{"document":"agent-reserve-authority-gateway-reference","version":"0.2.0","status":"in_process_reference_model","agentFacingSurface":["requestAuthorization","requestProtectedHandoff"],"protectedPaymentToolExposed":false,"policyControlledByAgent":false,"controls":["owner_policy_outside_request","scoped_agent_identity","vendor_allow_and_block_lists","evidence_gate","atomic_budget_reservation","nonce_replay_rejection","unforgeable_in_process_capability_brand","single_use_handoff"],"boundaries":{"realIdentity":false,"productionIsolation":false,"persistentLedger":false,"cryptographicSignature":false,"walletAccess":false,"paymentExecution":false,"fundsHeld":false,"humanConfirmationRequired":true},"vectors":[{"id":"AG01","purpose":"eligible request reaches only the protected handoff","expected":"single_use_handoff","actual":"single_use_handoff","passed":true},{"id":"AG02","purpose":"direct call without a capability is blocked","expected":"invalid_capability","actual":"invalid_capability","passed":true},{"id":"AG03","purpose":"a consumed capability cannot be replayed","expected":"capability_replay","actual":"capability_replay","passed":true},{"id":"AG04","purpose":"agent-side policy mutation cannot raise the real limit","expected":"per_request_limit","actual":"per_request_limit","passed":true},{"id":"AG05","purpose":"wrong agent cannot self-authorize","expected":"agent_mismatch","actual":"agent_mismatch","passed":true},{"id":"AG06","purpose":"unapproved scope is blocked","expected":"scope_denied","actual":"scope_denied","passed":true},{"id":"AG07","purpose":"blocked vendor is rejected","expected":"blocked_vendor","actual":"blocked_vendor","passed":true},{"id":"AG08","purpose":"unknown vendor requires human review","expected":"unverified_vendor","actual":"unverified_vendor","passed":true},{"id":"AG09","purpose":"missing evidence requires human review","expected":"missing_evidence","actual":"missing_evidence","passed":true},{"id":"AG10","purpose":"reserved spend is included in the daily limit","expected":"daily_limit","actual":"daily_limit","passed":true},{"id":"AG11","purpose":"authorization nonce cannot be reused","expected":"nonce_replay","actual":"nonce_replay","passed":true},{"id":"AG12","purpose":"malformed request fails closed","expected":"invalid_request","actual":"invalid_request","passed":true}],"verification":{"passed":12,"failed":0}}