Agent Middleware sits in front of MCP tools. Agents act under a permit; a same-key retry returns the original receipt, no second call or charge. Calls outside the permit are refused before any charge. Every receipt is Ed25519 signed and verifiable offline.