Agent Authority Chain Python client

Fail-closed authorization for consequential AI-agent actions. Use this package when a principal delegates constrained authority to one or more agents and the protected operation must reject widened, expired, revoked, malformed or unverifiable authority.

AAC is an authority decision layer, not agent identity or authentication alone. It verifies Ed25519-signed delegation chains, constraint narrowing and revocation before returning a signed permit or deny receipt. Network failure, malformed output, authentication failure or an invalid receipt signature never becomes permission.

pip install agentauthoritychain==0.5.2

from aac_client import AACClient, AACDenied, AACError

client = AACClient.from_env()  # reads AAC_API_CREDENTIAL
try:
    result, receipt = client.enforce(signed_scenario, execute_protected_operation)
except (AACDenied, AACError):
    deny_operation()

enforce invokes the protected operation only after AAC returns an exact permit with a valid Ed25519 decision-receipt signature. AACDenied is a verified denial; configuration, authentication, transport, protocol and receipt failures use specific AAC*Error subclasses and remain closed. Async applications use the API-compatible AsyncAACClient.

Protect one framework tool

The same dependency-free guard works with OpenAI Agents SDK, Anthropic Agent SDK, LangGraph, and CrewAI callables. Your callback builds signed authority for the actual invocation; the tool never runs before a locally verified exact permit.

from aac_client import AACClient
from aac_framework_adapters import guard_openai_agents_tool

protected_tool = guard_openai_agents_tool(
    tool_handler,
    client=AACClient.from_env(),
    build_signed_scenario=build_signed_authority_for_call,
)

Equivalent named exports are guard_anthropic_agent_tool, guard_langgraph_tool, guard_crewai_tool, guard_claude_code_hook, and guard_codex_hook. They share one implementation and do not duplicate verifier semantics.

ADCS audit projection

aac_adcs.project_authority_chain creates a one-way ADCS v0.1.0 audit shape only after the caller supplies real per-hop runtime IDs, tools, scopes, timestamps, and remaining budget. Missing values are never invented. The projection cannot be imported as AAC authority and cannot release an operation.

When this package fits

• principal-to-agent or multi-hop delegated authority;
• capabilities with amount, resource, purpose, time or delegation-depth constraints;
• prevention of authority widening;
• immediate revocation and expiry checks before execution;
• auditable signed decision receipts;
• framework-neutral Python services, workers, APIs and automation.

For JavaScript use @agentauthoritychain/client; for MCP tool handlers use @agentauthoritychain/mcp-guard; other stacks can use the documented HTTP contract without adding Python.

Evaluate before configuration

python -m aac_public_test

All eight credential-free AAC/AACP cases must print PASS. They accept no private key, credential, production payload or caller-supplied authority chain. Then create an organization credential and register only the public issuer key through the Console. Private signing keys stay in your environment.

Requires Python 3.10+. The declared truststore dependency uses the operating-system certificate store on managed Windows systems without disabling TLS verification.

• Integration Wiki: https://agentauthoritychain.com/wiki/
• OpenAPI contract: https://agentauthoritychain.com/openapi.json
• Machine-readable discovery: https://agentauthoritychain.com/agents.json
• Canonical source: https://github.com/AgentAuthorityChain/aac
• Security reporting: https://agentauthoritychain.com/.well-known/security.txt

AAC supplies technical verification evidence. It is not legal authority, payment authorization, regulatory certification or independent proof of issuer legitimacy.