> For the complete documentation index, see [llms.txt](https://docs.robotmoney.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.robotmoney.com/govern/headless-limits-api.md).

# Headless Limits

Headless limits are server-managed policy rules for decision-only external authorizations. They let a tenant admin set an auto-approval envelope without EIP-712 signing.

## Routes

```http
GET /v1/policy/headless-limits
PUT /v1/policy/headless-limits
DELETE /v1/policy/headless-limits
```

`GET` requires `policy:read`. `PUT` and `DELETE` require `policy:write` and an active admin member, either from a user session or a tenant service credential that asserts that member. Agent principals are refused.

## Upsert

```json
{
  "agent_id": "agent_...",
  "action_type": "ach_outbound",
  "currency": "USD",
  "per_authorization_limit": "100.00",
  "daily_window_limit": "500.00",
  "counterparty_allowlist_required": false
}
```

Allowed action types are `ach_outbound`, `wire`, `card`, and `erp_writeback`. Settlement and custody actions are refused.

Each upsert creates or replaces one managed rule for the agent, action, and currency. It never replaces unrelated tenant rules.

## Safety Rules

Generated rules carry `external_authorization_only: true` and `managed_by: headless_limits_api`. They are unsigned by design and apply only to `POST /v1/authorizations` with `execution: external`. Internal execution keeps the normal fiat human approval floor.

Every mutation activates a new policy version and emits an audit event with the before and after values. The linter still blocks unsafe generated rules.

Auto approval still requires a registered counterparty that is not paused, is not an agent counterparty, and has accepted provenance or verification. Accepted provenance is `human_confirmed` or `customer_asserted` from an admin-managed source. Accepted verification is `document_verified` or `sanctions_cleared`.

New self-serve tenants get default headless limits after they create their first tenant agent: `USD 100.00` per authorization and `USD 500.00` per day for `ach_outbound` and `card`.