Agent Policy Language

Why APL?

Existing policy engines (OPA, Cedar, Permit.io) were designed for API access control — not for financial transactions, not for crypto rails, not for MiCA compliance.

APL is purpose-built for AI agents that move money. It is deterministic (no LLM in the enforcement path), human-readable (auditors can read it), and produces cryptographic proof of every decision.

Syntax

Hosted engine today: the /api/enforce endpoint reads a fixed subset of APL, not the full language shown below. A policy must state three limits: a per-transaction approve limit (when input.amount <= N [CURRENCY] then APPROVE), an approval threshold (when input.amount > N and input.amount …) and a cap (Daily limit of N or when input.amount > N then DENY). The cap denies any single action above it and also limits the total approved per UTC day. A destination allowlist of double-quoted addresses (input.destination in ["…"]) and one currency are also enforced. A policy that leaves out a limit, or states one twice with different values, is rejected — nothing falls back to defaults. OFAC screening runs on every action. Everything else is ignored.

policy "payment-agent-v1" {

  rule auto_approve {
    when input.amount <= 500 and input.currency == "USDC"
    then APPROVE
  }

  rule require_review {
    when input.amount > 500 and input.amount <= 10000
    then REQUIRE_APPROVAL
  }

  rule hard_block {
    when input.amount > 10000
    then DENY
    reason "Exceeds operator daily limit"
  }

}

policy "regulated-agent-v2" {

  rule ofac_check {
    when is_sanctioned(input.destination)
    then DENY
    reason "OFAC SDN list match"
  }

  rule allowlist_only {
    when input.destination not in ["9WzDXw...", "AaBbCc..."]
    then DENY
    reason "Destination not in operator allowlist"
  }

  rule review_threshold {
    when input.amount > 1000
    then REQUIRE_APPROVAL
    reason "Above the auto-approve limit — needs sign-off"
  }

  rule auto_approve {
    when input.amount <= 1000
    then APPROVE
  }

}

Decision Outcomes

Regulatory Alignment

Start enforcing policies today

MiCA's transitional period for crypto-asset service providers ended on 1 July 2026.