsstring[]Domains that are always blocked, regardless of allowedDomains. Evaluated last — a domain on this list is blocked even if it appears in allowedDomains.

What happens on a violation

When a policy rule is violated:

  1. The action is blocked — no money moves.
  2. The event is logged to the audit trail with the specific rule that failed.
  3. An in-app notification is created in your dashboard.
  4. The agent run continues if possible — a blocked transaction does not always fail the entire run. The agent receives an error response and may continue with other tasks.

What the agent cannot do

  • Change its own policy — policy updates require an authenticated call from your server using your API key.
  • Split transactions to avoid limits — Valta includes structuring detection. Multiple small transactions that circumvent a per-transaction cap are flagged and blocked.
  • Read or modify the audit trail — audit entries are append-only and inaccessible to the agent itself.

Creating and updating a policy

ts
import { ValtaClient } from 'valta-sdk'

const valta = new ValtaClient({ apiKey: process.env.VALTA_API_KEY })

// Create a strict policy
await valta.policies.create({
  agentId: agent.id,
  dailyLimit: 100,
  maxPerTransaction: 25,
  requireApprovalAbove: 20,
  blockedCategories: ['gambling', 'adult'],
  allowedDomains: ['api.stripe.com', 'api.openai.com'],
})

// Update just the daily limit — all other fields remain unchanged
await valta.policies.update(agent.id, { dailyLimit: 200 })

Updates take effect immediately. In-flight runs that have already passed the policy check are not retroactively affected, but the next action in that run will be evaluated against the new policy.

Deleting a policy

Deleting a policy removes all spending restrictions from the agent. The agent will run without any limits until a new policy is created.

ts
await valta.policies.delete(agent.id)

After deleting a policy, the agent has no spending limits. Create a replacement policy before resuming agent runs.

Next steps