# Check an agent action from Go

This example validates a mandate over MCP JSON-RPC, calls HANRIA's free HTTP check at `https://check.hanria.ai/v1/check`, and verifies the signed receipt with the Go standard library. It needs Go 1.22 or later and has no third-party dependencies.

A mandate is the operator's rule set. An action is what the agent wants to do. The decision is `permit`, `deny`, or `escalate`. An `error` outcome means the input did not validate; treat it as deny. Decisions are advisory: the calling agent or its operator decides what to do with them.

## Run it

```sh
go run .
```

Pass `--keys FILE` to verify with a saved copy of `https://check.hanria.ai/.well-known/hanria-receipt-keys.json` instead of fetching the keys.

The program exits 0 only for a verified `permit`, `deny`, or `escalate`. It exits 1 for an error, a mismatch, an unverifiable receipt, an unsafe JSON number, or a failed connection. The receipt proves what the hosted check answered for the exact mandate and action. It does not prove that the action was performed or that the mandate belongs to the operator.

Replace `mandateJSON` and `actionJSON` in `main.go` to use your own documents. Requests are evaluated in memory and not stored; only daily counts are kept. See https://check.hanria.ai/privacy. The unchanged example counts as an example call; see https://check.hanria.ai/methodology. Do not send secrets, personal data, or confidential policies.