Built for 2026 enterprise-agent hackathons

Agent Payment Ledger case study

A payment-aware ledger for production-like agents: every tool call, approval gate, retry, error, x402 payment, and final outcome becomes inspectable run evidence.

The problem

Enterprise teams do not need another hidden transcript. They need durable operational evidence before agents can touch paid APIs, internal systems, or approval-gated workflows.

Trust gap

Final answers hide the decisions, retries, rejected approvals, and tool behavior that actually create risk.

Ops gap

Security and platform teams need searchable event streams, not screenshots of a chat window after the fact.

Spend gap

Agents calling paid APIs need cost attribution tied to the exact run, endpoint, provider, and outcome.

What shipped

The build turns an agent workflow into a run ledger with dashboard inspection, exportable audit JSON, x402-style payment events, and Splunk HEC telemetry.

SDK

startRun, trackToolCall, trackApproval, trackPayment, and finishRun wrap existing agent code without locking it to a framework.

Ledger

Express and SQLite store append-only events, group them into runs, calculate risk flags, and preserve compatibility with the original x402 event model.

Console

The dashboard shows recent runs, selected timelines, approval/payment/error evidence, spend by endpoint, spend by agent, and audit export.

Telemetry

The Splunk HEC adapter exports a selected run as agentops:run_event records for search, alerting, and incident review.

Evidence

The credibility layer is intentionally boring: public code, repeatable demo data, tests, release assets, hosted page, and a sanitized Splunk proof packet.

Public implementation

SDK helpers, server APIs, dashboard, seed data, architecture docs, and release assets are in the public repository.

Splunk HEC proof

The blocked demo run exported through HEC and appeared in Splunk as five agentops-ledger events.

Honest status

NandaHack is submitted and the Devpost video host is live; Splunk Devpost and broader social launch are still pending account-gated steps.

Current next gate: submit Splunk Agentic Ops with the public hosted video, repository, architecture, Splunk proof, and investigation pack. The Splunk investigation pack adds SPL searches, a Splunk MCP tool map, and AI/MCP prompt templates for the indexed run events. The Splunk submission packet keeps the Devpost copy and proof boundary in one place.

Hackathon fit

Agent Payment Ledger is positioned as infrastructure, not a novelty demo. It gives a stock agent a practical trust, audit, and observability layer.

NandaHack

Fits enterprise-agent trust infrastructure across safety, integration, coordination, and production-like evaluation.

Splunk Agentic Ops

Turns every agent run into Splunk-ready operational telemetry for search, alerting, and investigation.

Follow-on tracks

Google Rapid Agent and UiPath remain adaptation targets after adding platform-specific runtime integration.

Judge links

One place to inspect the product, code, architecture, proof, and demo material.