Control Demo

Protect by default. Choose your economic policy.

All non-PUBLIC routes have Default Protection — cryptographic verification, caveats, delegation, revocation. Then choose your economic policy: observe (audit), control (budget), or charge (payments).

Protection is the starting state. Economics are configurable.

Default Protection

Layer 0 — Always-On Cryptographic Verification

Default Protection is the foundation of SatGate's security model. Every request is cryptographically verified — signatures, caveats, delegation chains. You can't turn this off. Then you choose your economic policy: observe, control, or charge.

CISO Role

Issues root credentials. Retains authority. Can revoke instantly.

Agent Role

Uses tokens. Can delegate restricted sub-tokens offline.

Worker Role

Receives delegated tokens. Cannot escalate beyond granted scope.

What You'll See:

  • ✓ Stateless credential issuance (no database)
  • ✓ Instant cryptographic validation
  • ✓ Offline token delegation (zero network calls)
  • ✓ Mathematical scope enforcement
Live Demo Output
Waiting for demo action...

This demo runs against the live SatGate OSS deployment on Railway.

View Source on GitHub →Try Pay Mode →