Skip to main content

​
Policies

Arclasp’s backend is the authority for policy decisions on governed actions. A policy evaluation can result in:

​
Current built-in policy behavior

The current backend source verifies the following policy families and decision behavior: This table intentionally lists source-supported behavior. Do not infer additional default rules from category names alone.

​
Financial behavior

The current backend recognizes top-level amount_usd, amount, or value fields for financial exposure. Typical defaults for a fresh organization are:
  • single-action approval threshold: $5,000;
  • cumulative Chain approval threshold: $10,000;
  • cumulative hard-deny threshold: $50,000.
A per-Chain cumulative threshold can be configured before the Chain starts:
The old financial_approval_threshold_usd and cumulative_financial_threshold_usd arguments on arclasp.init() are retained for compatibility but are not the supported way to change current backend-authoritative financial policy.

​
Policy modes

Policy records support three modes:
  • enforce — apply the evaluated decision;
  • shadow — evaluate and record what would have happened while returning an allow-style result;
  • disabled — skip that policy after the organization kill-switch check.
Do not rely on a documentation claim about the default mode for a newly created customer policy. Treat the mode shown by the current dashboard/API record as authoritative.

​
Exceptions

A scoped PolicyException can bypass a matching require_approval outcome. Current exception durations include:
  • 1h
  • 1d
  • 1w
  • 1m
  • single_use
Exceptions do not bypass hard denies or the organization kill switch.

​
Custom policy boundary

The dashboard can create named policy records and control their mode. The current customer-facing product does not expose a mature arbitrary rule editor, JSON matching DSL, or general predicate builder for customer-authored policies. Do not describe the current product as if every policy rule and threshold can be freely authored in the dashboard.

​
Agent risk

Registered agents are first-class organization resources with risk metadata. The source-supported enforcement behavior to rely on is that a registered Critical agent requires approval for governed actions. Avoid assuming that every label such as “high-risk” has the same backend meaning unless the current backend policy checks it.

​
No first-class Tool Catalog

Arclasp records tool/action names in governed events and integrations, but the current product does not have a mature first-class Tool Catalog that generically denies unknown or disabled tools.