What is x402 Auto-Policy?
x402 auto-policy is the automatic creation of spending policies when an agent encounters a new x402-enabled endpoint for the first time — applying configured default limits (spending caps, rate limits, recipient pins) without requiring manual configuration for each new API.
WHY IT MATTERS
In an agent economy where agents autonomously discover and consume APIs, pre-configuring a policy for every possible endpoint is impossible. But having no policy means agents spend freely on any endpoint they encounter — an unacceptable risk.
Auto-policy solves this with a 'secure by default' approach:
- Agent encounters a new x402 endpoint that has no existing policy
- The policy engine automatically creates a policy using the operator's configured defaults
- The defaults typically include: per-request maximum, daily spending cap, requests-per-minute limit, and automatic recipient pinning
- The operator receives a webhook notification about the new endpoint
- The agent can immediately transact within the default limits
- The operator can later tighten or loosen the policy based on the endpoint's value
Typical default configurations:
{
maxAmountPerRequest: "1000000", // 1 USDC max per request
maxAmountPerDay: "10000000", // 10 USDC max per day
maxRequestsPerMinute: 10,
notifyOnDiscovery: true,
autoCreatePolicies: true
}This balances agent autonomy with financial safety. Agents can explore freely, but every new endpoint is immediately governed. Over time, operators build up a portfolio of endpoint-specific policies tuned to actual usage patterns.
HOW POLICYLAYER USES THIS
Auto-policy is a core PolicyLayer feature for x402. When an agent discovers a new x402 endpoint, PolicyLayer creates a policy from your defaults, records the discovery with timestamp and agent ID, pins the recipient address, and sends a webhook notification — all before the first payment is processed.