Policy Enforcement

if amount <= 0:
    return False, "amount_must_be_positive"
if fee < 0:
    return False, "fee_must_be_non_negative"

total_cost = amount + fee  # All limits include gas fees

if SpendingScope.ALL not in self.allowed_scopes and scope not in self.allowed_scopes:
    return False, "scope_not_allowed"

if mcc_code:
    mcc_ok, mcc_reason = self._check_mcc_policy(mcc_code)
    if not mcc_ok:
        return False, mcc_reason

effective_per_tx = self._get_effective_per_tx_limit(mcc_code, merchant_category)
if total_cost > effective_per_tx:
    return False, "per_transaction_limit"

policy.add_merchant_allow(
    category="cloud",
    max_per_tx=Decimal("500.00"),  # Allow up to $500 for cloud services
)
policy.add_merchant_allow(
    category="groceries",
    max_per_tx=Decimal("100.00"),  # Cap groceries at $100
)

if self.spent_total + total_cost > self.limit_total:
    return False, "total_limit_exceeded"

for window_limit in [self.daily_limit, self.weekly_limit, self.monthly_limit]:
    ok, reason = window_limit.can_spend(total_cost)
    if not ok:
        return ok, reason  # "daily_limit_exceeded", etc.

def reset_if_expired(self) -> bool:
    now = datetime.now(timezone.utc)
    if self.window_type == "daily":
        duration = timedelta(days=1)
    elif self.window_type == "weekly":
        duration = timedelta(weeks=1)
    elif self.window_type == "monthly":
        duration = timedelta(days=30)
    else:
        return False
    if now >= self.window_start + duration:
        self.current_spent = Decimal("0")
        self.window_start = now
        return True
    return False

if rpc_client:
    balance = await wallet.get_balance(chain, token, rpc_client)
    if balance < total_cost:
        return False, "insufficient_balance"

for rule in self.merchant_rules:
    if rule.rule_type == "deny" and rule.matches_merchant(merchant_id, merchant_category):
        return False, "merchant_denied"

allow_rules = [rule for rule in self.merchant_rules if rule.rule_type == "allow"]
if allow_rules:
    match = next((r for r in allow_rules if r.matches_merchant(merchant_id, merchant_category)), None)
    if not match:
        return False, "merchant_not_allowlisted"
    if match.max_per_tx and amount > match.max_per_tx:
        return False, "merchant_cap_exceeded"

if drift_score is not None and self.max_drift_score is not None:
    if drift_score > self.max_drift_score:
        return False, "goal_drift_exceeded"

if self.approval_threshold is not None and amount > self.approval_threshold:
    return True, "requires_approval"

if kya_client and self.trust_level in (TrustLevel.MEDIUM, TrustLevel.HIGH):
    kya_ok, kya_reason = await self._check_kya_attestation(wallet, kya_client)
    if not kya_ok:
        return False, kya_reason

from sardis_v2_core import create_default_policy, TrustLevel

policy = create_default_policy(
    agent_id="agent_123",
    trust_level=TrustLevel.LOW,
)

from sardis_wallet import EnhancedWalletManager

manager = EnhancedWalletManager(settings, async_policy_store=policy_store)

# Async policy check (production)
evaluation = await manager.async_validate_policies(mandate)
if not evaluation.allowed:
    raise HTTPException(403, detail=evaluation.reason)

# Comprehensive check (with balance, sessions, multi-sig)
evaluation = await manager.evaluate_policies(
    wallet=wallet,
    mandate=mandate,
    chain="base",
    token=TokenType.USDC,
    rpc_client=rpc_client,
    session_id=session_id,
)

ok, reason = policy.validate_execution_context(
    destination="0x742d35Cc6634C0532925a3b844Bc9e7595f0bEb",
    chain="base",
    token="USDC",
)

from sardis_v2_core import create_default_policy, TrustLevel

policy = create_default_policy("agent_001", TrustLevel.LOW)
print(policy.limit_per_tx)  # Decimal('50.00')
print(policy.daily_limit.limit_amount)  # Decimal('100.00')

from sardis_v2_core import SpendingPolicy, SpendingScope, TrustLevel
from decimal import Decimal

policy = SpendingPolicy(
    agent_id="agent_cloud_001",
    trust_level=TrustLevel.MEDIUM,
    limit_per_tx=Decimal("500.00"),
    limit_total=Decimal("10000.00"),
    allowed_scopes=[SpendingScope.COMPUTE],  # Only cloud services
    blocked_merchant_categories=["gambling", "adult"],
)

# Add allowlist for specific providers
policy.add_merchant_allow(merchant_id="aws.amazon.com", max_per_tx=Decimal("1000.00"))
policy.add_merchant_allow(merchant_id="cloud.google.com", max_per_tx=Decimal("1000.00"))
policy.add_merchant_allow(merchant_id="azure.microsoft.com", max_per_tx=Decimal("1000.00"))

policy = SpendingPolicy(
    agent_id="agent_retail_001",
    trust_level=TrustLevel.LOW,
    limit_per_tx=Decimal("200.00"),
    limit_total=Decimal("5000.00"),
    allowed_scopes=[SpendingScope.RETAIL],
)

# Different caps per category
policy.add_merchant_allow(category="groceries", max_per_tx=Decimal("100.00"))
policy.add_merchant_allow(category="restaurants", max_per_tx=Decimal("50.00"))
policy.add_merchant_allow(category="gas_stations", max_per_tx=Decimal("75.00"))

# Block high-risk categories
policy.block_merchant_category("alcohol")
policy.block_merchant_category("tobacco")

policy = SpendingPolicy(
    agent_id="agent_stable_001",
    trust_level=TrustLevel.HIGH,
    limit_per_tx=Decimal("5000.00"),
    limit_total=Decimal("500000.00"),
    allowed_chains=["base", "polygon", "arbitrum"],
    allowed_tokens=["USDC", "USDT", "PYUSD"],  # Stablecoins only
)

# In-memory (dev/test)
policy.spent_total += amount

# Database-backed (production)
db_state = await policy_store.load_state(agent_id)
if db_state["spent_total"] + total_cost > policy.limit_total:
    return False, "total_limit_exceeded"

vel_ok, vel_reason = await policy_store.check_velocity(agent_id)
if not vel_ok:
    return False, vel_reason  # "too_many_requests"

await audit_logger.log(
    wallet_id=wallet.wallet_id,
    category=AuditCategory.POLICY,
    action=AuditAction.TRANSACTION_DENIED,
    actor_id=agent_id,
    resource_type="transaction",
    resource_id=tx_hash,
    details={"reason": reason, "amount": str(amount), "merchant": merchant_id},
)