mizara 0.5.0

Mizara - programmable authorization layer for AI actions

Mizara SDK - Python

Authorization layer for AI agents. Call authorize() before any consequential action. Sub-2ms evaluation, policy-as-data, cryptographic receipt on every decision.

Also available for TypeScript/Node.js: @mizara/sdk

Install

pip install mizara

Quickstart

Local policy file

from mizara import create_mizara_client

mizara = create_mizara_client(policy_path="./policy.json")

result = mizara.authorize(
    actor={"id": "agent_support_v4", "type": "autonomous_agent"},
    action={"name": "execute_refund"},
    resource={"type": "monetary_transaction", "id": "tx_99210",
              "attributes": {"amount": 75, "currency": "USD"}},
)

if result.status == "DENY":
    raise Exception(result.enforcement.user_facing_error)
# result.status                   -> 'ALLOW' | 'DENY' | 'REDACT' | 'RE_ROUTE'
# result.cryptographic_receipt.id -> 'rcpt_8f3c...'

Hosted API - sign up at mizara.ai/signup, skip the local file:

import os
from mizara import create_mizara_client

mizara = create_mizara_client(
    api_key=os.environ["MIZARA_API_KEY"],
    client_id="acme_corp",
)

result = mizara.authorize(
    actor={"id": "agent_1", "type": "autonomous_agent"},
    action={"name": "execute_refund"},
    resource={"type": "monetary_transaction", "id": "tx_1",
              "attributes": {"amount": 75}},
)

Hosted mode evaluates locally against a policy snapshot that's refreshed in the background (every 10 seconds by default). A Mizara outage doesn't fail every authorize() call, it keeps using the last policy successfully fetched. Receipts are generated locally and flushed to the hosted API asynchronously. For zero-loss delivery across a process crash, pass receipt_log_path:

mizara = create_mizara_client(
    api_key=os.environ["MIZARA_API_KEY"],
    client_id="acme_corp",
    receipt_log_path="./mizara-receipts.log",
    on_sync_error=lambda err: print(f"[mizara] policy sync failing: {err}"),
)

Call mizara.close() before your process exits to stop the background sync thread (a no-op in local mode, safe to always call). Construction blocks briefly for the first policy sync to settle (bounded by a 10-second network timeout) since Python has no async equivalent to return immediately and resolve later.

Waiting on a RE_ROUTE decision - a RE_ROUTE result means the action is held pending human approval. In hosted mode, wait_for_approval blocks until it's approved, denied, or the timeout elapses:

result = mizara.authorize(...)

if result.status == "RE_ROUTE":
    outcome = mizara.wait_for_approval(result.cryptographic_receipt.id)
    # outcome: "APPROVED" | "DENIED" | "TIMEOUT"

Only available on the hosted client; local mode has no server to hold pending approval state. Defaults to polling every 3 seconds for up to 25 minutes.

Policy format

Plain JSON. No Rego, no Cedar syntax.

{
  "policy_id": "pol_refund_v1",
  "client_id": "acme_corp",
  "rules": [
    {
      "id": "rule_max_refund",
      "target_action": "execute_refund",
      "condition": "resource.attributes.amount <= 50.00",
      "effect": "ALLOW",
      "fallback_effect": "DENY",
      "remediation_message": "Refund exceeds the $50 unapproved threshold."
    }
  ]
}

Condition expressions support comparisons, boolean logic, arithmetic, and .contains():

resource.attributes.amount <= 50.00
context.jurisdiction == 'EU' && context.data_classification.contains('PII')
context.session_total + resource.attributes.amount <= 500

Integrations

Framework	Example
LangGraph	examples/langgraph/
OpenAI Agents SDK	examples/openai-agents/
Hosted API	examples/hosted-api/

Design choices

Fail closed. No matching rule returns DENY, not ALLOW.

Most restrictive wins. When more than one rule matches an action, the most restrictive triggered outcome wins - DENY > RE_ROUTE > REDACT > ALLOW - regardless of rule order.

Resilient by default, with one honest exception. Hosted mode evaluates locally against a synced policy, so a Mizara outage doesn't stop your agent. A rule that uses context.session_total is the one case that can't get this guarantee: cumulative tracking is inherently centralized state, so if the session store is unreachable, that specific request fails closed rather than silently trusting a stale total.

Policy as data. Rules live in a JSON file that non-engineers can edit without a deploy.

No Cedar or Rego. Conditions are plain boolean expressions. The engine compiles them safely without eval().

Receipt on every call. Even ALLOW decisions are signed and stored. The audit trail is part of the product, not an afterthought.

License

Apache-2.0