docs
fren get sandbox key

concepts

mandates & policy engine

Every spend is evaluated by a deterministic policy engine before the bank is touched. The rules run in a fixed order; the first one that fails decides.

three outcomes

decisionagent receiveswhat happens
allowstatus: "paid" / "initiated"Executed immediately. The issuer can still decline (declined_by_bank).
reviewstatus: "pending_approval" + requestIdNothing charged yet. A human approves or rejects.
blockstatus: "denied" + reasonNothing charged, logged in the audit log. Not escalated.
Hard limits come before review. A payment above the per-payment cap, the daily limit or the monthly budget is blocked, not sent for approval. Approval only applies to payments that already fit the mandate.

card payments: decision order

Amount must be > 0.

block

Merchant name contains an entry of blockedMerchants (case-insensitive).

block

allowedMccs is not empty and the mcc is missing or not in the list.

block

Amount > perTxMax.

block

Executed spend today + amount > dailyMax.

block

Executed spend this month + amount > monthlyMax.

block

Amount > approvalAbove.

review

Otherwise.

allow

Spend windows are calendar day and calendar month in UTC. Only executed card payments and transfers count; denied attempts and pending requests do not. Comparisons are strict: with approvalAbove: 250, a 250.00 EUR payment executes and 250.01 EUR is reviewed.

transfers: decision order

transfersEnabled is false.

block

Amount must be > 0.

block

Executed spend this month + amount > monthlyMax.

block

Amount > transferApprovalAbove (default 0: every transfer).

review

Otherwise.

allow

The IBAN format is checked before the mandate (invalid IBAN returns 400). Executed transfers count toward daily and monthly spend like card payments.

worked examples

With the sandbox demo-agent mandate: perTxMax 500, dailyMax 2000, approvalAbove 250, no MCC restriction.

callcontextoutcomerule
pay 49 Vercelnothing spentallowfits everything
pay 250 Notionallownot strictly above 250
pay 320 AWSreviewapprovalAbove
pay 900 AppleblockperTxMax
pay 200 Figma1 900 executed todayblockdailyMax
pay 40 Lucky CasinoblockedMerchants: ["casino"]blockblockedMerchants
pay 30 Uber mcc 4121allowedMccs: ["5734","7372"]blockallowedMccs
send_transfer 100default mandateblocktransfersEnabled

splitting is not a loophole

The MCP server instructs agents to respect each decision and never split an amount to get under a threshold. If one tries anyway, the daily and monthly limits still cap the total, and every attempt is in the audit log for you to see.

changing a mandate

update_agent_policy (or POST /api/agents/:id/policy) merges your patch into the current mandate and validates the result. Changing monthlyMax also updates the card's own limit. Changes apply to the next payment; they do not touch requests already pending.

update_agent_policy · arguments
{
  "agentId": "agt_3f2b8d10",
  "allowedMccs": [
    "5734",
    "7372"
  ],
  "blockedMerchants": [
    "casino",
    "crypto"
  ],
  "approvalAbove": 100
}

recipes

agentmandate
SaaS buyerperTxMax 200 · dailyMax 600 · monthlyMax 3000 · approvalAbove 100 · allowedMccs [5734, 7372]
Travel bookerperTxMax 1500 · dailyMax 3000 · approvalAbove 400 · allowedMccs [4511, 7011, 4112, 4722]
Ads spendperTxMax 1000 · dailyMax 1000 · monthlyMax 20000 · approvalAbove 1000 · allowedMccs [7311]
Supplier payertransfersEnabled true · transferApprovalAbove 0 · monthlyMax 50000

MCC values above are common examples; check the category your merchants actually report.