Delegation & approvals

Availability

Spend limits Team+ · Agent permissions & approvals Enterprise

Delegation is how you grant agents bounded authority to act — capped by spend, scoped by permission, and routed to a human when a decision needs sign-off. These controls are consulted during the authorize decision flow.

Spend limits (Team+)

Spend limits cap what an agent may spend over a rolling window, in USD:

• Daily and monthly limits, enforced during authorize.
• If an action would push spend over a limit, authorize returns deny. This check fails closed — if spend analytics are unavailable, the request is denied rather than allowed.

Spend limits are part of spend_controls and are available on the Team plan and up.

Method	Path	Purpose
GET	/v1/spend-limits	List spend limits.
POST	/v1/spend-limits	Create a spend limit.
DELETE	/v1/spend-limits/{id}	Delete a spend limit.

Agent permissions & approvals (Enterprise)

Agent permissions and approval routing are part of policy_engine and require the Enterprise plan:

• Agent permissions — explicit allow/deny grants per agent. An explicit deny is the first thing authorize checks and short-circuits to deny.
• Approval rules — self-service configuration for which actions route to human approval. When a rule matches, authorize returns needs_approval.
• Pending approvals — the requests awaiting a human decision, approved or rejected by a reviewer in the dashboard.

Method	Path	Purpose
GET	/v1/delegation	List agent permissions and pending approval requests.
POST	/v1/delegation/permissions	Create or update an agent permission.
DELETE	/v1/delegation/permissions/{id}	Delete an agent permission.
GET	/v1/approval-rules	List approval rules.
POST	/v1/approval-rules	Create an approval rule.
DELETE	/v1/approval-rules/{id}	Delete an approval rule.
GET	/v1/approvals/{id}	Poll a needs_approval decision.
POST	/v1/approvals/{requestID}/decide	Record a human approve/reject decision.

Human approval in the loop

When authorize returns needs_approval, the request becomes a pending approval. The agent polls GET /v1/approvals/{id} for the outcome while a reviewer approves or rejects it in the dashboard; the decision is recorded to the ledger.

Python

from splyntra import authorize

decision = authorize(
    "payments.refund",
    agent_id="support_agent",
    context={"amount": 80},
)

match decision["decision"]:
    case "allow":
        issue_refund()
    case "needs_approval":
        wait_for_human()   # poll GET /v1/approvals/{id}
    case "deny":
        reject()           # e.g. over the spend limit

TypeScript

import { authorize } from "@splyntra/sdk";

const d = await authorize("payments.refund", {
  agentId: "support_agent",
  context: { amount: 80 },
});

if (d.decision === "allow") {
  await issueRefund();
} else if (d.decision === "needs_approval") {
  await waitForHuman(); // poll GET /v1/approvals/{id}
} else {
  reject(); // e.g. over the spend limit
}

Next steps

• Governance overview — the full authorize decision order.
• Policy engine — deny-wins allow/deny rules.
• Activity ledger — where every decision is recorded.