decern — Python client

Website · Repository · Commands · Issues

Ask whether an action is allowed, and get an answer somebody can check afterwards. Standard library only — no requests, no httpx. Python ≥ 3.11.

uv add decern
# and a server to ask:
cargo install decern-server && decern-serve --trust-proxy
# and, to check the log afterwards:
cargo install decern-cli

from decern import Client

c = Client("http://127.0.0.1:8080")  # optionally: token="…"

d = c.evaluate(
    subject={"type": "Principal", "id": "corp"},
    action="Read",  # or {"name": "Read"}
    resource={"type": "Resource", "id": "claim1"},
)

d.allowed   # True / False
d.reasons   # ids of the policies that decided it, permit or forbid
d.errors    # evaluation failures and server gates (a missing Mission); neither: a default deny

When token is set it is sent as Authorization: Bearer on every request, for a deployment that requires bearer tokens on the evaluation endpoint.

Also on the client: c.pubkey() (the Ed25519 key id the log is signed with) and c.healthy(). A non-2xx response or transport failure raises DecernError with the HTTP status and body, so a denial is distinguishable from a misconfigured endpoint. context reaches the policies wherever the model's schema declares it, apart from keys the server reserves for the caller, the Mission and the challenge. The server sets now from its own clock, and records the accountable owner and any verified caller itself, whatever the context says.

What the server gives you

decern is an AuthZEN 1.0 authorization server whose safety rules are machine-checked over the model's symbolic input space (what that covers), and whose decisions land in an append-only, signed, hash-chained log before they are served — a decision that cannot be recorded is refused, and a third party can verify what was decided without trusting the operator:

decern verify --ledger <file> --pubkey <key>   # the chain and every signature
decern explain --ledger <file> --seq 12        # one decision, in full

Obtain the public key out of band; a key handed over by the party being audited establishes nothing.

Test

cd sdks/python && python -m unittest discover -v

Apache-2.0. Published from CI by OIDC with no stored credential.