Create or replace the policy for an effect type

Refuse a begin for this effect type unless it declares a cost. Turn this on wherever you have set a spend ceiling, so the ceiling cannot be bypassed by simply not declaring anything.

Hold an effect for a human when the declared cost reaches this amount, in micro-USD. mode="require_approval" is all-or-nothing per effect type, which is why it gets switched off; this is the rule people actually have — "anything over $5,000 needs a second pair of eyes" — and it leaves routine work flowing. Sits below max_cost_micros, which refuses outright, and must not exceed it or it could never fire. Setting it makes a declared cost mandatory, since an effect declaring nothing would otherwise sail past it.

Remind me to reconcile this effect type this often, in hours. Ratchet cannot fetch your vendor's records — it has no credentials and no outbound access to your systems. It keeps the calendar instead: when the gap since the last POST /v1/reconcile exceeds this, it emits reconciliation.due. Reconciliation is the only control that finds actions which never asked at all, and it used to run only when somebody was already suspicious.

A line to WATCH, never one to enforce. Nothing is refused for exceeding it. The structuring analysis measures how closely declared amounts crowd it, which is how you point Ratchet at a threshold it does not own — a reporting limit, an internal review limit. Null falls back to max_cost_micros.

Surge containment. New effects of this type per hour above which the circuit breaker opens. Budget ceilings catch an agent spending too much; this catches one doing too MUCH — a retry loop sending five thousand emails instead of three. Null (the default) disables it.

What an open breaker does. "require_approval" (the default) holds the work for a human rather than killing the agent, so nothing irreversible happens and no context is lost. "monitor" records and alerts but changes no decision — use it to watch before you enforce. "deny" refuses outright.

Relative alternative to surge_per_hour, for when you do not know your own traffic: how many times normal is definitely wrong. The baseline is the median hourly volume over the last 7 days, computed for you, and a learned ceiling never drops below 30 so quiet effect types are not tripped by an ordinary busy afternoon. surge_per_hour wins if both are set.

How long a tripped breaker stays open before closing itself. Closing grants a fresh allowance, so a cooldown is a real second chance.

How often this effect type should be compared against the vendor's own record. Ratchet cannot perform that comparison — it keeps the calendar and says when one is overdue, via the reconciliation.due event.

Declared cost at or above which begin returns approval_required instead of execute. Raises the decision only — it never turns an approval or a denial back into an allow. Null disables it.

A line watched but never enforced. Nothing is refused for exceeding it; the structuring analysis measures how closely declared amounts crowd it.

New effects of this type per hour above which the circuit breaker opens. Null disables surge containment, which is the default.

Relative surge threshold: how many times normal is definitely wrong. Use when you do not know your own traffic. Does nothing until enough history exists to compute a baseline.

Median hourly volume over the last 7 days. Computed for you.

The hourly ceiling actually in force, whichever rule produced it.