What is a Token Approval?

Before a DEX can swap your tokens, it needs permission to move them. That's what an approval does — it tells the token contract 'this spender can transfer up to X tokens from my account.' Without an approval, smart contracts can't touch your tokens.

The danger lies in unlimited approvals. Many dApps request infinite approval (type(uint256).max) for convenience — approve once, interact forever. But if that dApp's contract is compromised, the attacker can drain all your approved tokens. This has caused billions in losses.

For AI agents, approval management is critical. An agent that grants unlimited approvals to every DeFi protocol it interacts with creates an enormous attack surface. Each approval is a potential drain vector. Agents should use precise approval amounts and revoke approvals after use.

PolicyLayer controls which token approvals agents can grant. Policies can restrict approval amounts (no unlimited approvals), limit approved spenders to a whitelist, and automatically revoke approvals after use — closing the attack window.