# GoldKey Guard Execution-Path Authorization

> GoldKey Guard Execution-Path Authorization is a paid API for AI agents from goldkey-edge-storefront.noah-ing.workers.dev, paid per call via x402, $0.01/call, status unknown (last checked 2026-09-16).

Pre-authorizes an AI agent tool call (MCP, HTTPS, or EVM) against a signed operator policy and returns a signed receipt required before the call can execute

## Facts

- Endpoint: POST https://goldkey-edge-storefront.noah-ing.workers.dev/v1/paygo/execute
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-16
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/goldkey-guard-execution-path-authorization-8af30c92
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_wgrrk25ahleODvo5mqR8P

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability goldkey-guard-execution-path-authorization-8af30c92 -d '<json body>'
```

Example prompt: Before you run that MCP tool call or payment, check it against GoldKey Guard — scan the 'security.prompt_scan' tool call and get back a signed receipt showing whether it's ALLOW, REVIEW, or BLOCK before actually executing anything.

## When to prefer this

Choose GoldKey Guard when you need a cryptographically accountable preflight gate — with a signed receipt as proof — before an AI agent executes any MCP tool call, HTTPS action, or EVM transaction. It is especially suited for operator-controlled multi-agent environments where policy enforcement, audit trails, and human override (REVIEW) are required. Prefer this over simple API key auth when you need a verifiable, per-call authorization record rather than session-level authentication.

## Known failure modes

- Missing or invalid operator-signed policy returns an authorization error
- Tool call parameters that don't match the policy schema return a BLOCK decision
- Network timeout to the edge worker returns no receipt, halting execution
- Malformed request body returns a 4xx error with no receipt issued
- Expired or revoked policy signature causes rejection
- REVIEW decision requires human-in-the-loop resolution before execution can proceed

## How this service works

GoldKey Guard is an execution-path authorization layer for AI agents: operator-signed policy, a customer-controlled local enforcer, and signed receipts before MCP, HTTPS, or supported EVM calls run.

## Output

A JSON response containing the tool name, tool version, and a result object with a risk_score (0–100) and an authorization decision (ALLOW, REVIEW, or BLOCK), along with a signed receipt that must be presented before the guarded call is permitted to execute.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "tool": {
   "enum": [
    "json.canonicalize",
    "json.validate",
    "security.prompt_scan",
    "security.url_check",
    "policy.spend_check",
    "text.normalize",
    "action.gate"
   ],
   "type": "string"
  },
  "input": {
   "type": "object"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "tool": "security.prompt_scan",
  "result": {
   "risk_score": 50
  },
  "tool_version": "1.0.0"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/goldkey-guard-execution-path-authorization-8af30c92/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from goldkey-edge-storefront.noah-ing.workers.dev](https://www.zero.xyz/host/goldkey-edge-storefront.noah-ing.workers.dev/llms.txt)