Spending authority

The exact, covenant-bound set of rules that determines what an agent may spend, and how.

Spending authority is the complete set of rules the covenant enforces against an agent's spends from a vault. It is the sum of several independent, composable controls:

All of these are enforced together, additively — a spend must satisfy every applicable rule, not just one. None of them can be bypassed by constructing a transaction differently, because the covenant checks the transaction's actual content and resulting state, not any claim about intent.

Per-agent, not per-vault, in multi-agent vaults

Covenant versions that support multiple independent agents on one vault give each agent its own complete, separately tracked policy — its own cap, its own budget, its own recipient set, its own approval threshold. One agent exceeding or exhausting its own budget has no effect on another agent's authority in the same vault.

Authority is set by the owner, and only the owner

Every one of the controls above is set (and can only be changed) by the vault owner, through an owner-signed covenant operation. Nothing about an agent's spending authority can be changed by the agent itself, by an approver, or by editing PolicyVault's application-level metadata (see Owner/agent/approver authority boundaries).

Zero authority by default

An agent with no configured spending authority has no ability to move funds at all. Authority is always something the owner explicitly grants — there is no default or implicit allowance.

See also: Give an AI agent spending authority.