Bounty Engineer Delegated Agent Scope Gate

Use this endpoint when you need a lightweight, fast policy pre-check before an autonomous agent executes a sensitive tool call, payment, or external API request — especially when you want to enforce scope boundaries defined in a delegation mandate (allowed tools, origins, spend caps) before committing to execution. It is not a substitute for cryptographic signature verification or a trusted identity provider, but it is a useful first-pass gate in an agentic pipeline to catch out-of-scope actions early and generate an audit trail via SHA256 hashes.

• Missing required mandate fields (agent_id, allowed_tools, allowed_origins, issued_at, expires_at, max_spend_usd) cause validation failure
• Action destination_url not in allowed_origins returns policy_match: false
• Tool not in allowed_tools list returns policy_match: false
• Expired mandate (expires_at in the past) fails scope check
• Amount exceeding max_spend_usd triggers policy violation
• authoritative_authorization always false — endpoint explicitly warns it cannot substitute for cryptographic or identity-provider verification
• Malformed JSON body returns HTTP error
• Payment failure (insufficient USDC balance) blocks the call entirely