Skip to main content

Component: SDK Client

What it is: a thin orchestrator-side library — consent(), authorize(), hop(), with context propagation of the act chain and (once Phase 4 ships) taint.

What it does: the same decide → exchange sequence the sidecar enforces externally, called inline from the agent's own process — for the orchestrator code that starts a session and needs its own narrowed token to call the first hop, or any agent code that wants richer Python exceptions than an HTTP 403.

Why authorize/hop never return a decision without also exchanging: a decision without an exchange would leave the caller holding a token that hasn't actually been narrowed for the approved call, and an exchange without a fresh decision would issue authority nobody just approved. The two always happen together, and a deny is raised as PolicyDenied rather than returned as a value a caller could accidentally ignore — routing around the SDK's own denial is exactly the failure mode this product exists to prevent.

Why hop depth lives in the token, not in the client: HopContext carries only session_id and token — its .hop and .act_chain properties are derived by decoding the token's own verified claims, so a client process can never drift out of sync with the signed truth by, say, forgetting to increment a counter.