Admission gate
Put a cost on bot sign-ups without asking for a phone number or a big-platform account. An admission gate is how your service decides whether to accept a PCOC at sign-in. A PCOC is an identifier the new user made themselves, at a real cost in time. Use groundinglab's hosted gate, run the gate yourself, or check PCOCs in your own code with the SDK. Its pair is Make a PCOC.
What an admission gate is
Its verifier measures the PCOC; your policy decides. The two stay separate: any conforming verifier measures a PCOC the same way, and each service sets its own requirement.
An admission gate is the verifier plus your policy. Your service can accept a PCOC as a cost-backed credential for sign-in, next to the sign-in options you already have.
Compose it or use it alone: beside your existing sign-in, in front of a free tier, or as the only way in.
Why a service would want it
Each fake account costs real resources to make, and there's no new issuer. You set what you require through your own policy. No issuer sits in between, you ask for no phone number, email or ID, and checking takes seconds.
It fits where bots hurt most: open sign-up, spam, and a free tier that scripts farm.
It can sit beside a stronger personhood or identity check, for actions that don't need that check.
A service's gate can refuse or revoke a PCOC under its policy. Your gate can use different values within the ranges the specification allows.
groundinglab's hosted gate (gl-admit-v12) sets a testing minimum pace of 0.1 legs/s for the making, asks for at least 6 anchored points, sets no tip-versus-last-beacon submission deadline, and checks one randomly placed leg in each stage. The exact count is set by the service's policy. In our calibration study against a 0.2 floor candidate, our low-end laptop (an Intel Core i7-10610U) stayed above that study pace while making two PCOCs at once, and a six-core laptop making six at once fell below it. How we set groundinglab's admission policy: the argument, the evidence, and how to test it yourself.
Three ways to add it
Use groundinglab's hosted gate
The gate behind this site's Sign in, hosted by groundinglab.
Run your own gate
The same split: the verifier measures, your policy decides. Setup below.
Embed the SDK verifier
The SDK measures the PCOC and returns a record. You apply your own policy. Setup below.
Every page here, the SDK page and the specification read as plain text, so a coding agent can build from them. Integration guides: Verifier and policy and the gate's request and response bodies.
Run your own gate
Paste each step into a terminal, in order, or hand this page to your coding agent. groundinglab's own sign-in runs this same service.
Version, policy id, and command names checked against pcoc main and tag sdk/go/v2.3.1 on 24 Oct 2026. This page was not run as a build on that date.
1. Install the system packages
sudo apt update
sudo apt install -y build-essential git curl2. Install Rust with rustup
The gate builds with Rust 1.99.0, the version the repository pins for the SDK. The second line loads Rust into this terminal.
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain 1.99.0
. "$HOME/.cargo/env"3. Get the code
git clone https://github.com/groundinglab/pcoc.git
cd pcoc/services/admission-gate4. Build the gate
This downloads and compiles everything. It took 18 seconds on an 8-core test machine; a small machine takes longer.
cargo build --locked --release5. Check the build
./target/release/admission-service --versionExpected output (the version and commit follow the code you cloned)
admission-service 0.5.8 commit=<the commit you cloned> sdk=2.3.1 (path)6. Configure it
Your copy stays in deploy/ so it finds the policy file next to it. Replace https://your-site.example with your own site. The file explains every other setting. The example file names groundinglab's policy, gl-admit-v12, which you can change.
cp deploy/gate.toml deploy/my-gate.toml
sed -i 's|^served_origins = .*|served_origins = ["https://your-site.example"]|' deploy/my-gate.toml7. Run it
It listens on 127.0.0.1:8787 and keeps running. Leave this terminal open and open a second one for the next step.
./target/release/admission-service --config deploy/my-gate.tomlExpected output (end of the last line)
… bind=127.0.0.1:8787 index=https://index.groundinglab.io log=gate-log-v2 config=deploy/my-gate.toml8. Check the result
curl -sS http://127.0.0.1:8787/v1/healthExpected output (shortened)
{"ok":true,"service":"admission-service","version":"0.5.8", … "policy_id":"gl-admit-v12"}, … }9. Put it in front of your site
To serve it publicly, run it as a service behind your reverse proxy. DEPLOY.md has the systemd unit and every setting. Request and response bodies: Technical: Integrate an admission gate.
Check a PCOC with the SDK
The known-good check is the Go quickstart at tag sdk/go/v2.3.1. It measures the pinned conformance object. The download in step 3 is a previous-version object. A current verifier records an unknown kind for it and does not fetch an index. Rust, C, and Java print the same lines apart from the language name and version. The SDK setup on Make a PCOC covers those.
Version, policy id, and command names checked against pcoc main and tag sdk/go/v2.3.1 on 24 Oct 2026. This page was not run as a build on that date.
1. Install Go, git and curl
sudo apt update
sudo apt install -y golang-go git curl2. Get the code
git clone https://github.com/groundinglab/pcoc.git
cd pcoc
git checkout sdk/go/v2.3.1
cd sdk/go3. Download groundinglab's own PCOC
curl -fLO https://groundinglab.io/verify/groundinglab.pcoc.cbor4. Run the quickstart
It checks the conformance pack. It does not read the downloaded file, and it does not time the run.
go run ./cmd/pcoc quickstart5. Check the result
Six lines. The second line names the SHA-256 backend on your machine. This example is reference system 3. The verifier measures and never decides. Your code applies your rules to the record. Verifier and policy.
Expected output
pcoc 2.3.1 (go) spec-2.3.0 pack 91ded57e5c05b7cb: pin match
kernel scalar, sha256 sha-ni
O1-S1 object sha256 800ad07a87a567c835f539617b61ccddc96a0a984425675a5ece971162dfd246
O1-S1 six_leg match, checkpoints match, waypoints match
negatives 13 non-match
PROD leg 0 legs_le_hex 88a04ac5beacb8a7See it live
groundinglab's Sign in on this site is that pattern.
Every decision groundinglab's own service makes is on the public gate log, with the policy it applied. Another service can decide differently on the same kind of measurement.