Raise a limit for one task

Sometimes a policy limit blocks a task that you still want your agent to finish. When that happens, the agent can ask an admin to raise that one limit for a few hours. Once the admin approves, the agent finishes the task, and the limit will return to its old value when the override expires.

Example use case

Let's say the per-transaction limit in your agent's policy blocks invoice INV-4471 for $420.00. The agent asks for a temporary override (the console calls it a temporary grant) just big enough for the invoice, for 4 hours. An admin approves it in the console, the agent pays the invoice, and 4 hours later the override ends on its own.

The steps below follow that agent from start to finish:

Find the rule → Request an override → Approve or deny → Finish the task

Requirements

You'll need a linked agent whose policy allows override requests. An admin can turn this on by setting Temporary grant requests to Require approval in the policy's Payments section. See Temporary overrides for details.

Prompt

You can hand the task to your agent with a prompt like this one:

Our per-transaction limit blocked invoice INV-4471 for $420.00. Ask for a temporary override just big enough for this invoice, for 4 hours, then pay it once approved.

Steps

1. Find the rule that blocked it

First, the agent looks at the blocked intent and the policy:

catena intents get int_...
catena policy show

The intent's .reasons names the rule that blocked it. From there, we recommend that the agent pick the smallest change that lets the task through.

2. Request an override

Next, the agent requests the override, with the amount, the duration, and a reason the admin will read:

catena policy request-override --account acct_... \
  --amount 500 --duration 4h \
  --reason "Vendor invoice INV-4471 is $420.00"

Depending on the limit, the agent may need to change the command:

• A limit shared across all accounts: Use --all-accounts in place of --account.
• A transfer limit: Add --capability transfer. In this case, --account is the source account.

The request is an intent with status pending, and the agent sends you metadata.dataUrl (a link to the request in the console).

3. Approve or deny

Open the link, review the change and the reason, and approve or deny the request. If you deny it, the intent will become blocked, and the agent should not ask again.

4. Finish the task

Once you approve, the agent runs the blocked command again. If the first run passed --idempotency-key, the agent uses a new key this time. We apply the raised limit at once, and catena policy show reports it until it expires.

Rules

A few rules apply to every override:

• Each agent can have one pending override request.
• Durations run from one minute to seven days (e.g., --duration 4h).
• An override applies only to the agent that asked, and only to the limit it names.
• An override ends when its duration runs out, so you don't need to remove it.