Boot the bad ones. When an AI agent shows up to post, buy, or call your API, verify who it is and what it's allowed to do, then admit it or bounce it. Free, drop-in, runs in your own backend.
import { axisGate } from 'axis-platform-sdk/express' app.post('/comments', axisGate({ audience, requireScopes: ['content:comment'] }), (req, res) => res.json({ by: req.axis.agent_id }))
import { aitGate, denialResponse } from 'axis-platform-sdk' const gate = aitGate({ audience, requireScopes: ['content:comment'] }) // in fetch(): const v = await gate(request)
Signature, revocation, and delegation chain, checked by the public registry.
Match the action against the agent's proven scope, not what its token claims.
Block one agent or a whole operator at runtime, with no redeploy.
One outbound HTTPS call. No database, no key from us, nothing to host.