14-payment-allowed

Agent pays within policy

Agent payment within policy: 0.50 USDC-TEST to an approved merchant

research-agent-01 asks the mock merchant for a report and gets HTTP 402 with an x402 v2 PAYMENT-REQUIRED (0.50 USDC-TEST on the test network eip155:31337). It sends that to POST /v1/payments/sign through the edge. The amount is under the 1.00 per-payment cap and the daily budget, and the payee is on the merchant allowlist, so PolicyGate signs an EIP-3009 authorization. The agent retries with PAYMENT-SIGNATURE; the merchant verifies it and delivers.

paymentsallowevidence
FIXTURE
tenant_id"northwind-finance"
home_region"tst"
scopes
payments:sign
sub"agent:research-agent-01"
agent_id"research-agent-01"

Defaults: iss = http://localhost/tst-issuer, aud = edge, exp = now+1h, kid = tester-rs256

EXPECTED OUTCOME
POLICYGATE DECISIONallow · 200
SIGNATUREsigned by PolicyGate
MERCHANTverifies, delivers · 200
EVIDENCEpayment.sign, signed
What this demonstrates

An AI agent buys a 0.50 report from an approved merchant, within its limits. PolicyGate holds the payment key, signs this one payment, and records a signed decision an auditor can match to the payment. Test network: no real money.

Spend controlsAudit trail of payments

Test network — no real money. A simulated network (eip155:31337) and a test token (USDC-TEST); the merchant settles in memory, nothing is sent to a blockchain.

RUNNER

Execute scenario

The agent asks the merchant, gets a 402, asks PolicyGate to sign, and on an allow retries the merchant with the signature. Runs on the server: the agent's token and the full signature never reach your browser.

WHY THIS MATTERS

Proves the allowed path end to end: the agent never holds a payment key, PolicyGate signs only after a policy allow, the signed decision is evidence, and the merchant accepts the signature.