Architecture overview
The agentic authorization SDK is a portable Policy Decision Point (PDP) and Policy Enforcement Point (PEP) for multi-hop AI agent systems: authority is declared as a versioned manifest, narrowed at every hop, enforced before dispatch, and recorded as a queryable delegation chain back to the consenting human.
This page is the map. Every node below has its own page, with its own sequence diagram, under Explanation → Components — this diagram exists so those pages share one consistent vocabulary (a name used here is the same name used there).
Not every component on this diagram has shipped code yet. PEP — Gateway, PEP — Boundary
adapters, and the enrollment/revocation half of Identity Registry / Verifier are
Phase 5/Phase 4 design, not yet built (docs/phases/README.md) — see each component's own page
for its status.
Reading the diagram
- One consent, many hops. A human consents once (
SDK); every subsequent hop is decided by thePDPagainst that one pinned policy version — no agent re-asks the human. - Enforcement is pluggable, decision is not. Whichever enforcement point sits at a boundary
(sidecar, gateway, or a boundary adapter), it always calls the same
PDPand the sameToken Exchange Service— see Enforcement point tradeoffs for why there are three. All three exist to answer the same question, "can this caller do this, at this hop, given this taint" — see PDP. - Two things gate every decision beyond scope: the
Provenance / Taint Engine(was this input trustworthy?) and, once identity enforcement is deployed, theIdentity Registry / Verifier(is this really the agent it claims to be?). See The taint and provenance model. - The audit log is the source for two different reads: a full chain back to the consenting
human (
Delegation-Chain Query API), and a diff against what was actually declared (CI Drift Action). Both read the same append-only rows; neither can see an uncommitted decision.
The 15 components
| # | Component | Page |
|---|---|---|
| C1 | Manifest Store | manifest-store |
| C2 | Capability Discovery | capability-discovery |
| C3 | Reconciler | reconciler |
| C4 | DAG Compiler | dag-compiler |
| C5 | PDP | pdp |
| C6 | Token Exchange Service | token-exchange-service |
| C7 | PEP — Sidecar | pep-sidecar |
| C8 | PEP — Gateway | pep-gateway |
| C9 | PEP — Boundary adapters | pep-boundary-adapters |
| C10 | Provenance / Taint Engine | provenance-taint-engine |
| C11 | Audit Log | audit-log |
| C12 | Delegation-Chain Query API | delegation-chain-query-api |
| C13 | Identity Registry / Verifier | identity-registry-verifier |
| C14 | CI Drift Action | ci-drift-action |
| C15 | SDK Client | sdk-client |
| C16 | Observability Layer | observability-layer |