With the growth of the agentic economy and the ability of agents to manage wallets and make payments it's critical that we have a mechanism to audit their payment behavior. And to complicate matters, agents are invoking subagents to work faster.

When an agent hands work to another agent, OAuth Token Exchange (RFC 8693) nests an "act" claim at each hop. Those claims are informational, not enforceable. Each actor in the process (e.g., your identity manager, your gateway, each agent) logged its activity — and no artifact anywhere answers "did this action, three steps from the user, stay inside what the user actually authorized?" Cloudflare (Wallets, and Cloudflare OS's Gatekeepers) enforces scope at call time against its own ledger, and Block's Buzz mints an owner→agent authorization a third party can verify offline without calling Block — ScopeTrail is the layer above both, proving scope actually attenuated across every hop and returning a verdict on the action at the end.

ScopeTrail is a TypeScript library (Apache 2.0) that lives above the multi-agent transaction and documents the full chain by: - Building and validating the chain from raw tokens - Minting and signing a receipt with Ed25519 over JCS (RFC 8785), and - Storing the receipt in an AT Protocol PDS.

The user can then retrieve and verify the receipt including the hop and scope if the agents went beyond their remit.

Raw tokens are never stored — only SHA-256 digests. Verification is stateless: no callback to the issuer is needed at verify time, no vendor in the loop.

You can try it now! Verify a live receipt by:

  curl -sO https://scopetrail.github.io/.well-known/jwks.json
  npx -y --package=@scopetrail/core view-receipt \
    at://did:plc:bty3gmskhla7rwblq5zl5jm5/dev.scopetrail.auditReceipt/00MSQDN0UT747ADDB2C4BB25420974 \
    --jwks jwks.json

This view-receipt call resolves the DID, fetches the receipt, checks its Ed25519 signature against the JWKS downloaded before the call, and prints the delegation chain.

The next milestone will be mint-by-default inside an open-source MCP gateway. If you work on gateways, an agent platform, or an identity product, I'd like to hear where this breaks.