The rules can be as complex as the code you can write. It effectively sends a webhook on which you can respond "decline" to stop the tx from succeeding. (RootCode also packages this concept to make it quicker to prototype)

Is there a timeout for approving/declining transactions? I'd be interested in setting up a sort of 2FA for large/over budget transactions where I'd have to manually approve it before it goes through.

e.g. "You've already spent over your monthly Amazon budget by X amount, are you sure you want to make this $200 purchase?"