Building the authorization layer for AI agents

The agent wallet

Shipped: Wallet Card at `/.well-known/wallet-card.json`, **`POST /v1/mandate/verify`**, and a **hosted wallet URL** at `/mcp` (Streamable HTTP, agent API key). stdio and the URL are both cooperative — the honesty contract is on the card. Next: broker mode that intercepts `tools/call`.

Adopt without flipping the switch

Shipped: **observe mode** runs the real decision engine on a live fleet and records exactly what it would have done — blocking nothing, moving no counters — so you watch a week of would-be denials and the dollars behind them on the Observe console, then flip each pool to enforce in one confirm-gated click, the revision chain marking when enforcement went live. The do-nothing on-ramp: adopt quietly, enforce when the numbers convince you.

Sanction Local: from runtime to install

Shipped: the air-gapped runtime (local models, fail-closed egress denial, every denied attempt in the audit trail) now has its install package — the **no-egress** policy pack (only on-box tools pass; cloud calls deny and persist) and the Audit console's signed, hash-chained evidence download an assessor verifies self-contained. Regulated practices first.

The MCP broker — tools/call is intercepted

Shipped (BROKER-1): register an upstream MCP server on the wallet (`POST /v1/broker/upstreams` — the upstream credential is SEC-1-vaulted, the agent never holds it) and point the host at **`/mcp/broker/<upstream>`**. Every `tools/call` runs the full tool ladder — inheritance, conditions, observe, evidence — BEFORE it is forwarded; denials and escalations come back as proper MCP results with the machine code, and an approval is redeemed by retrying with `_meta["sanction/grant_id"]`. On brokered traffic, a hijacked agent cannot invoke what policy forbids. Honest scope: traffic that bypasses the broker is not governed; the plain wallet URL stays cooperative. Next: OAuth onboarding and tools/list filtering.

Rules that read the clock and the meter

Shipped (COND-1): a tool rule can carry a **`when`** — a closed vocabulary, one predicate per rule. `outside_hours_utc` makes deploys escalate outside business hours; `after_model_calls_today` is the runaway breaker — block everything once the agent's model calls pass N today. Restrictive effects only, never a conditional allow. Signals are captured once per request by the shell and persisted in the decision's evidence, so replay reads the snapshot, never the live clock — determinism holds. Conditions inherit down the tree like every other rule. Next: more signals (spend pace, denial rate) once each has an honest persisted source.

Rules inherit down the wallet tree

Shipped (INHERIT-1): tool and capability decisions now consult every ancestor policy — each layer evaluated independently through the pure ladder, verdicts folded deny > escalate > allow, the root-most objector named in the decision. **A child may tighten, never loosen**: an org can block `payments.charge` once and no team below can allow it back, while a permissive parent can never widen a team's strict allow-list. No copy-down — every wallet keeps its own revision chain, and evidence records the deciding layer plus every consulted revision. Same fold on the native routes and the AuthZEN PDP. The console shows inherited constraints read-only, named by parent. Next: spend-threshold inheritance stays deliberately out — money ceilings are per-team by design; the tree-wide money control is the subtree cap.

The console is a roster, and wallets have people

Shipped: the dashboard home is a **roster** — the wallet tree as groups, agents as cards, a mandate stamp (live / paused / blocked) on each — with the rail trimmed to three items. Wallets now carry **people**: team membership with roles, a wallet switcher that reaches every membership, and a viewer role that cannot mutate; an org owner decides escalations anywhere in their subtree. **Month runway** draws cumulative burn against the monthly cap with the projected exhaust date, and **seat health** flags the seats whose denial rate is hot or climbing, each with the decision code it keeps hitting. Operators get numbers they can act on, not a monthly report of zeros.

Distribution by channel

Compatibility badges, channel-shaped policy packs, and install paths for MCP hosts, coding agents, LLM gateways, agencies, and payment-agent pilots — each previewable against your real history before you apply it.

Governed in every runtime

One authorization plane, wherever the agent runs — MCP (stdio or the hosted `/mcp` URL), the SDK's framework adapters (the tool executes behind the decision, shipped for TypeScript and the Vercel AI SDK), and Bedrock. Broker mode that sits in front of any tool server is Next, not a claim we make on the URL today.

Tamper-evident audit exports

Shipped: the decision history exports as a signed, hash-chained document any recipient can verify self-contained — altering, dropping, or reordering a row names the broken link. Governance as cryptographic evidence.

Slack is a live approval surface

Shipped: **Sanction for Slack** at `/slack` lets a wallet admin install into a workspace and choose the approval channel. Escalations arrive as interactive **Approve/Deny** cards; every click verifies Slack's signature, is bound to that install, and resolves through the same grant and audit path as the dashboard. Incoming webhooks still deep-link, and pasted archive URLs plus `SANCTION_SLACK_BOT_TOKEN` remain the platform-token fallback. MCP Apps wait on the v2 SDK.

Per-agent Wallet Cards

This seat, this remaining budget band, never the key. Attach to A2A Agent Cards so a peer can fetch constraints before a task. The platform card at `/.well-known/wallet-card.json` is the issuer's card.

Decision receipts

A hash-chained slip both parties keep after a governed action. AUDIT-1 is wallet-scoped export; A2A needs per-decision. Same carry / present / verify / evidence pathway — not a parallel log.

The published SDK + the Python side

Shipped: **`npm install sanction-sdk`** is live (0.8.0, FSL, zero runtime dependencies — renamed from the planned `@sanction/sdk` scope to publish unscoped like `sanction-mcp`). `SanctionClient` + `SanctionAdminClient`, the escalate→grant loop, and the framework adapters. Python is in-repo: `packages/sanction-python` (same `sanction-sdk` name) ships `SanctionLiteLLMLogger` — LiteLLM usage posted to `/tokens` after the call, httpx-only runtime. Next: PyPI publish, then LangChain/LangGraph + CrewAI over the same client.

Sequential simulation, all the way down

Sequential replay shipped for per-agent budgets; next it threads pooled and subtree caps too, and the console's simulation preview grows an as-recorded vs sequential toggle.

Audit chain anchors

Exports are tamper-evident today; anchoring each export's head to the next seals the history across time — evidence that outlives any single document.

Customer-managed keys + SOC 2

Bring-your-own encryption keys and the compliance attestations enterprises require.

Mandate authority (AP2 / x402)

Hold the mandate, not the rail — policy, consent, and audit in front of whichever agent-payment standard wins. Shipped so far: pay-per-crawl quotes (Cloudflare, x402-settled) governed as spend decisions via the SDK’s sanctionedFetch, and a **rail-aware ledger** (STABLE-0) — `/v1/authorize` takes optional settlement metadata (`x402`/`usdc`/`base`, closed vocabulary), inert to the decision, recorded in the audit trail. Stablecoin settlement is irreversible, so pre-transaction authorization is the only control point. **The x402 spend gate is live** (STABLE-1): post a 402 challenge to `/v1/authorize/quote`, or let the MCP broker intercept one — Sanction prices the quote and runs it through the same ladder before the wallet signs, and on the broker a refused challenge is WITHHELD, so an agent cannot sign payment requirements it never received. USD-pegged stablecoin quotes only; an amount we would have to guess a rate for is denied, never estimated. Next: settlement receipts reconciled back to decisions, and the wallet-provider co-signer (veto-only).