Built a demo where an agent can provision 2 GPUs, then gets hard-blocked on the 3rd call

Policy:

- budget = 1000

- each `provision_gpu(a100)` call = 500

Result:

- call 1 -> ALLOW

- call 2 -> ALLOW

- call 3 -> DENY (`BUDGET_EXCEEDED`)

Key point: the 3rd tool call is denied before execution. The tool never runs.

Also emits:

- authorization artifacts

- hash-chained audit events

- verification envelope

- strict offline verification: `verifyEnvelope() => ok`

Feels like this is the missing layer for side-effecting agents:

proposal -> authorization -> execution

rather than agent -> tool directly.

Are you doing execution-time authorization, or mostly relying on approvals / retries / sandboxing.

Happy to share the exact output / demo flow if useful.