> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.thepennyinc.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.thepennyinc.com/_mcp/server.

# Rule Applicability

Every spend control rule requires `applicable_transaction_authorizations` and `applicable_card_issuance_modes`. Together, these fields define the transactions for which Penny evaluates the rule. State every value you want the rule to cover; there is no default that means all values.

**`A rule for managed-card purchases`**

```json title="A rule for managed-card purchases"
{
  "rule_type": "transaction_amount",
  "applicable_transaction_authorizations": ["debit"],
  "applicable_card_issuance_modes": ["managed"],
  "configuration": {
    "USD": { "maximum": "500.00" }
  }
}
```

## Transaction authorization types

`applicable_transaction_authorizations` selects the direction or purpose of the authorization:

| Value        | Applies to                                                                                                                                                                                             |
| ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `debit`      | A new debit, such as a card purchase, outbound transfer, ACH debit, or the sell leg of a currency exchange.                                                                                            |
| `credit`     | A credit, such as a merchant-initiated refund, inbound transfer, ACH credit, or the buy leg of a currency exchange. A credit is its own authorization and does not have to reference an earlier debit. |
| `adjustment` | A non-standard change to a previously authorized transaction, such as correcting a hold or expected balance.                                                                                           |

Most card-purchase rules should use `["debit"]`. Include `credit` or `adjustment` only when the same rule should also govern those authorization types.

## Card issuance mode

`applicable_card_issuance_modes` selects how the card involved in the authorization was issued:

| Value     | Meaning                                                                                                                                      | Availability |
| --------- | -------------------------------------------------------------------------------------------------------------------------------------------- | ------------ |
| `managed` | A card created through the API and managed by your business over its lifecycle. Use this mode for cards you issue for ongoing or repeat use. | Available    |

Use `["managed"]` for every rule:

```json
{
  "applicable_transaction_authorizations": ["debit"],
  "applicable_card_issuance_modes": ["managed"]
}
```

The applicability fields do not change the rule's typed `configuration`; they determine whether that rule participates in an authorization decision. Spend control responses return both fields on each rule. Fetch `GET /spend_controls/rule_types` for the current schema and a configuration example for each rule type.