Add webhooks, policy templates, and usage quotas (2096 -> 2333 tests)

Three new features to strengthen the Auth0 hackathon submission:
- Webhook notifications: HMAC-signed alerts for 17 security event types
- Policy templates: 8 pre-built security profiles with risk assessment
- Usage quotas: daily/monthly/total token budgets with configurable actions

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: optimus-fulcria

README.md

@@ -29,6 +29,9 @@ AgentGate uses Auth0 Token Vault to provide a secure, observable layer between A
 | **Compliance Reports** | SOC2/GDPR-ready audit exports with risk scoring |
 | **Agent Delegation** | Agents can delegate narrowed permissions to sub-agents with depth limits |
 | **Policy Simulation** | Dry-run authorization checks without issuing tokens |
+| **Webhook Notifications** | Real-time alerts for security events (HMAC-signed, auto-retry) |
+| **Policy Templates** | Pre-built security profiles for common use cases |
+| **Usage Quotas** | Daily/monthly token budgets with configurable actions on exceed |
 
 ## Architecture
 
@@ -134,6 +137,31 @@ See [AUTH0_SETUP.md](AUTH0_SETUP.md) for detailed instructions.
 - `GET /api/v1/analytics?hours=24` - Token usage analytics with anomaly detection
 - `GET /api/v1/compliance?days=30` - SOC2/GDPR compliance audit report
 
+### Webhook Notifications
+- `POST /api/v1/webhooks` - Create a webhook subscription (returns HMAC secret)
+- `GET /api/v1/webhooks` - List webhook subscriptions
+- `GET /api/v1/webhooks/{id}` - Get webhook details
+- `PATCH /api/v1/webhooks/{id}` - Update a webhook
+- `DELETE /api/v1/webhooks/{id}` - Delete a webhook
+- `POST /api/v1/webhooks/{id}/rotate-secret` - Rotate HMAC secret
+- `GET /api/v1/webhooks/{id}/deliveries` - View delivery history
+- `GET /api/v1/webhooks/events/list` - List all available event types
+
+### Policy Templates
+- `GET /api/v1/templates` - List available templates (filter by category, risk, tag)
+- `GET /api/v1/templates/{id}` - Get template details
+- `GET /api/v1/templates/{id}/preview` - Preview policy + risk assessment
+- `GET /api/v1/templates/compare/{a}/{b}` - Compare two templates side by side
+- `POST /api/v1/templates/apply` - Create a policy from a template with overrides
+
+### Usage Quotas
+- `POST /api/v1/quotas` - Create a usage quota (daily/monthly/total)
+- `GET /api/v1/quotas` - List all quotas
+- `GET /api/v1/quotas/check/{agent_id}` - Check quota status
+- `DELETE /api/v1/quotas/{id}` - Delete a quota
+- `POST /api/v1/quotas/{id}/reset` - Reset quota counter
+- `GET /api/v1/quotas/{id}/history` - View usage history
+
 ## Security Features
 
 ### Anomaly Detection

SUBMISSION.md

@@ -44,6 +44,9 @@ AgentGate is built entirely on Auth0 primitives:
 | Emergency revoke | Kill switch to instantly disable all agent policies and revoke all keys |
 | Agent delegation | Agents delegate narrowed scopes to sub-agents with depth limits and cascade revocation |
 | Policy simulation | Dry-run authorization checks return detailed pass/fail report without issuing tokens |
+| Webhook notifications | HMAC-signed real-time alerts for 17 security event types with auto-disable on failures |
+| Policy templates | 8 pre-built security profiles (read-only, dev, CI/CD, admin, paranoid) with risk assessment |
+| Usage quotas | Daily/monthly/total token budgets with configurable actions (deny, warn, step-up) |
 | API key hashing | Keys are SHA-256 hashed at rest. Raw keys shown only once at creation |
 | Token rotation | Token Vault handles automatic refresh and rotation |
 | Audit logging | Every token request, policy change, and connection event is logged |
@@ -65,7 +68,7 @@ AgentGate is built entirely on Auth0 primitives:
 - **Policy engine**: Eight-stage enforcement (existence, active status, ownership, expiration, time windows, IP allowlist, service authorization, scope validation, rate limiting)
 - **Dual authentication**: Session-based auth for dashboard users, API key auth (Bearer tokens) for agents
 - **Agent-key binding**: API keys are bound to specific agents -- an agent cannot use another agent's key to request tokens
-- **Test suite**: 1,896 tests across 51 test files covering policy enforcement, CIDR IP validation, time windows, rate limiting, scope intersection, multi-tenant isolation, security injection, API key lifecycle, audit trails, agent delegation chains, policy simulation, and edge cases
+- **Test suite**: 2,333 tests across 61 test files covering policy enforcement, CIDR IP validation, time windows, rate limiting, scope intersection, multi-tenant isolation, security injection, API key lifecycle, audit trails, agent delegation chains, policy simulation, webhook notifications, policy templates, usage quotas, and edge cases
 - **Type safety**: Pydantic models for all API requests, dataclasses for domain objects
 - **Starlette TemplateResponse**: Updated to current API format (no deprecation warnings)
 
@@ -101,6 +104,9 @@ Auth0's Token Vault, CIBA, and Connected Accounts already provide the building b
 - Policy engine = the missing layer that maps agent identity to permitted actions
 - Delegation chains = safe agent-to-agent permission sharing with scope narrowing at every hop
 - Policy simulation = debuggable authorization without side effects
+- Webhook notifications = real-time incident response for security teams
+- Policy templates = security best practices encoded as reusable profiles
+- Usage quotas = budget-based access control for cost and risk management
 
 ## Architecture