# Authorize-Before-Mutate Protocol (ABMP)

**Status:** LIVE · **Reference:** [SQLGuard](https://sqlguard.io) · Machine: [`/protocol`](https://sqlguard.io/protocol)

## Axiom

No autonomous agent may mutate production state without a cryptographically verifiable authorize artifact issued by an external sandbox attestor.

Lint is not authorization. Model confidence is not authorization. EXPLAIN alone is not authorization.

## Normative (MUST)

1. Fail closed on mutating SQL without a PASS attestation.
2. Verify the attestation signature before execute.
3. Deny DROP / TRUNCATE by default unless an explicit policy pack allows them.
4. Use a non-self payer when smoke-testing the payment path.

## Compliance loops (SQLGuard)

**Handshake:** ask what you need — [`/handshake`](https://sqlguard.io/handshake) · MCP `sqlguard_handshake`

```
POST /v1/cert  →  settle Exact USDC $0.05  →  POST /v1/verify  →  execute locally
```

### Mandate Bind (ABMP 2.5) — Intent text hashed into the cert

```
POST /v1/bind { mandate, schema_ddl, sql } → settle Exact $0.07 → POST /v1/gate → execute
```

`mandate_hash` is cryptographic binding of the bytes you sent — not KYC or legal review of the human. See [/disclaimer](https://sqlguard.io/disclaimer).

### Session loop (ABMP 2.0) — burst writes

```
POST /v1/session → settle Exact $0.20 → session_token
POST /v1/session/cert (+ X-SQLGuard-Session) × N → POST /v1/verify → execute
```

### Portable check (free)

```
POST /v1/gate { certificate, signature, sql, mandate? } → ok → execute
```

Embed: [`/require`](https://sqlguard.io/require) · Liability brief: [`/pain`](https://sqlguard.io/pain) · Discovery prover: [`/v1/effects`](https://sqlguard.io/v1/effects) · Legal: [`/legal`](https://sqlguard.io/legal)

## Roadmap

| Version | Capability |
|---------|------------|
| **1.0** | Instant Cert + verify + fail-closed require (LIVE) |
| **1.1** | Progressive ladder cert → micro → starter (LIVE) |
| **1.2** | Settle≠discovery effects prover (LIVE) |
| **2.0** | Session certificates (`POST /v1/session` → `/v1/session/cert`) (LIVE) |
| **2.5** | Mandate Bind + free authorize bus `POST /v1/gate` (LIVE) |
| **2.1** | PLANNED — Multi-agent attestation chains |
| **2.2** | PLANNED — Optional on-chain attestation receipts on Base |
| **3.0** | LIVE (lite) via `/v1/gate`; fuller cross-tool bus PLANNED |

## Adoption

- **Agent runtimes:** `GET /require` — block SQL write tools until PASS + verify/gate.
- **x402 sellers:** keep `extensions.bazaar` on settle payloads (facilitators index after successful settle; see Bazaar docs / x402#2911).
- **Operators:** demand PASS certificates in incident reviews; reject lint-as-authorize.

Fail-closed agents. Paid authorize where it matters. Signed proof before mutate.