Agent Control Tower ACT
Sandbox · fictional data

Sandbox

Change an invoice without a grant

The Invoice Agent tries to change INV-1001's total. Its write grant is observe-only, so the gateway refuses and the invoice stays as it was.

Denied Started 2026-11-01 02:00:54 UTC · took 1.1 s

Denied: the write never reached the ERP, and the invoice is unchanged.

invoice-agent for employee-demo-42 · run sbx-denied-write-0c4cd7fb63

What happened

  1. invoice-agent signed in for employee-demo-42

    The demo issuer signed a short-lived token naming the agent, the employee, and this run; the gateway checks it on every call.

  2. Tools the gateway lets it see

    get_invoice_tool, list_documents_client_a

  3. Read INV-1001

    Total 1,200.00

  4. Tried to set the total to 9,999.00

    Refused by the gateway: the write grant only observes.

  5. Read INV-1001 again

    Total 1,200.00, unchanged

  6. Gateway decision recorded: denied

    ACT-DEFAULT-DENY v1 · revision 595f4c6d39ef · chained as event 6

Open the run timeline Run another scenario