Cedar-powered authorization for AI agents

Usage: agentguard [OPTIONS] <COMMAND>

Commands:
  init       Initialize a new agentguard store in the current directory
  validate   Validate policies against the schema
  authorize  Run a single authorization check from a request file or stdin
  sim        Simulate: same as authorize, but always reads from a file and pretty-prints
  delegate   Mint a delegation token
  verify     Verify and inspect a delegation token
  api-key    Manage standalone PDP API keys
  schema     Inspect the schema
  log        Tail/query the audit log
  audit      Audit log operations (verify, export, SAR, erase, notarize)
  gen        Generate Cedar policy from a natural language description (requires OPENAI_API_KEY or
             ANTHROPIC_API_KEY env)
  doctor     Diagnose a deployment: schema, policies, audit log, chain, authorizer
  help       Print this message or the help of the given subcommand(s)

Options:
      --store <STORE>              Path to policy store (default: .agentguard, or $AGENTGUARD_STORE)
                                   [env: AGENTGUARD_STORE=] [default: .agentguard]
      --audit <AUDIT>              Path to decision log (default: .audit/decisions.jsonl, or
                                   $AGENTGUARD_AUDIT) [env: AGENTGUARD_AUDIT=] [default:
                                   .audit/decisions.jsonl]
      --output <OUTPUT>            Output format (json|pretty) [default: pretty]
      --secret-file <SECRET_FILE>  Path to the HMAC chain secret file. Subcommands that write to the
                                   audit log (`authorize`, `audit verify`) consult this when
                                   `AGENTGUARD_CHAIN_SECRET` is unset. Ignored otherwise [env:
                                   AGENTGUARD_CHAIN_SECRET=]
  -h, --help                       Print help
  -V, --version                    Print version