Three actions, three correct outcomes — the test any agent governance system should be able to demonstrate.

What happens. The gate evaluates identity, mission scope, tool permission and autonomy budget. email_transmit is not in the granted set. The action is refused before execution and a signed refusal receipt is emitted naming the policy version and the check that denied it.

Why it matters. Most systems record what succeeded. A record containing only successes is not a record — and "show me an action that was refused" is the question most estates cannot answer.

What happens. The approval is bound to the hash of that exact payload, marked single-use, and given an expiry. Then three variations are tried: the original payload executes once. A modified payload is refused — the hash no longer matches. The same approval used twice is refused — already consumed. An expired approval is refused — past its window.

Why it matters. An approval that survives a payload change is a rubber stamp with a longer shelf life. Binding is what makes human oversight a control rather than a ritual.

What happens. Chain verification fails. Because each receipt carries the hash of the previous one and of itself, the alteration breaks the chain, and verification reports exactly which link broke.

Why it matters. This is the difference between an audit log and an execution receipt. A log line can be edited without trace. A chained receipt cannot be edited unnoticed — which is the whole reason it counts as evidence.

SYNTHETIC  This walkthrough describes the mechanism using illustrative data, not a recording of a production incident. The structures are real and published — sample execution receipt, sample agent passport, full schema — and every field shown maps to a field in that schema.

Labelling this synthetic costs us a more impressive page. It is also the only version of this page a trust vendor can honestly publish, and a buyer who checks will find the label rather than the omission.