Resolve the tenant-bound Paybond principal behind the configured service-account API key.

Use this when you need raw capability-token verification for one tenant-bound Harbor intent. Do not use this to create, fund, or modify intents; use paybond_authorize_agent_spend as the clearer gate before side-effecting agent tools.

Use this when an agent has an intent_id and capability_token and needs a tenant-bound spend gate before calling a side-effecting tool, paid API, vendor action, or settlement workflow. Do not use this for creating, funding, or changing intents; call paybond_create_spend_intent or paybond_fund_intent first when no funded capability token exists.

Use this when building or testing a first paid-tool integration and you need a sandbox-only guardrail intent with no live settlement rails. Do not use this for production live money movement or already-created Harbor intents.

Pre-validates vendor and canonical completion evidence against catalog JSON Schemas and preset forbidden_evidence_fields. Required before evidence submit tools when PAYBOND_MCP_EVIDENCE_POLICY=strict. Harbor remains authoritative at submit time.

Use this when a sandbox guardrail intent needs evidence to complete simulator settlement or predicate checks. Do not use this for live Harbor spend evidence; use paybond_submit_spend_evidence for production spend intents.

List tenant-scoped Harbor intents through the gateway operator view with optional filters.

Fetch one tenant-scoped Harbor intent detail through the gateway operator view.

List tenant-scoped compliance audit export jobs through the gateway operator view.

Fetch one tenant-scoped compliance audit export job detail through the gateway operator view.

Fetch the signed Signal receipt for one operator DID.

Fetch the tenant-scoped Signal portfolio summary.

Fetch the tenant-scoped signed Signal portfolio artifact for portable verifier and partner sharing.

Fetch the read-only fraud assessment for one tenant-scoped operator DID.

Fetch tenant-scoped read-only fraud backtesting and monitoring metrics for a supported active window.

Fetch the published Paybond A2A discovery card for protocol-trust delegation.

Fetch the published catalog of Paybond A2A task contracts for delegated Harbor workflows.

Fetch one published Paybond A2A task contract by identifier.

Verify a signed AgentMandateV1 envelope through the gateway v2 protocol surface.

Verify a replay-safe AgentRecognitionProofV1 against an expected purpose and request envelope. Verifier context (tenant_id, verifier_id) is derived from the authenticated MCP session only.

Import a signed AgentMandateV1 through the gateway v2 protocol route and bind it to one Harbor intent using a replay-safe recognition proof.

Fetch the signed protocol-v2 settlement receipt for one Harbor intent.

Verify a protocol-v2 authorization or settlement receipt through the gateway.

Use this when you already have a fully signed Harbor intent request body and replay-safe recognition proof for the gateway /harbor/intents route. Do not use this for the normal agent spend-control path unless you specifically need the low-level Harbor API; prefer paybond_create_spend_intent.

Use this when an agent workflow needs a new Paybond spend intent with bounded budget, allowed operations, evidence requirements, and settlement review. Do not use this for checking an already funded capability token; use paybond_authorize_agent_spend before the paid action.

Use this when you already have a Harbor evidence request body and recognition proof for the gateway /harbor/intents/{id}/evidence route. Do not use this for the high-level spend-control path unless you need the low-level Harbor API; prefer paybond_submit_spend_evidence.

Use this when a Paybond spend intent needs signed evidence so release, refund, review, and receipt generation use the same audit-ready record. Do not use this to create or fund intents, and do not use it for sandbox guardrail evidence.