Keep the source-rights record beside your AI workflow

What will your team show during a later review?

A tool trace usually identifies the URL and execution. It may not retain the machine-readable licence conditions or restrictions that were observable when the source was checked.

AcqPath adds a source-rights observation record to the existing workflow. Your customer policy remains responsible for enforcement; Observe mode does not change the original action.

Live source eligibility and trust boundary

LIVE: Secure Preflight and Gateway accept eligible public HTTPS URLs through a signed, public-network-only relay. The four origins in reviewed coverage are independently reviewed sources, not the dynamic eligibility limit. Stock x402 remains reviewed-origins-only. Robots, access restrictions, per-origin quotas and UNKNOWN outcomes still apply.

Start with evidence. Decide on enforcement later.

The first integration mode is Observe: AcqPath runs beside the existing request path and writes evidence to your audit stream. Nothing is blocked and no existing policy is replaced.

Three eligible events prove the integration path. Any material rights/drift signal can end the sprint early. Otherwise use 25 eligible events or 6 hours as the normal commercial gate; never exceed 50 events or 24 hours.

existing request ───────────────→ existing execution
       └─→ AcqPath Evidence → audit log

3 events = integration smoke test
25 events / 6h = normal decision gate
50 events / 24h = hard stop

One provider-neutral evidence contract

Every integration consumes rights-evidence.resolution.v1. Evidence statements are declared_permitted, declared_prohibited, license_required or unknown. Transport states are resolved, unavailable, unsupported or invalid.

AcqPath never maps that evidence to your final allow/deny decision. The consumer-owned policy engine remains authoritative.

Choose the architecture you already have

AI or MCP gateway: observe tool calls and pass the normalized evidence into the existing policy engine. Crawler or search API: attach rightsEvidence beside the existing URL/content result. RAG: persist source_rights with document provenance. Policy engine: consume an attested evidence input without moving enforcement into AcqPath.

What a typical audit trail may not capture

A normal audit log can prove who acted, which tool executed, the URL and the timestamp. It may not preserve what the publisher declared about machine use at that time, the signed source-state evidence behind the decision, or later declaration drift.

If your system already captures those fields, AcqPath fits as the external evidence source behind them rather than replacing your audit or governance layer.

Build internally vs integrate

Building this internally means maintaining declaration discovery, RSL parsing, purpose mapping, conflict handling, source hashing, timestamps, signatures, freshness, caching, retry semantics, revalidation, drift detection, URL normalization and SSRF controls.

AcqPath collapses those evidence concerns behind one provider-neutral contract while your application keeps policy and enforcement.

Current production boundary

Secure Preflight and Gateway accept eligible public HTTPS origins beyond the four independently reviewed publishers, with signed relay, robots/DNS/TLS controls and bounded per-origin budgets. Stock x402 is a separate reviewed-only route. Missing declarations can yield UNKNOWN.

A customer-owned Base USDC x402 buyer is still required for paid reports. Walletless API keys, prepaid credits, invoices and subscriptions are not live. A neutral adapter can map URLs and a configured shadow-mode purpose without replacing the partner policy engine.