# GoldKey Action Gate — AI Agent Preflight Authorization

> GoldKey Action Gate — AI Agent Preflight Authorization is a paid API for AI agents from goldkey-edge-storefront.noah-ing.workers.dev, paid per call via x402, $0.01/call, status unknown (last checked 2026-09-15).

Performs a deterministic preflight security check on proposed AI agent actions (tool calls, payments, fetches, writes, executions), returning ALLOW, REVIEW, or BLOCK with reason codes and reproducible SHA-256 hashes before any action is executed.

## Facts

- Endpoint: POST https://goldkey-edge-storefront.noah-ing.workers.dev/v1/action-gate
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/goldkey-action-gate-ai-agent-preflight-authorization-33ffe90d
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_tdVcDcFB2WPzO9yY-9I3e

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability goldkey-action-gate-ai-agent-preflight-authorization-33ffe90d -d '<json body>'
```

Example prompt: Before my agent executes this tool call to fetch https://internal-api.example.com and write the result to the database with a $5 spend, run a GoldKey preflight check to screen it for prompt injection, hidden Unicode, SSRF risks, and spend limit compliance — give me ALLOW, REVIEW, or BLOCK with reason codes.

## When to prefer this

Choose this endpoint when you need a single, deterministic, low-cost ($0.01) preflight gate that combines multiple safety checks (prompt injection, hidden Unicode, SSRF, payload validation, spend enforcement) into one atomic request before any consequential agent action. Prefer it over ad-hoc checks when you need reproducible SHA-256 audit hashes, stable reason codes for logging, and a clear ALLOW/REVIEW/BLOCK signal — especially in MCP/tool-call pipelines, agentic payment flows, or any workflow where you want to intercept unsafe actions without executing them.

## Known failure modes

- Missing or malformed JSON payload returns a validation error
- Payment of $0.01 USDC not included or rejected results in 402 Payment Required
- URL check returns 'not_provided' if no URL is submitted, bypassing that check
- Overly broad or missing JSON Schema causes payload check to pass vacuously
- Network timeout on the Workers edge may cause transient 5xx errors
- Spend amount not specified means spend mandate check cannot be enforced

## How this service works

GoldKey Guard is an execution-path authorization layer for AI agents: operator-signed policy, a customer-controlled local enforcer, and signed receipts before MCP, HTTPS, or supported EVM calls run.

## Output

A JSON object containing a top-level decision (ALLOW, REVIEW, or BLOCK), an array of reason_codes explaining any flags, per-check status objects for url, spend, action, prompt, and payload checks, a request_sha256 fingerprinting the input, a receipt_sha256 for auditability, and the tool_version. The hashes are deterministic and reproducible but are not cryptographic signatures.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "url": {
   "type": "string",
   "maxLength": 4096,
   "description": "Optional absolute URL for static scheme, credential, port, hostname, and direct-IP screening. No DNS lookup or fetch occurs."
  },
  "spend": {
   "type": "object",
   "required": [
    "proposal",
    "mandate",
    "now"
   ],
   "properties": {
    "now": {
     "type": "string",
     "format": "date-time",
     "description": "Required caller-supplied ISO 8601 evaluation time; Action Gate never reads the server clock."
    },
    "mandate": {
     "type": "object",
     "required": [
      "max_per_tx_atomic",
      "max_period_atomic",
      "allowed_assets",
      "expires_at"
     ],
     "properties": {
      "expires_at": {
       "type": "string",
       "format": "date-time",
       "description": "Mandate expiry as an ISO 8601 date-time."
      },
      "allowed_assets": {
       "type": "array",
       "items": {
        "type": "string",
        "maxLength": 256,
        "minLength": 1
       },
       "maxItems": 100,
       "minItems": 1,
       "uniqueItems": true
      },
      "max_per_tx_atomic": {
       "type": "string",
       "pattern": "^(0|[1-9]\\d*)$",
       "maxLength": 78,
       "minLength": 1,
       "description": "Per-transaction cap as a canonical atomic-unit integer string."
      },
      "max_period_atomic": {
       "type": "string",
       "pattern": "^(0|[1-9]\\d*)$",
       "maxLength": 78,
       "minLength": 1,
       "description": "Period cap as a canonical atomic-unit integer string."
      },
      "spent_period_atomic": {
       "type": "string",
       "pattern": "^(0|[1-9]\\d*)$",
       "maxLength": 78,
       "minLength": 1,
       "description": "Optional already-spent amount in the same period; defaults to zero."
      },
      "allowed_counterparties": {
       "type": "array",
       "items": {
        "type": "string",
        "maxLength": 256,
        "minLength": 1
       },
       "maxItems": 100,
       "uniqueItems": true
      }
     },
     "additionalProperties": false
    },
    "proposal": {
     "type": "object",
     "required": [
      "amount_atomic",
      "asset",
      "counterparty"
     ],
     "properties": {
      "asset": {
       "type": "string",
       "maxLength": 256,
       "minLength": 1,
       "description": "Exact asset identifier compared with mandate.allowed_assets."
      },
      "counterparty": {
       "type": "string",
       "maxLength": 256,
       "
… (truncated)
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "tool": "action.gate",
  "result": {
   "checks": {
    "url": {
     "status": "not_provided"
    },
    "spend": {
     "status": "pass"
    },
    "action": {
     "status": "pass"
    },
    "prompt": {
     "status": "pass"
    },
    "payload": {
     "status": "pass"
    }
   },
   "decision": "ALLOW",
   "reason_codes": [],
   "receipt_format": "goldkey-action-gate-v1",
   "receipt_sha256": "0000000000000000000000000000000000000000000000000000000000000000",
   "request_sha256": "0000000000000000000000000000000000000000000000000000000000000000"
  },
  "tool_version": "1.0.0"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/goldkey-action-gate-ai-agent-preflight-authorization-33ffe90d/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from goldkey-edge-storefront.noah-ing.workers.dev](https://www.zero.xyz/host/goldkey-edge-storefront.noah-ing.workers.dev/llms.txt)