Which tool or route?
The tool or route the agent called.
For example, a tool name on an MCP server or a path on your API.
Sample signed receipt
Who allowed what?
This sample shows a planned audit view of one workflow. Today a real Evidence Pack holds one signed receipt, which shows the tool or route, the decision and a refusal code.
Summary
- Receipt
- ep_demo_2026_05_10_001
- Budget
- 30 / 30 credits spent
- 0 left after the budget ran out and requests were refused.
What a receipt tells you
What a real receipt shows.
What did SatGate decide?
Whether SatGate allowed the call or refused it.
With the time SatGate decided.
Why was it refused?
A refusal code, such as budget_exhausted.
Other codes cover a missing payment or a tool the agent may not use.
What did it cost?
The amount checked and the budget left.
On calls that spend from a budget.
Which token?
A hash of the token used, on calls that spend from a budget.
The raw token is blanked out.
Who signed it?
SatGate, with a key anyone can check against SatGate’s published keys.
The agent never writes or edits its own record.
Token chain
Main agent → sub-agent with a narrower token.
The sub-agent's token allows less than the main agent's: fewer permissions, a smaller budget, no customer-data export and no further handoffs.
Step 1: root_grant
Finance automation
Allowed
invoices:read, invoices:search, mcp:invoice-tools, mcp:document-ai
Budget limit
100 credits
Step 2: delegation
Invoice reconciler worker
Allowed
invoices:read, invoices:search, mcp:document-ai.ocr
Budget limit
30 credits
Receipt timeline
Signed receipts for budget spends and for refusals over a budget, a missing payment or a tool permission.
#3 · 14:23:18
rcpt_demo_003
spend
call_mcp_tool
mcp:invoices.search
dec_demo_invoice_policy_v7
allowed
#4 · 14:24:02
rcpt_demo_004
spend
call_api_route
/v1/invoices/compare
dec_demo_invoice_policy_v7
allowed
#5 · 14:24:44
rcpt_demo_005
spend
call_paid_tool
mcp:document_ai.ocr
dec_demo_invoice_policy_v7
allowed
#6 · 14:25:08
rcpt_demo_006
denial
call_api_route
/v1/invoices/export
policy_denied
denied
#7 · 14:25:33
rcpt_demo_007
denial
call_api_route
/v1/invoices/reconcile
budget_exhausted
denied
Payments
Not tied to one payment method.
This sample records spending from an internal budget and one paid call to a document-AI service over x402. The payment shows money moved. The receipt shows the sub-agent was allowed to spend it.
Signature
How the export is signed.
- JSON format signed
- RFC8785-JCS
- Hash algorithm
- sha256
- Signature
- ed25519:REDACTED_DEMO_SAMPLE_DO_NOT_VERIFY
- Note
- This sample uses placeholder hashes and a placeholder signature, so it won't pass the verifier. Real exports are signed. Check a real one.
In short