Skip to main content
Policy rules define the boundaries within which automated agents — API keys holding the AGENTS_EXECUTE scope — are permitted to operate. Each rule matches on one or more criteria such as agent key prefix, token type, chain, transaction amount, or specific accounts. Rules are evaluated by PolicyGuard, a stateless per-tenant evaluator that runs before any agent-originated write. Any transaction that falls outside the active rules is rejected before it reaches the ledger, and the evaluation itself is recorded to the HMAC-signed agent audit log.

​
Rule types

Idem supports six policy rule types. Each type is a narrow, single-purpose constraint — to combine constraints (for example, “cap the amount and restrict the token”), create one rule per constraint; PolicyGuard evaluates all active rules for a tenant/agent together, and an intent must satisfy every one of them. All rule types accept an optional agentKeyPrefix to scope the rule to a subset of agents (see below).

​
Create a policy rule

Send a POST request to /api/v1/admin/policy-rules to define a new rule. Because each rule type is single-purpose, restricting an agent to “up to 1,000 USDC/USDT on EVM” takes three separate rules — one for the amount cap and one for each allowlist:
A successful response returns the created rule including its assigned id and createdAt timestamp:

​
Rule fields

Only supply the fields required by the type you’re creating — the API rejects a request that’s missing a required field for its type.

​
List policy rules

To view all active policy rules for your tenant, send a GET request to /api/v1/admin/policy-rules:
The response is an array of PolicyRuleResponse objects, each containing the rule id, type, agentKeyPrefix, params, and createdAt.

​
Delete a policy rule

To remove a policy rule, send a DELETE request with the rule’s ID:
A successful deletion returns 204 No Content with an empty response body. Deletion takes effect immediately. Any agent transactions submitted after the deletion will no longer be evaluated against the deleted rule. If other rules remain active, those continue to apply.

​
Required scope

All policy rule operations — listing, creating, and deleting — require the ADMIN scope. This scope should be held only by highly privileged keys used by your platform administrators, not by agent or service account keys.
Use agentKeyPrefix to scope rules to a specific set of agents without needing a separate rule per key. For example, if you have a group of payment-processing agents whose keys all begin with sk_live_agent_pay_, a single rule with "agentKeyPrefix": "sk_live_agent_pay_" covers all of them. You can then create a separate, more permissive rule for a different group — such as internal settlement agents with a distinct prefix — without any overlap.