Authorize first.
Prove everything.

Counterroll puts a deny-by-default policy gate between every AI agent and every x402 payment. It evaluates each request against your policy, fails closed on anything it cannot safely evaluate, and returns a signed, hash-chained receipt for every policy-evaluable decision — before settlement. x402 today, running live on Base; a rail-neutral evidence model designed for what comes next.

import { Counterroll, usdc } from '@counterroll/sdk';

// Public sandbox: one published key, bundled demo agents, a live URL.
const cr = new Counterroll({ apiKey: 'qm_sandbox_publicdemo_v1' });

const ok = await cr.check({ agent: 'research-bot', to: 'openai', amount: usdc(1) });
const no = await cr.check({ agent: 'research-bot', to: 'openai', amount: usdc(500) });

console.log(ok.approved, no.reasons); // true  ['per_tx_cap_exceeded']
console.log(no.receipt!.hash);        // signed + hash-chained — verify it yourself

Autonomy without ungoverned spend

A wallet limit can cap an amount. Counterroll records which agent asked, which policy was applied, why the decision was made, and whether the evidence still verifies later.

check → receipt → chain → verify

1 · check()

Your agent asks first. One call carries the payee, amount, network, and asset of the x402 payment it wants to make. Deny by default: no matching policy, an ambiguous rule, or a malformed payload all come back DENY. Nothing approves on an error path.

2 · signed receipt

Every policy-evaluable decision returns an attestation signed with your org's Ed25519 key, carrying the exact policy snapshot it was evaluated against. Unknown agents, malformed payloads, and replayed nonces fail closed and are recorded separately because they cannot be represented safely on the chain.

3 · hash chain

Each receipt stores the SHA-256 of the one before it, and the ledger is append-only — enforced in code, in review, and by a Postgres trigger that raises on UPDATE or DELETE. History can be extended, never edited.

4 · verify yourself

qm.verify({ publicKey }) pulls the raw rows and re-derives the entire chain locally: every hash recomputed, every signature checked against a key you pinned out-of-band. An attacker who rewrote the database and re-signed it with a fresh key passes the server's own check — and fails yours.

{
  "decision": "APPROVE",
  "denyReasons": [],
  "attestation": {
    "id": "att_29240a122a59b0c63e0749d16008ded9",
    "organizationId": "org_sandbox",
    "seq": "1",
    "agentId": "research-bot",
    "policyId": "policy_sandbox_research",
    "decision": "APPROVE",
    "payTo": "openai",
    "amount": "1000000",
    "network": "eip155:8453",
    "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
    "policySnapshot": { "perTxCap": "5000000", "windowCap": null, … },
    "requirements": { … },
    "eip3009Nonce": "c31d1ab50d697dd6b7a1973632ca2a93d8e247fa442e830fef57d7c1b4bfcac6",
    "payloadSha256": "53e3bc4b0d3735baf9d8e1ab3642bfbc4626366b68d23fa543246cbef575c56b",
    "prevHash": "GENESIS",
    "hash": "e0c9a5964716f7b6a0cb71e6275601e4a00524bc43d40a15e6dbc547d9c15082",
    "signature": "23106faca39847ab2b2cec5c3f428760214b42e395754d3ebf576189d258ff83926059aeb7515ea5c18a0d4b85c45c9e0383191f42faf0c3c38b78a9544f0109",
    "createdAt": "2026-07-18T22:16:00.214Z"
  }
}

{
  "decision": "DENY",
  "denyReasons": ["per_tx_cap_exceeded"],
  "attestation": {
    "id": "att_abbfe9ca99df62898d204f1c520ac181",
    "organizationId": "org_sandbox",
    "seq": "2",
    "agentId": "research-bot",
    "policyId": "policy_sandbox_research",
    "decision": "DENY",
    "payTo": "openai",
    "amount": "500000000",
    "network": "eip155:8453",
    "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
    "policySnapshot": { "perTxCap": "5000000", "windowCap": null, … },
    "requirements": { … },
    "eip3009Nonce": "9641901101b3259d4145bd6a594571bd45543051aa2585d1a0fd9755584b43b3",
    "payloadSha256": "9954c6456edcc97c62984f3c425de8d7fb50daa495c845553e29484757596e95",
    "prevHash": "e0c9a5964716f7b6a0cb71e6275601e4a00524bc43d40a15e6dbc547d9c15082",
    "hash": "dbf1b4efee0ff1baf6e76dce561627452f25affecae65d1735fc2ae0eb97c616",
    "signature": "c71dc37a66c2b7f933710bf452e41e72b2210d466b69b3eefaabcf84f9830610a07f75b98511feecd0a42545ec86da929c916752d15ffb518755013b2b8e2903",
    "createdAt": "2026-07-18T22:16:00.670Z"
  }
}

Rows 1 and 2 of Counterroll's live public sandbox chain (org_sandbox), pulled read-only from the deployed API on 2026-07-23. Every hash and signature is real: the DENY's prevHash is the APPROVE's hash, and both signatures verify against the org's published anchor e9d3619e…b6d1. Run qm.verify({ publicKey }) to re-derive the whole chain yourself against that key — 132 signed rows the day this was captured, and append-only since. Note what the deny costs you: nothing moved, and you still got a receipt.

Prove it in production. Then distribute it.

The SDK is public and self-serve — start there. Beyond it, Counterroll supports two focused partner paths: teams putting one governed payment flow into production, and platforms embedding the same independent control across many customers. Both begin with a real integration surface—not a generic AI demo.

Built for the questions that follow an incident.

We audit Counterroll the way an attacker would, before each layer ships. Two findings from those audits shaped the architecture. Both are in the git history.

A tamper-evident ledger is only as good as the code that writes to it. The audits continue; the relevant fixes, tests, and threat-model decisions are available during technical diligence.

The system that authorizes should not be the only system you must trust.

Counterroll moves no money: v1 authorizes, attests, and records, and settlement is proxied to whichever x402 facilitator you configure. A governance layer is only credible if it can say no to the rail itself — so it is built to be checked without trusting us.

No trust required: qm.verify({ publicKey }) re-derives every hash and signature locally against a key you pin out-of-band — e9d3619e…b6d1 for the public sandbox. A rewritten, re-signed database passes our server's own check and fails yours.