Merchant not on the allowlist
Agent payment to a merchant not on the allowlist
research-agent-01 tries to buy a 0.50 report from another shop on the same site, whose payee address is not on the tenant's merchant allowlist. The amount is within limits, but PolicyGate answers 403 spend.merchant_not_allowed and signs nothing.
Defaults: iss = http://localhost/tst-issuer, aud = edge, exp = now+1h, kid = tester-rs256
An agent tries to pay a seller the company never approved. The amount is small, but the payee is unknown, so PolicyGate refuses and records why. Test network: no real money.
Test network — no real money. A simulated network (eip155:31337) and a test token (USDC-TEST); the merchant settles in memory, nothing is sent to a blockchain.
Execute scenario
The agent asks the merchant, gets a 402, asks PolicyGate to sign, and on an allow retries the merchant with the signature. Runs on the server: the agent's token and the full signature never reach your browser.
Proves payments go only to approved payees: a merchant binds its payee addresses to its origin, and any other payee is refused and recorded.