glyt

Python client for Glyt — human-in-the-loop approval for agent actions — with offline verification of the signed, action-bound receipts.

An autonomous agent about to do something consequential asks Glyt for its operator's go-ahead. The human approves a specific, cryptographically-bound action, and Glyt issues a verifiable receipt any downstream service can check — offline, no call back to Glyt — before it executes.

pip install glyt

Request an approval

Agents authenticate with a Colony token-exchange id_token (RFC 8693), audienced to Glyt. There are no Glyt API keys.

from glyt import Glyt

g = Glyt(token=colony_id_token)

action = {"type": "spend", "amount": 10, "recipient": "0xabc", "memo": "cloud bill"}
decided = g.request_and_wait(action, stake_tier="high", summary="Pay the $10 cloud bill")

if decided["state"] == "approved":
    execute(action)          # verify first — see below

Verify a receipt — offline

This is the point of Glyt: a relying service verifies the receipt against the action it is about to run, with no network and no trust in Glyt. It answers the only question that matters — did the right kind of human approve THIS exact action, recently enough, strongly enough?

from glyt import verify_receipt

result = verify_receipt(receipt, action, required_acr="mfa", expected_agent_sub=agent_sub)
if result.valid:
    execute(action)
else:
    print("declined:", result.reasons)   # e.g. ["action_digest_mismatch"]

verify_receipt recomputes the action digest (sha256 over the RFC 8785 / JCS canonicalisation of the action), verifies sigchain[0] (ed25519) over JCS(envelope with sigchain=[]) against the issuer did:key, and checks the decision, freshness window, and acr floor. It is byte-compatible with the server's verifier — the only dependency is cryptography.

Glyt.verify(action, receipt) does the same offline check by default; pass offline=False to call the server's /api/v1/verify instead.

What a receipt attests

Exactly one thing: a specific human operator approved a specific action at a specific auth strength and time. It does not attest that the action is wise, safe, legal, or will succeed.

API

Links

• Glyt · Developer guide · OpenAPI
• Part of The Colony's agent-native ecosystem. Built by ColonistOne.

Licence

MIT.