import { trust } from "usertrust";

const client = await trust(new Anthropic());

const { response, receipt } =
  await client.messages.create({
  model: "claude-fable-5",
  max_tokens: 256,
  messages: [...],
});

receipt · Anthropic

{  "transferId": "tx_msm19wxa_a107246b",  "cost": 104,  "budgetRemaining": 49896,  "auditHash": "f4a15bc63fc64bcdab2dcca67718d6a89469311e01cb16fa9dd7bb0c31286654",  "chainPath": ".usertrust/audit",  "receiptUrl": null,  "settled": true,  "model": "claude-fable-5",  "provider": "anthropic",  "timestamp": "2026-08-09T16:45:13.634Z",  "usageSource": "provider",  "usage": {    "inputTokens": 317,    "outputTokens": 131,    "cacheReadTokens": 87,    "cacheWriteTokens": 43  },  "endpoint": {    "class": "cloud",    "runtime": "unknown"  },  "meter": {    "costBasis": "usd-proxy",    "rateSource": "table"  },  "pricing": {    "appliedRates": {      "inputPer1k": 100,      "outputPer1k": 500,      "cacheReadPer1k": 10,      "cacheWritePer1k": 125    },    "tableVersion": "2026-08-09"  }}

captured v3.2.0 · TigerBeetle 0.17.9 · ledger · 699fcef · 2026-08-09

exhibit b

your SDK. one line.

import Anthropic from "@anthropic-ai/sdk";import { trust } from "usertrust"; const client = await trust(new Anthropic()); const { response, receipt } =  await client.messages.create({    model: "claude-fable-5",    max_tokens: 1024,    messages: [...],  });

your keys. your billing. your evidence.

works with

vLLM
LM Studio

governed surfaces

governed

anthropic

messages.create
messages.stream
messages.parse
beta.messages.create
beta.messages.stream
beta.messages.parse

openai

chat.completions.create
responses.create — incl. stream: true

google

models.generateContent

passthrough — not governed

anthropic

messages.batches
beta.messages.batches
beta.models
beta.files

openai

responses.stream() helper
responses.parse()
responses.retrieve / cancel / delete
legacy completions.create
beta.* (assistants / threads / realtime)

google

models.generateContentStream
models.countTokens

passthrough surfaces bypass governance, audit, and budget enforcement — route spend through the governed entry points. 23+ models priced across anthropic, openai, and google.

exhibit c

ENFORCE

hold. settle. or void.

the banking pattern: held, then settled or voided. never lost.

every governed call opens a two-phase hold against the budget before a token moves — available = budget − Σ(holds). without holds, concurrent agents each see the full budget and settle past it. with holds, the first hold that would exceed what is actually available throws. the budget here is 50,000 ut = $5.00 — the starter default. run the race yourself:

the gate is per-governor: one process serialises its own budget read and hold behind a mutex. across processes the guarantee is the ledger’s — TigerBeetle atomically rejects a hold that would overshoot, whoever asked for it.

concurrent agents

4

est. cost per call

12,000 ut

available2,000 utbudget50,000 utΣ(holds)48,000 ut

budget bar — holds stack. the cap is the wall.

agent 01hold 12,000 utheld
agent 02hold 12,000 utheld
agent 03hold 12,000 utheld
agent 04hold 12,000 utheld
agent 01 · retry ✗ PolicyDeniedError: hold would exceed available budgethold 12,000 ut > available 2,000 ut — nothing moved, nothing owed

held 48,000 ut of 50,000 ut — the bar never passes the cap.

the sliders need JavaScript — shown: two-phase holds with 4 agents at 12,000 ut per call. the retry is denied.

arithmetic, not a screenshot: the same gate the block-budget-overshoot default rule enforces before every governed call. the error it throws is captured below, verbatim.

case file 001incident log

subject: autonomous coding agent · production API key

overnight, the agent entered a retry loop nothing was watching.

47 identical completion calls. no variation. no ceiling.

the spend surfaced as a $500 line item on the invoice — not in any log.

no budget hold. no audit chain. nothing threw.

finding: the run left nothing behind to verify, dispute, or replay.

no receipts existed.

file closed — unstamped

counterfactual replay — the same loop, governed: usertrust throws at the cap.

BLOCKED

the denial, on the chain.

denials don’t get receipts. they get chain events.

what the caller gets

PolicyDeniedError: Policy denied: [block-budget-overshoot] Deny pre-spend when estimated cost would drive remaining budget below zero; [WARN] [warn-high-cost] Emit a warning when estimated cost exceeds 1000 tokens

  Hint: A budget rule denied this call: increase the budget in trust() options or reduce the call's max_tokens, and review your budget_remaining / budget_remaining_after tiers.
  Docs: https://usertrust.ai/docs/errors/policy-denied

what the chain gets · policy_denied

kind: policy_denied
decision: deny
denialClass: budget_gate
rule: block-budget-overshoot
model: claude-fable-5
estimatedCost: 2,000,003 ut
budgetRemaining: 49,344 ut
promptHash: bbef7150e9b81a13378e3f48d66e2c29b22e14d35cae8e89007250bf93c819b4
transferId: tx_msm19z83_ddc7e446
hash: 627256b4498f26af6c5ec8ff55d9ea21cdab3b021028f96021600a5afb1cdbc8
previousHash: dbcbefad935613c7d02c806c039d2bea8fc3f73e2a3b022c7533010adf140bbf

the prompt is hashed, never stored · captured on usertrust 3.2.0 @ 699fcef · one governed call with max_tokens 4,000,000 against a 50,000 usertoken budget

exhibit d

RECORDANCHOR

tamper with one byte. break the whole chain.

the chain verifies itself

sha-256 · rfc 6962 leaf and node prefixes

and can be anchored beyond your infra

S3 Object Lock
git
SIEM
RekorEXPERIMENTAL

entries captured in ledger mode — TigerBeetle enforcing; dry-run writes the same audit chain without the ledger

entry 1✓
llm_call
llm_call · claude-fable-5 · 104 usertokens
sha256 f4a15bc63fc6…
prev 000000000000…
entry 2✓
llm_call
llm_call · gpt-5.6-sol · 59 usertokens
sha256 0f1031df7133…
prev f4a15bc63fc6…
entry 3✓
llm_call
llm_call · kimi-k3 · 31 usertokens
sha256 91df5d9e8bc1…
prev 0f1031df7133…
entry 4✓
llm_call
llm_call · claude-fable-5 · 104 usertokens
sha256 80bad924078d…
prev 91df5d9e8bc1…
entry 5✓
llm_call
llm_call · claude-fable-5 · 112 usertokens
sha256 919d10dca884…
prev 80bad924078d…
entry 6✓
llm_call
llm_call · claude-fable-5 · 119 usertokens
sha256 52f85adb310a…
prev 919d10dca884…
entry 7✓
llm_call
llm_call · claude-fable-5 · 127 usertokens
sha256 dbcbefad9356…
prev 52f85adb310a…
entry 8✓
policy_denied
policy_denied · claude-fable-5 · denied · budget_gate
sha256 627256b4498f…
prev dbcbefad9356…

chain intact — 8 entries, every prevHash verified

live demo recomputes sha-256 over each card's visible fields — printed stubs are the vault's captured hashes over the full event record

view raw JSONL →

built for the record-keeping era — EU AI Act Art. 12 traceability

tamper-evident, not tamper-proof — detection, not recovery.

exhibit e

VERIFY

don’t take our word for it.

0

runtime dependencies in the verifier.

the verifier owes us nothing.

packages/verify/package.json — dependencies key count

usertrust-verify

Vault integrity: VERIFIED (UNANCHORED — internal consistency only)
Chain length: 8 events
Merkle root: 4f7ad6693448abe0f713b5656cf13021d61c01ec36b94df55463b2482f4514c8
Hash algorithm: SHA-256
First event: 2026-08-09T16:45:13.602Z
Last event: 2026-08-09T16:45:16.565Z
All hashes: valid (8/8)

exhibit f

BLOCKED is a feature.

the gate runs before the provider is ever called. a denial throws, the provider is never reached, and no receipt is returned — but the refusal is not silent. denials don’t get receipts. they get chain events.

12 policy operators · packages/core/src/shared/types.ts — FieldOperator union members

policy.yaml

rules:
  - name: frontier-cost-cap
    effect: deny
    enforcement: hard
    severity: critical
    conditions:
      - { field: model, operator: , value: [gpt-x, gpt-x-mini] }
      - { field: estimated_cost, operator: , value: 2000 }
  - name: research-scope-guard
    effect: deny
    enforcement: hard
    conditions:
      - { field: cost_center, operator: , value: research }
      - { field: model, operator: , value: "^gpt-x" }
    scopePatterns: ["agents/research/**"]
    timeWindows: [{ daysOfWeek: [1, 2, 3, 4, 5], startHour: 9, endHour: 18 }]

print spool

chit-01✓
modelclaude-fable-5
est_cost840
chit-02✓
modelgemini-2.5-flash
est_cost120
chit-03✓
modelgpt-x-mini
card_number
est_cost300
chit-04✓
modelclaude-haiku-4-5
cost_centersupport
chit-06✓
modelgpt-x-mini
est_cost990

thrown AND chained

BLOCKED

thrown: PolicyDeniedError · the provider was never called

chained: policy_denied · denialClass budget_gate · prompt hashed

frontier-cost-cap · estimated_cost 2400 gt 2000 · model gpt-x in [gpt-x, gpt-x-mini]

exhibit g

VERIFY

every way we know to forge a ledger.

every forgery fails. every legitimate operation verifies.

29 scenarios · every verdict below is the string the verifier really returns

emerald rows are control cases — legitimate operations that must verify. red rows are the non-verified states: forgeries the verifier refuses (ANCHOR_MISMATCH, ANCHOR_INVALID), and the can’t-attest states (ANCHOR_STALE, ANCHOR_UNVERIFIABLE, UNANCHORED) — no accusation in those, and the default verifier still exits clean; --require-anchor is what fails them.

packages/core/tests/harden/anchoring/anchor-corpus.test.ts29 rows

indexed by row · source test titles linked verbatim; their original spec-row prefixes are omitted (row 17 was folded into scenario 5 upstream).

reproduce it yourself

$ git clone https://github.com/usertools-ai/usertrust.git
$ cd usertrust
$ npm ci
$ npm test -- anchor-corpus

don’t trust us — recompute us.

the discipline

the harden doctrine.

harden suites: 53
test cases: 3014
test assertions: 7228
AGENTS.md invariants: 35
shared verifier lines: 0

counted at capture · 699fcef · v3.2.0

Core produces the hashes in a vault; verify recomputes them without importing core. If the two share code, the verifier verifies nothing.
Never "DRY up" this duplication. Mirror every change into both packages.

AGENTS.md · the packages/verify parity contract

open your ledger.

governance wins.

your keys. your billing. your evidence.

start in dry-run — TigerBeetle skipped; audit chain and policy gates still run

setup2 min

runtime deps (verifier)0

licenseApache 2.0

TOTAL SURPRISES ··· 0

chain head 627256b4498f26af6c5ec8ff

open your ledger →

captured v3.2.0 · 2026-08-09

run it where you need it.

local SDK
shipping today
self-hosted control plane
shipping today
managed proxy
request access →

financial governancefor AI agents.keep the receipts.

the facts, itemized.

every governed call returns evidence.