# SQLGuard Gateway — permission before production writes

**Sell:** AI agents need permission before they modify production data.

**Feature:** Authorization Receipt — `POST /v1/gateway/decide`

```
Agent requests:  UPDATE customers ...
Policy:          sqlguard.change_control.v1
Scope:           UPDATE — customer_status only
Expires:         +10 minutes
Result:          AUTHORIZED
```

**Not selling as headline:** Execution Certificate Firewall · AI-contract platform.

## Buyers

AI startups with DB-connected agents · MCP write-tool builders · companies letting AI read/write customer data.

## Pricing (invoice) — 3 paying companies mission

| Tier | Price | Role |
|------|-------|------|
| Builder | $99/mo | Early |
| **Starter** | **$299/mo** | **Primary close** |
| Company | $499/mo | Multi-seat AI SaaS |
| Production | $1,999/mo | Multi-tenant writes |
| Enterprise | $10k+/yr | Later |

Contact: hello@sqlguard.io

## Install

```bash
SQLGUARD_EXECUTOR_ENABLED=1
SQLGUARD_EXECUTOR_DATABASE_URL=postgres://writer:...@db/app
```

Public host executor stays OFF. Enable on your private deploy.

## API

- `POST /v1/gateway/decide` → Authorization Receipt
- `POST /v1/gate` → verify Ed25519 PASS
- `POST /v1/execute` → Gateway holds DB when enabled

Proof Exact: Workday $2.50 · Session $0.25 — not the wealth path.

Tracker: `team/MISSION-3PAY.md` · 50 AI+DB companies listed → pursue.