---
title: Scoped approval
description: The spend envelope, the approval ledger, and approval scope, with today's limits.
url: https://thepoints.io/docs/agents/concepts/scoped-approval
audience: [agents, operators, developers]
status: Live (limited)
---

# Scoped approval

> **Agent Pay status:** Approve does not execute. Execution: not enabled. ACH settlement: not enabled. prepare_payment never moves money. Machine-readable: [/docs/agents/status.json](/docs/agents/status.json).

Every human approval creates a spend envelope: a record of what the approval covers. Decisions about it are written to a separate approval ledger.

## Limits today

Both features are Live (limited). Read these before relying on them:

- **Approval still starts from a draft.** A human approves one payment draft, and the spend envelope and ledger entry are recorded alongside that approval. There is no standalone "approve a budget" flow.
- **Aggregate caps are in progress.** An envelope can carry `maxPayments` and `maxTotalCents`, but usage across multiple payments is not persisted yet. Per-payment and allow-list checks apply.
- **Scope can't be set from the approval screen yet.** Approvals use the defaults in the table below.
- **Approve does not execute.** An envelope never moves money on its own, and execution is not enabled.

## Spend envelope

Minted in the same transaction as the human approval. If it can't be saved, the approval fails rather than being recorded without it. It holds:

- The signed fields: amount, currency, payee, funding source, rail, idempotency key, and `executableUntil`.
- Who is involved: the principal (account owner), the agent, and the approver.
- The signature, cleared on revocation.

Envelope statuses: `approved`, `revoked`, `expired`, `denied`.

## Approval ledger

An append-only record of envelope decisions, separate from general agent activity. Each entry is one of `approved`, `revoked`, `expired`, or `denied`.

## Approval scope

| Field | Default | Effect |
|---|---|---|
| Principal, amount, currency, payee, expiry | From the approved draft | Locked by the signature |
| `allowedCounterparties` | Empty | Empty means the locked payee only |
| `maxPayments`, `maxTotalCents` | Unset | Aggregate caps (see limits above) |
| `unattendedAllowed` | `false` | Automated, unattended use is refused |
| `requiresInteractiveSession` | `true` | Use must come from a signed-in human session |

Scope checks fail closed. Any automated reuse of an interactive, one-time approval is refused.

## Related

- [Authorization envelope](/docs/agents/concepts/authorization-envelope)
- [Recurring mandates](/docs/agents/concepts/recurring-mandates), which need a fresh envelope every cycle
- [Statuses](/docs/agents/reference/statuses)