Authority before x402 settlement.
Cloudflare-style x402 gateways can verify payment at the edge. TaskHawk Authority Rails verifies whether the autonomous requester had bounded authority before money moves, a tool runs, a dataset is consumed, or the origin releases protected work.
What each layer proves
| x402 gateway | Payment challenge, credential verification, and settlement enforcement. |
|---|---|
| TaskHawk Authority Rails | Delegated authority, spend cap, rail scope, obligation binding, nonce, expiry, and signed evidence. |
| Origin or tool host | Local release decision after authority, payment, and account policy clear. |
Reference flow
- An agent requests a monetized API, page, dataset, or MCP tool.
- The gateway or origin asks TaskHawk to clear authority for the exact obligation.
- Kevros returns ALLOW, CONSTRAIN, or DENY with a signed authority receipt.
- If authority clears, the gateway continues to x402 payment verification.
- The origin receives the authority receipt plus any required payment receipt before release.
Boundary language
This page does not claim Cloudflare acceptance, endorsement, partnership, settlement, or TaskHawk revenue. Payment challenge traffic is not revenue. Settlement requires rail-specific receipt evidence. Delegation / Protocol 427 is a public Internet-Draft family, not an adopted IETF standard.
Pilot
A 30-day authority-clearing pilot can cover one paid API, dataset, or MCP tool. The output is a working pre-payment authority path plus an evidence packet that separates authority, settlement, execution, and revenue.