The Move contract

public struct AccessPolicy has key {
    id: UID,
    owner: address,
    /// key = `agent::namespace`, value = allowed. Absent key = allowed.
    grants: Table<String, bool>,
    receipt_count: u64,
    chain_head: vector<u8>,
}

public fun set_access(
    cap: &OwnerCap,
    policy: &mut AccessPolicy,
    agent: String,
    namespace: String,
    allowed: bool,
) {
    assert!(cap.policy == object::id(policy), ENotOwner);
    let k = gkey(&agent, &namespace);
    if (policy.grants.contains(k)) { *policy.grants.borrow_mut(k) = allowed; }
    else { policy.grants.add(k, allowed); };
    event::emit(AccessChanged { policy: object::id(policy), agent, namespace, allowed });
}

public fun is_allowed(policy: &AccessPolicy, agent: String, namespace: String): bool {
    let k = gkey(&agent, &namespace);
    if (policy.grants.contains(k)) { *policy.grants.borrow(k) } else { true }
}

public fun anchor_receipt(
    policy: &mut AccessPolicy,
    answer_id: String,
    agent: String,
    used_namespaces: vector<String>,
    blocked_namespaces: vector<String>,
    digest: vector<u8>,
    walrus_blob: String,
    clock: &Clock,
    ctx: &mut TxContext,
) {
    // 1. recompute the verdict on-chain
    let mut all_authorized = true;
    let mut i = 0; let n = used_namespaces.length();
    while (i < n) {
        if (!is_allowed(policy, agent, used_namespaces[i])) { all_authorized = false; };
        i = i + 1;
    };

    // 2. extend the blake2b256 hash chain
    let prev = policy.chain_head;
    let mut buf = prev;
    vector::append(&mut buf, digest);
    let chain_digest = hash::blake2b256(&buf);
    let seq = policy.receipt_count;

    // 3. mint the Receipt + update chain head
    let r = Receipt { id: object::new(ctx), policy: object::id(policy), seq,
        answer_id, agent, used_namespaces, blocked_namespaces, all_authorized,
        digest, prev_digest: prev, chain_digest, walrus_blob,
        timestamp_ms: clock.timestamp_ms() };
    policy.receipt_count = seq + 1;
    policy.chain_head = chain_digest;
    transfer::public_transfer(r, ctx.sender());
}

cd contracts && sui move test