Building the authorization layer for AI agents

The agent wallet

Shipping: Sanction MCP is the wallet an agent carries, not another tool server. A **Wallet Card** at `/.well-known/wallet-card.json` is how other agents discover carry / present / verify. **`POST /v1/mandate/verify`** lets a counterparty check a presented execution JWT with no API key. stdio MCP stays cooperative — the honesty contract is on the card. Next after this: the hosted remote MCP endpoint, then broker mode that intercepts `tools/call`.

Adopt without flipping the switch

Shipped: **observe mode** runs the real decision engine on a live fleet and records exactly what it would have done — blocking nothing, moving no counters — so you watch a week of would-be denials and the dollars behind them on the Observe console, then flip each pool to enforce in one confirm-gated click, the revision chain marking when enforcement went live. The do-nothing on-ramp: adopt quietly, enforce when the numbers convince you.

Sanction Local: from runtime to install

Shipped: the air-gapped runtime (local models, fail-closed egress denial, every denied attempt in the audit trail) now has its install package — the **no-egress** policy pack (only on-box tools pass; cloud calls deny and persist) and the Audit console's signed, hash-chained evidence download an assessor verifies self-contained. Regulated practices first.

Distribution by channel

Compatibility badges, channel-shaped policy packs, and install paths for MCP hosts, coding agents, LLM gateways, agencies, and payment-agent pilots — each previewable against your real history before you apply it.

Governed in every runtime

One authorization plane, wherever the agent runs — MCP (the wallet the agent carries), the SDK's framework adapters (the tool executes behind the decision, shipped for TypeScript and the Vercel AI SDK), and Bedrock. Hosted MCP that sits in front of any tool server is the next front door, not a claim we make on stdio today.

Tamper-evident audit exports

Shipped: the decision history exports as a signed, hash-chained document any recipient can verify self-contained — altering, dropping, or reordering a row names the broken link. Governance as cryptographic evidence.

Hosted remote MCP — the wallet endpoint

stdio is a client. The launch is a URL: OAuth or API-key onboarding, Streamable HTTP, the agent is issued a wallet endpoint. v1 can still be cooperative. v1.1 is broker mode — Sanction fronts other MCP servers and intercepts `tools/call` through the existing `/authorize/tool` ladder, the way the LLM gateway already intercepts inference.

The published SDK + the Python side

@sanction/sdk is publish-ready (0.6.0, FSL, escalate-loop helpers) — run the publish-sdk workflow once the npm org is wired. Shipped in-repo: Python `sanction-sdk` with a LiteLLM callback (`SanctionLiteLLMLogger`) that posts usage to `/tokens` after the call — not a pre-call wall (that's still `/api/gateway`). Next: PyPI, then LangChain/LangGraph + CrewAI over the same client.

Sequential simulation, all the way down

Sequential replay shipped for per-agent budgets; next it threads pooled and subtree caps too, and the console's simulation preview grows an as-recorded vs sequential toggle.

Audit chain anchors

Exports are tamper-evident today; anchoring each export's head to the next seals the history across time — evidence that outlives any single document.

Customer-managed keys + SOC 2

Bring-your-own encryption keys and the compliance attestations enterprises require.

Mandate authority (AP2 / x402)

Hold the mandate, not the rail — policy, consent, and audit in front of whichever agent-payment standard wins. First slice shipped: pay-per-crawl quotes (Cloudflare, x402-settled) governed as spend decisions via the SDK’s sanctionedFetch. Next: settlement reconciliation (crawler-charged receipts vs decisions) and mandate scopes.