> ## Documentation Index
> Fetch the complete documentation index at: https://docs.trustgated.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# Behavioral Access Gating

> TrustGate attests a score. Your protocol owns the ladder. Signed, time-bound, fail-closed.

## What it is

Behavioral access gating is how a DAO, lending market, launchpad, or agent permission layer uses TrustGate as an **access-control signal** without handing TrustGate the keys.

TrustGate provides a hard-to-fake behavioral score and, optionally, a verifiable attestation of that score. Your protocol defines what each score band is allowed to do. TrustGate does not set borrow limits, assert token price, or act as a credit bureau.

Live pilot UI: [trustgated.xyz/gating](https://www.trustgated.xyz/gating)

<Note>
  Liability fence, repeated on every response: TrustGate said the wallet scored N at time T under scoringVersion V. The protocol chose what N allows. Scores behaviour, not value or safety.
</Note>

## What it is not

Do not call this an onchain credit score, a safe-to-lend check, or TrustGate authorization. The `allowed` bit on `POST /api/gating/check` is **your ladder's** evaluation (`allowedByCallerLadder`, `policySource: "caller_ladder"`). Trust the attested `score` and `signature`. Do not treat `allowed` as TrustGate saying yes.

Do not sole-gate on `score >= X`. Combine with collateral, protocol history, staking, and domain signals. High-value paths must fail closed.

## The three APIs

| Method | Path                 | Job                                                  |
| ------ | -------------------- | ---------------------------------------------------- |
| `POST` | `/api/gating/attest` | Issue an EIP-712 attestation for a wallet or token   |
| `POST` | `/api/gating/verify` | Fail-closed off-chain verify                         |
| `POST` | `/api/gating/check`  | Score + evaluate **your** ladder + issue attestation |

Gating is **free** for protocols on testnet.

## Attestation shape

Every attestation is time-bound and signed. Domain: `TrustGateAttestation` / version `1`.

| Field                         | Purpose                                                  |
| ----------------------------- | -------------------------------------------------------- |
| `subject`, `subjectType`      | Wallet or token, plus the address                        |
| `chainId`                     | Domain separation. Default Arc Testnet `5042002`         |
| `score`, `tier`, `confidence` | The signal                                               |
| `scoringVersion`              | `testnet-wallet-v1.0` or `testnet-token-v1.0`. Pin this. |
| `environment`                 | `testnet` or `mainnet`                                   |
| `issuedAt`, `expiresAt`       | Unix seconds                                             |
| `flags`, `flagsHash`          | Display list plus keccak of sorted codes                 |
| `issuer`, `signature`         | EIP-712 over the payload                                 |
| `disclaimer`                  | Always present                                           |

Default TTL by `useClass`:

| `useClass`       | Default TTL | Ceiling |
| ---------------- | ----------- | ------- |
| `financial_high` | 6 hours     | 7 days  |
| `governance`     | 2 days      | 7 days  |
| `allowlist`      | 7 days      | 7 days  |
| `display`        | 1 day       | 7 days  |

Clients cannot request a near-permanent attestation. Minimum TTL is 60 seconds.

## Protocol-owned ladder

You send bands. TrustGate never authors a production ladder.

```json theme={null}
{
  "protocolId": "my-dao",
  "minConfidence": 40,
  "multiFactorAcknowledged": true,
  "bands": [
    { "minScore": 25, "maxScore": 48, "capability": "borrow", "maxAmount": 20000 },
    { "minScore": 49, "maxScore": 60, "capability": "borrow", "maxAmount": 100000 },
    { "minScore": 61, "maxScore": 90, "capability": "borrow", "maxAmount": 500000 }
  ]
}
```

`ladderPreset: "example_lending"` and `"example_governance"` exist for demos on testnet only. They are forbidden on mainnet. Mainnet also requires `protocolId` and multi-factor acknowledgement.

## On-chain verify

Deploy `TrustAttestationVerifier.sol` yourself — it is **not** a shared singleton on Arc Testnet. Authorize your TrustGate issuer. Call `verify` before releasing funds. It checks signature, expiry, subject, chain, and issuer registry. It does **not** evaluate your ladder.

Integration guide: [Gate with attestations](/integrate/gating).

## Status

Phase A is implemented: attestations, ladder check, off-chain verify, and the on-chain verifier contract. Treat it as a pilot surface. Set `ATTESTATION_SIGNER_PRIVATE_KEY` before any production gate. A demo signer is rejected when `SCORING_ENVIRONMENT=mainnet`.