{"id":"policy-gate","title":"Policy gate with a signed receipt: your JsonLogic rules vs a proposed tool call or payment","description":"Evaluates your own policy (JsonLogic rules, each allow or deny, deny-overrides or first-match, default deny) against a proposed tool call, payment or action, and returns allow or deny, the rule id that decided, and a receipt signed by the hub over the hashes of the policy, the request and the decision. The receipt is the product: another agent or an auditor can verify offline which rule allowed the action. A rule that errors fails closed (deny, status unknown). Cedar and Rego answer unsupported.","roi":"An auditable allow/deny for every consequential tool call at $0.005, verifiable by anyone with the hub's public key.","audience":"agent-infra","package":"agent-coordination-kit","channels":["x402","mcp"],"endpoint":{"method":"POST","url":"https://agents.writerslogic.com/api/v1/policy-gate","path":"/api/v1/policy-gate","contentType":"application/json"},"price":{"amount":"0.005","currency":"USDC","network":"base","perCall":true,"failedCallsCharged":false},"inputSchema":{"type":"object","additionalProperties":false,"required":["policy","request"],"properties":{"language":{"type":"string","enum":["jsonlogic","cedar","rego"],"description":"Default jsonlogic. cedar and rego return unsupported."},"policy":{"description":"JsonLogic: { rules: [{ id, effect: allow|deny, when: <JsonLogic>, description? }] (at most 100), combining?: deny-overrides|first-match, defaultEffect?: deny|allow }. A string for cedar/rego."},"request":{"description":"The proposed action as JSON (at most 65536 bytes), e.g. { tool, args, amountUsd, payee }. Rules read it with { \"var\": \"args.amountUsd\" }."}}},"resultSchema":{"type":"object","properties":{"status":{"type":"string","enum":["pass","fail","unknown","unsupported"],"description":"pass: every rule held. fail: a rule was violated (see witnesses). unknown: the input lacks the evidence to decide. unsupported: outside what this engine covers. Missing evidence is never a pass."},"decision":{"type":"string","enum":["allow","deny"]},"ruleId":{"anyOf":[{"type":"string","description":"The rule that decided; null when the default effect applied."},{"type":"null"}],"description":"The rule that decided; null when the default effect applied."},"matchedRules":{"type":"array","items":{"type":"string"}},"policyHash":{"type":"string","description":"sha256 of the JCS policy."},"requestHash":{"type":"string","description":"sha256 of the JCS request."},"receiptBody":{"type":"object","description":"Exactly what the receipt digest covers."},"receipt":{"type":"object","description":"Standalone receipt: recompute digest from `receiptBody`, then recover the EIP-191 signer and compare with the DID document's attestation key. signature is null when the hub has no attestation key configured.","properties":{"digest":{"type":"string"},"scheme":{"type":"string"},"signature":{"anyOf":[{"type":"string"},{"type":"null"}]},"signer":{"anyOf":[{"type":"string"},{"type":"null"}]}}},"witnesses":{"type":"array","items":{"type":"object","properties":{"ruleId":{"type":"string"},"detail":{"type":"string"},"path":{"type":"string","description":"JSON pointer or dotted path into the input."},"offset":{"type":"integer"},"index":{"type":"integer"},"expected":{"description":"What the rule required."},"actual":{"description":"What the input had."}}}},"versions":{"type":"object","description":"Every semantic dependency of this answer (engine, tables and their as-of dates, tokenizer, calendar, rounding profile)."},"limits":{"type":"array","items":{"type":"string"}},"deterministic":{"type":"boolean","description":"Always true: pure code, no model."}}},"outputSchema":{"type":"object","properties":{"data":{"type":"object","properties":{"status":{"type":"string","enum":["pass","fail","unknown","unsupported"],"description":"pass: every rule held. fail: a rule was violated (see witnesses). unknown: the input lacks the evidence to decide. unsupported: outside what this engine covers. Missing evidence is never a pass."},"decision":{"type":"string","enum":["allow","deny"]},"ruleId":{"anyOf":[{"type":"string","description":"The rule that decided; null when the default effect applied."},{"type":"null"}],"description":"The rule that decided; null when the default effect applied."},"matchedRules":{"type":"array","items":{"type":"string"}},"policyHash":{"type":"string","description":"sha256 of the JCS policy."},"requestHash":{"type":"string","description":"sha256 of the JCS request."},"receiptBody":{"type":"object","description":"Exactly what the receipt digest covers."},"receipt":{"type":"object","description":"Standalone receipt: recompute digest from `receiptBody`, then recover the EIP-191 signer and compare with the DID document's attestation key. signature is null when the hub has no attestation key configured.","properties":{"digest":{"type":"string"},"scheme":{"type":"string"},"signature":{"anyOf":[{"type":"string"},{"type":"null"}]},"signer":{"anyOf":[{"type":"string"},{"type":"null"}]}}},"witnesses":{"type":"array","items":{"type":"object","properties":{"ruleId":{"type":"string"},"detail":{"type":"string"},"path":{"type":"string","description":"JSON pointer or dotted path into the input."},"offset":{"type":"integer"},"index":{"type":"integer"},"expected":{"description":"What the rule required."},"actual":{"description":"What the input had."}}}},"versions":{"type":"object","description":"Every semantic dependency of this answer (engine, tables and their as-of dates, tokenizer, calendar, rounding profile)."},"limits":{"type":"array","items":{"type":"string"}},"deterministic":{"type":"boolean","description":"Always true: pure code, no model."}}},"_provenance":{"type":"object","description":"C2PA-aligned manifest and W3C VC 2.0 (eddsa-jcs-2022) issued by the hub DID; verify at POST /api/v1/verify-provenance"}},"required":["data","_provenance"]},"example":{"policy":{"rules":[{"id":"deny-new-payee","effect":"deny","when":{"!":{"in":[{"var":"payee"},["0x7a16fF8270133F063aAb6C9977183D9e72835428"]]}}},{"id":"allow-small","effect":"allow","when":{"<=":[{"var":"amountUsd"},25]}}]},"request":{"tool":"pay","payee":"0x7a16fF8270133F063aAb6C9977183D9e72835428","amountUsd":12.5}},"openapiOperation":{"operationId":"policy_gate","summary":"Policy gate with a signed receipt: your JsonLogic rules vs a proposed tool call or payment","description":"Evaluates your own policy (JsonLogic rules, each allow or deny, deny-overrides or first-match, default deny) against a proposed tool call, payment or action, and returns allow or deny, the rule id that decided, and a receipt signed by the hub over the hashes of the policy, the request and the decision. The receipt is the product: another agent or an auditor can verify offline which rule allowed the action. A rule that errors fails closed (deny, status unknown). Cedar and Rego answer unsupported.\n\nPrice: 0.005 USDC on Base (x402).","x-x402-price-usdc":"0.005","x-x402-amount":"5000","x-payment-info":{"protocols":["x402"],"price":{"mode":"fixed","currency":"USD","amount":"0.005"}},"x-audience":"agent-infra","x-sample-url":"https://agents.writerslogic.com/api/v1/samples/policy-gate","security":[{"x402":[]},{"apiKey":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","additionalProperties":false,"required":["policy","request"],"properties":{"language":{"type":"string","enum":["jsonlogic","cedar","rego"],"description":"Default jsonlogic. cedar and rego return unsupported."},"policy":{"description":"JsonLogic: { rules: [{ id, effect: allow|deny, when: <JsonLogic>, description? }] (at most 100), combining?: deny-overrides|first-match, defaultEffect?: deny|allow }. A string for cedar/rego."},"request":{"description":"The proposed action as JSON (at most 65536 bytes), e.g. { tool, args, amountUsd, payee }. Rules read it with { \"var\": \"args.amountUsd\" }."}}},"example":{"policy":{"rules":[{"id":"deny-new-payee","effect":"deny","when":{"!":{"in":[{"var":"payee"},["0x7a16fF8270133F063aAb6C9977183D9e72835428"]]}}},{"id":"allow-small","effect":"allow","when":{"<=":[{"var":"amountUsd"},25]}}]},"request":{"tool":"pay","payee":"0x7a16fF8270133F063aAb6C9977183D9e72835428","amountUsd":12.5}}}}},"responses":{"200":{"description":"Paid result with provenance","content":{"application/json":{"schema":{"type":"object","properties":{"data":{"type":"object","properties":{"status":{"type":"string","enum":["pass","fail","unknown","unsupported"],"description":"pass: every rule held. fail: a rule was violated (see witnesses). unknown: the input lacks the evidence to decide. unsupported: outside what this engine covers. Missing evidence is never a pass."},"decision":{"type":"string","enum":["allow","deny"]},"ruleId":{"anyOf":[{"type":"string","description":"The rule that decided; null when the default effect applied."},{"type":"null"}],"description":"The rule that decided; null when the default effect applied."},"matchedRules":{"type":"array","items":{"type":"string"}},"policyHash":{"type":"string","description":"sha256 of the JCS policy."},"requestHash":{"type":"string","description":"sha256 of the JCS request."},"receiptBody":{"type":"object","description":"Exactly what the receipt digest covers."},"receipt":{"type":"object","description":"Standalone receipt: recompute digest from `receiptBody`, then recover the EIP-191 signer and compare with the DID document's attestation key. signature is null when the hub has no attestation key configured.","properties":{"digest":{"type":"string"},"scheme":{"type":"string"},"signature":{"anyOf":[{"type":"string"},{"type":"null"}]},"signer":{"anyOf":[{"type":"string"},{"type":"null"}]}}},"witnesses":{"type":"array","items":{"type":"object","properties":{"ruleId":{"type":"string"},"detail":{"type":"string"},"path":{"type":"string","description":"JSON pointer or dotted path into the input."},"offset":{"type":"integer"},"index":{"type":"integer"},"expected":{"description":"What the rule required."},"actual":{"description":"What the input had."}}}},"versions":{"type":"object","description":"Every semantic dependency of this answer (engine, tables and their as-of dates, tokenizer, calendar, rounding profile)."},"limits":{"type":"array","items":{"type":"string"}},"deterministic":{"type":"boolean","description":"Always true: pure code, no model."}}},"_provenance":{"type":"object","description":"C2PA-aligned manifest and W3C VC 2.0 (eddsa-jcs-2022) issued by the hub DID; verify at POST /api/v1/verify-provenance"}},"required":["data","_provenance"]}}}},"400":{"description":"Invalid request (no payment consumed)","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"},"code":{"type":"string"}}}}}},"401":{"description":"Invalid X-API-KEY","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"},"code":{"type":"string"}}}}}},"402":{"description":"Payment required or invalid","content":{"application/json":{"schema":{"type":"object","description":"x402 v2 PaymentRequired (also base64 in the PAYMENT-REQUIRED header)","properties":{"x402Version":{"type":"integer"},"error":{"type":"string"},"code":{"type":"string"},"resource":{"type":"object"},"accepts":{"type":"array","items":{"type":"object"}},"extensions":{"type":"object"}}}}}},"502":{"description":"Upstream failure; the payment is released or not settled","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"},"code":{"type":"string"}}}}}}}},"links":{"docs":"https://agents.writerslogic.com/docs/policy-gate/","docsJson":"https://agents.writerslogic.com/docs/policy-gate.json","sample":"https://agents.writerslogic.com/api/v1/samples/policy-gate","openapi":"https://agents.writerslogic.com/openapi.json","catalog":"https://agents.writerslogic.com/api/v1/catalog","verifyProvenance":"https://agents.writerslogic.com/api/v1/verify-provenance","index":"https://agents.writerslogic.com/docs/index.json"}}