axiomatics-ai-sdk-python

Externalized attribute-based access control (ABAC) for AI applications.

Agents decide what to do; this SDK decides what they are allowed to do, by asking a Policy Decision Point (PDP) at every point where an agent turn touches something that matters: the prompt, the tool list, each tool call, each tool result, the final answer, agent-to-agent messages, and document retrieval. Policies live in the PDP, written once in a standard policy language, and apply the same way across LangChain, Google ADK, Strands, OpenAI Agents, the Claude Agent SDK, MCP servers, A2A agents, and your own code. No authorization logic in the application.

The SDK speaks XACML 3.0 JSON and OpenID AuthZEN, so it works with any PDP that implements either. It is developed and tested against Axiomatics ADS.

Where it fits

Every block below talks to the PDP through the SDK, which plays the Policy Enforcement Point (PEP): it builds the authorization request from the caller's identity and the thing being attempted, asks the PDP, and applies the answer.

When it intercepts

Along one agent turn the SDK can intercept at seven points. Each is a transformation of what flows through it; a Deny is the simplest case (block, hide, or filter).

Quick start

pip install "axiomatics-ai-sdk[langchain-agents]" langchain-litellm   # or: uv add ...

langchain-litellm is only the model this example uses; bring any LangChain chat model.

Wrap a LangChain agent. The context dict is the user's identity; the PDP decides which tools alice sees, which calls run, and which records come back.

from langchain.tools import tool
from langchain_litellm import ChatLiteLLM
from axiomatics_ai import AuthZConfig, PDPConnection, create_authorized_agent, standard_tool_enforcement

@tool
def search_docs(query: str) -> str:
    """Search internal documentation."""
    return "..."

config = AuthZConfig(
    connection=PDPConnection(base_url="http://localhost:8080"),
    enforcement=standard_tool_enforcement(),   # tool visibility + invocation + output filter
)

agent = create_authorized_agent(
    model=ChatLiteLLM(model="openai/gpt-5.6-luna"),
    tools=[search_docs],
    config=config,
)

agent.invoke({"messages": [{"role": "user", "content": "Find docs on deployment"}]},
             context={"username": "alice"})

No framework? Ask the PDP directly and enforce yourself (same config):

from axiomatics_ai import Authorizer

authz = Authorizer(config)
if not authz.is_permitted(action="read_document", resource="doc-42", context={"username": "alice"}):
    raise PermissionError

Every other framework has a one-call equivalent; see Integrations. Full walkthrough, including running a PDP and writing the first policy: Getting started.

What it covers

Not every framework exposes a hook at every point. ✅ supported · — not expressible there.

¹ OpenAI's guards are SDK guardrails: a block raises a tripwire the caller catches. ² The Claude Agent SDK has no tool-list filter and no hook that sees the final answer; its input guard is a hard block. ³ Experimental: not production grade yet; the gateway will move to its own package.

PDP compatibility

Endpoint paths are configurable, so a PDP that mounts the same protocols elsewhere needs only a PdpEndpoints override. Developed and tested against Axiomatics ADS 26.1.x over both protocols; single and batch decisions have also been exercised against other open-source PDPs over AuthZEN and XACML JSON. Details: Configuration.

Documentation

• Getting started → Configuration → Identity → Agent identity → Enforcement points → Content guards → Intent-based access control → Obligations and human approval → Post-invocation → Hooks → Security → Troubleshooting → Performance
• Integrations, one page per framework
• Architecture, Running Axiomatics ADS, Changelog

Examples and tests

Runnable examples for every integration are under examples/, each folder with a README naming the policy it needs; the policies are in examples/policies/.

uv sync --extra all
uv run pytest tests/          # unit tests need no PDP; integration tests start ADS from examples/policies/

License

Apache 2.0. See LICENSE.