Record format
@flashylabs/agentpay
pay-policy/1 — the Commerce layer’s policy format and a pure allow/deny/escalate evaluator for agents that spend, over any rail: given a policy, a proposed payment and the period’s spent-so-far, may it go, must it stop, or must a person decide. Not a wallet; the rails and the signing live elsewhere.
version 0.1.0 · measured 2026-10-19 from a checkout · source: agentpay
node vendor-pay-policy.mjs check <policy.json> — dependency-free; the spec, not on npmMinor units only: every figure is a whole number of minor units beside an explicit currency, and a float anywhere in a policy, a payment or a ledger state is refused; the CLI refuses 2500.0 in the file text before JSON.parse can round it to 2500. A child policy may only narrow — caps ≤, allowlists ⊆, rails ⊆, same currency, same period — and attenuate names every widened dimension.
The evaluator is pure: it reads no clock, opens no connection and mutates nothing; spent-so-far is injected as ledgerState, and when a period is capped and no ledger state is supplied the answer is deny, because unknown is not zero.
Edge cases — each one paid for once
A human gate no payment can reach is a missing gate
Any policy whose per-transaction cap is above zero must carry humanApprovalAbove, and it must be strictly below that cap — a uniform gate is theatre and a gate above the cap is absent. A closed policy (cap 0) may omit it because it can pay nobody anything; 0 escalates everything.