Tollgate — the governance gate for AI agents that move money

Deterministic policy enforcement, human approvals with cryptographic non-repudiation, budget escrow with clawback, and a tamper-evident audit chain — a zero-dependency governance gateway for any agent that touches money. Exposed to any agent as an MCP server.

中文文档

Axiom: the LLM is an untrusted component. It proposes; deterministic code disposes. Every tool call an agent makes passes through the gate — and the gate never guesses.

Why

Teams won't give agents spending authority because three questions have no answer: what exactly can it do? who is accountable? can we audit it afterwards? Tollgate answers all three with a single enforcement point that every tool call must cross:

unknown tool → rate limit → circuit breaker → integrity check → read cache
→ accountability → blacklist → budget reserve → field-semantics contract
→ injection fence → financial guardrails → adaptive risk score
→ policy rules (with business-calendar context) → authenticated approval
→ execution → hash-chained audit

Denial reasons flow back to the model so it can adapt. Anything that isn't explicitly allowed is denied — and that default is measured, not assumed (see Red team).

60-second demo

git clone https://github.com/kkU1444/agent-governance-gateway.git && cd agent-governance-gateway
python -m tollgate demo-web        # no API key needed
# open http://127.0.0.1:8765 — approve the $4,200 transfer in the browser

A travel agent runs a 15-step adversarial scenario: read-only calls pass, external email is blocked, a replayed payment is caught, a negative amount is rejected, an unregistered agent is refused, an unknown payee forces human sign-off, and an over-limit transfer hits a hard cap. Then the ops team freezes and claws back a fraudulent transfer, and the payee lands on a blocklist.

The money lifecycle

Approving a transfer is not the same as money leaving the building:

reserve (atomic, concurrency-safe) → human approval → execution
→ holding period (24h, funds in escrow, reversible)
→ settle | freeze → recover (clawback) → payee blacklist (permanent escalation)

Budget pools use BEGIN IMMEDIATE critical sections so concurrent agents see "occupied", not a stale balance. Clawbacks are two-step (freeze, then recover), each with operator identity and reason written into the audit chain.

Security architecture

Policy files hot-reload on change; every reload lands in the chain as a policy.reload entry (old hash → new hash), so changes to the law itself are auditable.

Learning loop: attacks are auto-recorded into an intel base, replayed on every change (tollgate drill), and live samples merge into the red-team corpus (tollgate redteam) — real attacks become permanent regression tests.

Red team

$ python -m tollgate redteam
恶意样本拦截: 32/32 (召回率 100%)      injection corpus: 32/32 blocked
良性样本误报: 0/8 (误报率 0%)          false positives: 0/8
策略不变量模糊测试: 300 例,四条不变量全部成立   300 fuzz cases, all invariants hold

Four fuzz invariants: the governance layer never crashes; execution is fail-closed (actual executions ≡ audited executions); the hash chain survives any input sequence; same seed reproduces exactly. THREAT_MODEL.md maps mechanisms to STRIDE, OWASP Agentic AI threats and MITRE ATLAS, and keeps an honest residual-risk list.

MCP server

python -m tollgate mcp          # stdio JSON-RPC 2.0, zero dependencies

Point any MCP client (Claude Desktop, Cursor, your own agent) at it — every tool call crosses the full enforcement chain. Policy denials come back as isError tool results with reasons, so the calling model can adapt.

Install

Python ≥ 3.10, zero mandatory dependencies (a bundled YAML-subset parser is used unless PyYAML is installed):

pip install tollgate-gateway # PyPI (import / CLI name stays `tollgate`)
pip install -e .             # or from this repository
tollgate demo                # or: python -m tollgate demo

CLI surface

Docs

• 威胁模型 / Threat model — trust boundaries, STRIDE mapping, residual risks
• 中文文档

Roadmap

• Ed25519 for terminal approvals & settlement ops (web approvals done)
• Pluggable storage (Postgres) for multi-instance deployments
• Delegation chains (agent acting on behalf of a department)
• Policy-change approval workflow (policy as a first-class audited asset)

Contributing & security

See CONTRIBUTING.md. Security issues: follow SECURITY.md — please do not open public issues for vulnerabilities.

License

Apache-2.0