Building the authorization layer for AI agents

The agent wallet

Shipped: Wallet Card at `/.well-known/wallet-card.json`, **`POST /v1/mandate/verify`**, and a **hosted wallet URL** at `/mcp` (Streamable HTTP, agent API key). stdio and the URL are both cooperative — the honesty contract is on the card. Next: broker mode that intercepts `tools/call`.

Adopt without flipping the switch

Shipped: **observe mode** runs the real decision engine on a live fleet and records exactly what it would have done — blocking nothing, moving no counters — so you watch a week of would-be denials and the dollars behind them on the Observe console, then flip each pool to enforce in one confirm-gated click, the revision chain marking when enforcement went live. The do-nothing on-ramp: adopt quietly, enforce when the numbers convince you.

Sanction Local: from runtime to install

Shipped: the air-gapped runtime (local models, fail-closed egress denial, every denied attempt in the audit trail) now has its install package — the **no-egress** policy pack (only on-box tools pass; cloud calls deny and persist) and the Audit console's signed, hash-chained evidence download an assessor verifies self-contained. Regulated practices first.

The console is a roster, and wallets have people

Shipped: the dashboard home is a **roster** — the wallet tree as groups, agents as cards, a mandate stamp (live / paused / blocked) on each — with the rail trimmed to three items. Wallets now carry **people**: team membership with roles, a wallet switcher that reaches every membership, and a viewer role that cannot mutate; an org owner decides escalations anywhere in their subtree. **Month runway** draws cumulative burn against the monthly cap with the projected exhaust date, and **seat health** flags the seats whose denial rate is hot or climbing, each with the decision code it keeps hitting. Operators get numbers they can act on, not a monthly report of zeros.

Distribution by channel

Compatibility badges, channel-shaped policy packs, and install paths for MCP hosts, coding agents, LLM gateways, agencies, and payment-agent pilots — each previewable against your real history before you apply it.

Governed in every runtime

One authorization plane, wherever the agent runs — MCP (stdio or the hosted `/mcp` URL), the SDK's framework adapters (the tool executes behind the decision, shipped for TypeScript and the Vercel AI SDK), and Bedrock. Broker mode that sits in front of any tool server is Next, not a claim we make on the URL today.

Tamper-evident audit exports

Shipped: the decision history exports as a signed, hash-chained document any recipient can verify self-contained — altering, dropping, or reordering a row names the broken link. Governance as cryptographic evidence.

Approve without leaving Slack

Shipped: incoming webhooks still deep-link. Interactive **Approve/Deny** posts via the Slack app (`chat.postMessage`). **Add to Slack** installs per workspace (OAuth) and encrypts the bot token on the wallet; pasted channel archive URLs plus `SANCTION_SLACK_BOT_TOKEN` remain the platform-token fallback. Same `resolveApproval` path as the dashboard. MCP Apps wait on the v2 SDK.

Hosted MCP broker — intercept tools/call

v1 issued the URL. v1.1 is broker mode — Sanction fronts other MCP servers and intercepts `tools/call` through the existing `/authorize/tool` ladder, the way the LLM gateway already intercepts inference. That is what makes "a hijacked agent cannot spend" true. Until then, do not claim interception on MCP. OAuth onboarding follows the API-key paste.

Per-agent Wallet Cards

This seat, this remaining budget band, never the key. Attach to A2A Agent Cards so a peer can fetch constraints before a task. The platform card at `/.well-known/wallet-card.json` is the issuer's card.

Decision receipts

A hash-chained slip both parties keep after a governed action. AUDIT-1 is wallet-scoped export; A2A needs per-decision. Same carry / present / verify / evidence pathway — not a parallel log.

The published SDK + the Python side

Shipped: **`npm install sanction-sdk`** is live (0.8.0, FSL, zero runtime dependencies — renamed from the planned `@sanction/sdk` scope to publish unscoped like `sanction-mcp`). `SanctionClient` + `SanctionAdminClient`, the escalate→grant loop, and the framework adapters. Next: the adapters where Python agents live — a LiteLLM callback and LangChain/LangGraph + CrewAI bindings over the same core, each with a runnable example. Next: the adapters where Python agents live — a LiteLLM callback and LangChain/LangGraph + CrewAI bindings over the same core, each with a runnable example.

Sequential simulation, all the way down

Sequential replay shipped for per-agent budgets; next it threads pooled and subtree caps too, and the console's simulation preview grows an as-recorded vs sequential toggle.

Audit chain anchors

Exports are tamper-evident today; anchoring each export's head to the next seals the history across time — evidence that outlives any single document.

Customer-managed keys + SOC 2

Bring-your-own encryption keys and the compliance attestations enterprises require.

Mandate authority (AP2 / x402)

Hold the mandate, not the rail — policy, consent, and audit in front of whichever agent-payment standard wins. First slice shipped: pay-per-crawl quotes (Cloudflare, x402-settled) governed as spend decisions via the SDK’s sanctionedFetch. Next: settlement reconciliation (crawler-charged receipts vs decisions) and mandate scopes.