A self-storage tenant chats with the facility's AI bot and tries a prompt injection. The bot drafts the tool calls it was told to make. AgentGuard evaluates each call before it runs against the operator's policy, storage-bot-v1: fee waivers and credits above $0 wait for a manager, money movement stops at a $500 daily cap, gate codes need a capability the bot does not hold, and outbound calls stay inside the calling window the operator set. Every decision becomes a hash-chained record signed by a key generated in this tab.
waive_fee 50.00 and apply_credit 100.00. Each one goes through AgentGuard before it runs. Press the actions below to run them.Press play. As the call runs, each drafted action goes through the gate below: the $50.00 waiver is held for a manager, who approves it; the $1,122.41 credit to the card blocks on the daily cap; the 9:15 PM collections call blocks on the calling window. Every decision writes a real signed record in the log.
The calling window is the operator's setting in storage-bot-v1, not legal advice. For reference, the federal window for telemarketing calls is 8 AM to 9 PM in the called party's local time, and Florida, Oklahoma and Washington set 8 PM.
The simulation and the signing run in your browser. The inline demo code does not transmit its action metadata or private key. It loads cryptographic modules from jsDelivr and fonts from Google. If you click “Verify chain on /verify,” the signed chain and public key are placed in the AgentGuard URL for a separate browser verification; the private key is not. The record shows what the policy permitted, escalated or blocked for simulated metadata; it does not show that a fee was waived, a call was placed or a manager existed. AgentGuard ships today as a plugin for coding agents (Claude Code and Codex). The same gate is offered to software vendors as a hosted API that sees only metadata: action type, amount, local time and a capability claim. Never the tenant's words, account or card.
The policy sets auto-approve at $0 for fee waivers and credits, so the bot's $50.00 waiver became an ESCALATE record and a manager card. Approve or Deny writes a second record that names the outcome. Nothing moved until a human said so.
A $1,122.41 refund blocks on the $500 daily cap, a gate-code change blocks because the bot never held that capability, and a 9:15 PM call blocks on the calling window. Each block is hashed, chained and signed like an allow.
Every record has a “Verify chain on /verify” link that re-checks the signatures and every previousHash link on a separate page, a copy button for your own terminal, and a tamper test that edits one field and shows the hash break.
A recorded run of this page: the $50.00 waiver escalates and a manager approves it, the $1,122.41 refund blocks on the daily cap, the 9:15 PM collections call blocks on the calling window, and the signed chain verifies on a separate page.
If your voice, SMS or property-management software drives an agent that can waive fees, issue credits, change gate codes or call tenants, this gate sits between the agent and your APIs. It sees only metadata and writes a signed record of every decision your customer's policy made. The hosted API behind this page is live today: the request shape, a sample policy with money and calling-window rules, and the one-tap approval flow are on the vendor page.
Tell us what your agent does for an operator. We reply with a starting policy written for it.