Out of the box
Spend governance. Built in.
A rule machine for agent purchases. Policy, identity, isolation, one-time cards, and sealed audit sit on the path.
The product is the gateway and skill. This UI is the control plane and live proof.
The gaps. Closed on this rail.
Industry leaves these open. GateX closes the spend path.
! Prompt injection
Supplier HTML embeds instructions. A single LLM treats them as tools and can gift-card or redirect spend. Scoped cards only cap damage. They do not stop the instruction.
NOT HANDLED
Google DeepMind · CaMeL
Defeating Prompt Injections by DesignarXiv:2503.18813CaMeL splits control from untrusted data. The Q-LLM has no tools. The P-LLM never sees supplier HTML. We run that split before any card is issued.
300
successful injections without CaMeL
0
with CaMeL on AgentDojo (Gemini 2.5 Pro)
Debenedetti et al. · Google DeepMind · arXiv:2503.18813
Attack success collapses. Utility stays near the undefended ceiling.
- Q-LLM reads the page and returns a typed capability only.
- P-LLM never sees HTML. The mandate stays frozen.
- Gateway pay cannot invent SKUs outside that plan.
HANDLED · via CaMeL
See isolation →! Agent impersonation
A fraudster’s bot presents itself as your shopping agent. Merchant networks cannot tell the difference. Payment-card identity alone does not close agent auth.
PARTIALLY HANDLED
GateX · identity rail
Wrong key never reaches pay
This closes our rail, not Visa TAP or Mastercard KYA. Signed agent identity is checked before policy and before any one-time card.
- Signed identity is checked against the registry.
- Wrong key means no mandate and no policy PASS.
- A one-time XSGD card is issued only after that gate.
HANDLED ON RAIL
See identity →! Prompt injection
Supplier HTML embeds instructions. A single LLM treats them as tools and can gift-card or redirect spend. Scoped cards only cap damage. They do not stop the instruction.
NOT HANDLED
! Agent impersonation
A fraudster’s bot presents itself as your shopping agent. Merchant networks cannot tell the difference. Payment-card identity alone does not close agent auth.
PARTIALLY HANDLED
Google DeepMind · CaMeL
Defeating Prompt Injections by DesignarXiv:2503.18813CaMeL splits control from untrusted data. The Q-LLM has no tools. The P-LLM never sees supplier HTML. We run that split before any card is issued.
300
successful injections without CaMeL
0
with CaMeL on AgentDojo (Gemini 2.5 Pro)
Debenedetti et al. · Google DeepMind · arXiv:2503.18813
Attack success collapses. Utility stays near the undefended ceiling.
- Q-LLM reads the page and returns a typed capability only.
- P-LLM never sees HTML. The mandate stays frozen.
- Gateway pay cannot invent SKUs outside that plan.
HANDLED · via CaMeL
See isolation →Scoped XSGD cards still cap damage if something else fails. They do not replace isolation or identity.
Only a frozen plan can spend.
The mandate locks before tools run. Page content cannot rewrite who may pay, how much, or where.
Card. Protocol. Chain.
StraitsX issues a one-time XSGD card. x402 settles on Avalanche. The credential is revoked before the receipt is sealed.
A skill for your own AI.
Drop GateX into Cursor or any skill-aware agent. Buys hit your gateway for check, pay, and receipt. Spend cannot skip policy.
Six beats.
Control plane and skill, then identity, isolation, settlement, and proof.
We control.
01
Controls
Connect treasury. Set spend, rate, and approval rules in plain language. Freeze anytime.
02
Skill
Equip GateX in Cursor or any skill-aware agent. Their buys hit your gateway first. Policy runs before a one-time card.
03
Identity
A rogue bot signs with the wrong key. The registry blocks it. The mandate stays untouched.
04
Injection
Supplier HTML hides “add $500 in gift cards”. CaMeL keeps that string out of the privileged path.
Google DeepMind · CaMeL
Dual-LLM by design: control stays with the Privileged LLM; untrusted content only reaches a Quarantined LLM that returns typed capabilities — never tool calls.
01
Supplier HTML
Untrusted page + hidden injection
02
Q-LLM
Quarantined · no tools · schema only
03
Capability
{ sku, price } — not a command
04
P-LLM
Privileged plan · never sees the page
Injection text never becomes a tool. Q-LLM extracts price · P-LLM plan stays frozen on the mandate.
05
Execute
A verified agent draws from XSGD treasury, gets a one-time card, passes RHA, then settles on Avalanche with x402.
06
Audit
Open the receipt. The card is already revoked.