Agent Control Tower ACT
Allowed Started 2026-11-01 02:00:54 UTC · took 0.6 s

Allowed: the read ran and the gateway's decision is in the audit chain.

invoice-agent for employee-demo-42 · run sbx-allowed-read-03f3c84124

What happened

  1. invoice-agent signed in for employee-demo-42

    The demo issuer signed a short-lived token naming the agent, the employee, and this run; the gateway checks it on every call.

  2. Tools the gateway lets it see

    get_invoice_tool, list_documents_client_a

  3. Read INV-1001

    Total 1,200.00

  4. Gateway decision recorded: allowed

    FIN-READ-001 v1 · revision 595f4c6d39ef · chained as event 2