A cryptographically valid payment can still be unauthorized. x402Shield exists to make the authorization decision — deterministically, before a signing key is used — and to keep evidence of it afterwards. This page covers how that decision is structured and how it has been tested.
The gateway reaches an authorization decision but holds no signing key. A separate authorization issuer mints a signed permit only against a durably committed authorization record. A separate external payment signer verifies that permit and re-verifies the exact transaction before producing an EIP-3009 signature. Compromising any single one of these is not sufficient to move money.
Authorization is bound to the exact request it was issued for — recipient, amount, network and exact asset contract all enter the request-binding digest. A mutated or substituted field breaks the binding and the decision resolves to DENY before signing.
Authorization decisions are deterministic and auditable. No LLM sits in the decision path. Delegated authority, allowed recipients, exact asset and network, per-payment and session budgets, approval thresholds and replay state are all evaluated as deterministic checks; each produces a bounded reason code.
The validation campaign repeatedly found and closed real distributed-systems and isolation defects before launch. These are controlled results, not an SLA.
| # | Test | Status | Workload | Result |
|---|---|---|---|---|
| 01 | Multi-Tenant Isolation | PASS | 1,000,000 adversarial HTTP requests | 0 cross-tenant isolation violations |
| 02 | Approval Concurrency | PASS | 100,000 concurrent approval-resume attempts | Exactly one valid consumption |
| 03 | Replay Protection | PASS | 1,000,000 replay attempts | 0 duplicate replay acceptance |
| 04 | Multi-Replica Identity | PASS | Restart cycles + concurrency sweep to 1,000 | 0 internal identifier collisions |
| 05 | Trust-Boundary Closure | PASS | 52 real separate-process boundary assertions | 52 / 52 checks pass, including delegation, permit and evidence integrity |
| 06 | Broker Failure Recovery | IN PROGRESS | Real broker outage/recovery under live traffic | Results publish on completion |