Choose an interface.

AuthZEN HTTP

POST /access/v1/evaluation accepts the following starter-schema request. Context includes args and session; required arguments vary by action.

{
  "subject": {
    "type": "Agent",
    "id": "research"
  },
  "action": {
    "type": "Action",
    "id": "ToolCall::repo_read"
  },
  "resource": {
    "type": "Repository",
    "id": "demo"
  },
  "context": {
    "args": {
      "repo": "demo"
    },
    "session": {
      "mfa": true
    }
  }
}

{"decision": true}

The response contains a boolean decision and optional reason/context. Proceed only on a successful response with decision exactly true. A false decision is a normal authorization result. Authentication errors, malformed responses, timeouts, and HTTP failures must stop the tool.

Batch evaluation

POST /access/v1/evaluations accepts an evaluations array, capped at 100. Optional evaluation_semantics supports execute_all, deny_on_first_deny, and permit_on_first_permit. Each nested evaluation may include its own entities array; entity sets are evaluated independently and malformed entities fail the batch. The response contains an evaluations array; early-exit modes can return fewer results than requests.

Integration examples

import { Client, Principal, Action } from "agentguard";

const guard = new Client({ store: ".agentguard" });
guard.check(
  Principal.agent("research"),
  Action.tool("repo_read"),
  { entity_type: "Repository", uid: "demo", attrs: { org: "example" } },
  { args: { repo: "demo" }, session: { mfa: true } },
);
// Permission granted. Your application may now run the tool.
// On denial, check() throws AuthorizationDenied.

curl --fail-with-body http://127.0.0.1:8443/access/v1/evaluation \
  -H 'Content-Type: application/json' \
  -d '{
  "subject": {
    "type": "Agent",
    "id": "research"
  },
  "action": {
    "type": "Action",
    "id": "ToolCall::repo_read"
  },
  "resource": {
    "type": "Repository",
    "id": "demo"
  },
  "context": {
    "args": {
      "repo": "demo"
    },
    "session": {
      "mfa": true
    }
  }
}'
# Proceed only if the response succeeds and decision === true.

agentguard validate
agentguard --output json authorize request.json
agentguard sim request.json
agentguard log tail --n 10
agentguard doctor

use agentguard_core::{AgentRequest, Authorizer, PolicyStore};
use cedar_policy::Entities;

let store = PolicyStore::open(".agentguard")?;
let authorizer = Authorizer::new(store)?;
let req: AgentRequest = serde_json::from_str(request_json)?;
// This policy uses IDs and context, not entity attributes.
let entities = Entities::empty();
let decision = authorizer.authorize(&req, &entities)?;
// Check decision.effect before executing the tool.
// Append to your configured DecisionLog at this boundary.

import { AgentGuard, guarded } from "./guard.js";

const guard = new AgentGuard({
  principal: { type: "Agent", id: "research" },
  resource: { type: "Repository", id: "demo" },
});
// Wrap your tool config before registering it with Strands:
const protectedTool = guarded(guard, toolConfig);
// The callback runs only after an explicit HTTP allow.
// Tailor the schema and policy to toolConfig's input.

TypeScript SDK behavior

Build with pnpm install and pnpm --filter agentguard build at the repository root. The package exports Client, Principal, Action, AuthorizationDenied, StepUpRequired, and CLIUnavailable. It wraps a local Node.js CLI process; it is not a browser SDK or remote HTTP client.

Existing synchronous methods remain available for scripts but block the Node.js event loop. In web servers and other concurrent Node.js applications, use Client.authorizeAsync / Client.checkAsync for authorization, Client.logTailAsync for audit reads, and Client.delegateAsync for delegation. Async CLI operations default to a 30-second timeout, allow at most 8 concurrent children per Client, and cap combined output at 8 MiB. Configure these limits with ClientOptions.timeoutMs and ClientOptions.maxConcurrentCliProcesses.

Client.check and Client.checkAsync throw on deny. authorize and authorizeAsync return a Decision unless check is requested. For a step-up denial, onStepUp: "return" returns the decision; the default raises StepUpRequired. The current core/server path does not emit step-up decisions. BearerToken is passed as AGENTGUARD_BEARER; the local CLI does not validate or forward it to a remote PDP. No SDK option currently produces DPoP proofs.

gRPC

Enable the loopback listener with --grpc-listen 127.0.0.1:9443. The repository-defined service is agentguard.v1.AccessEvaluation/Evaluation. It mirrors the HTTP single evaluation with context_json and entities_json strings. Use the checked-in protobuf to generate clients. The listener is plaintext and does not constitute a standardized AuthZEN gRPC protocol.

CLI commands

Global flags: --store, --audit, --output, --secret-file. Use each command’s --help for arguments. The server is agentguard-server, not agentguard serve. Policy diff/version/blast-radius APIs live in the Rust library, not an agentguard policy command.

Framework compatibility

The Strands directory is a supported repository example using HTTP and a guard/intervention hook. The Rust example mounts build_router. Other frameworks can implement the same tool-boundary contract. There are no official LangChain, MCP, or Kubernetes adapters in these examples.

Source references: TypeScript API, CLI parser, HTTP request and response types.