All starter kits

Agent Governance

Verify capabilities and delegation before granting access

An autonomous agent requests access to payment execution and customer PII. Your current guard is a manual checklist. Replace it with a Patchr capability audit: verify each claimed capability against source-bound evidence, trace the delegation chain, and get back a grant / deny / escalate decision with a sealed proof card.

Run in sandbox Workflow template

Agent route

ResolveProxy→ proof card
Before Patchr

Manual process, no audit trail, inconsistent outcomes.

// Before: manual checklist — no delegation audit
async function grantAccess(agentRequest) {
  // ❌ Capabilities are self-reported — not verified
  // ❌ Delegation chain not traced
  // ❌ No tamper-evident access decision record
  const approved = await manualCapabilityReview(agentRequest);
  if (approved) {
    await issueAccessToken(agentRequest.agentId);
  }
}
After Patchr — Node.js

One SDK call. Evidence map, proof card, and recommended action returned.

import { PatchrClient } from "@patchr-core/sdk";

const patchr = PatchrClient.fromEnv();

async function grantAccess(agentRequest) {
  const run = await patchr.runOrchestrator({
    clientId:       "agent-governance",
    channel:        "api",
    conversationId: `conv_agent_${agentRequest.agentId}`,
    request: `Verify agent ${agentRequest.agentId} claiming capabilities:
${agentRequest.claims.join(", ")}.
Check delegation chain from operator root.
Return grant / deny / escalate decision.`,
    metadata: {
      agentId:         agentRequest.agentId,
      claimedCapabilities: agentRequest.claims,
      delegationDepth: agentRequest.delegationDepth,
    },
  });

  // ✅ Each claimed capability checked against verifiable sources
  // ✅ Delegation chain audited — gaps flagged
  // ✅ Sealed proof card: grant | deny | escalate
  const decision = run.proofCard?.recommendedRestraint;
  if (decision === "proceedSafely") {
    await issueAccessToken(agentRequest.agentId);
  }
  return { decision, proofCard: run.proofCard };
}
After Patchr — Python

Same integration using the raw HTTP API with the httpx client.

import os, httpx

PATCHR_API   = os.environ["PATCHR_API_BASE_URL"]
PATCHR_TOKEN = os.environ["PATCHR_API_TOKEN"]

def grant_access(agent_request):
    claims_str = ", ".join(agent_request["claims"])
    resp = httpx.post(
        f"{PATCHR_API}/v1/orchestrator/run",
        headers={"Authorization": f"Bearer {PATCHR_TOKEN}"},
        json={
            "clientId":       "agent-governance",
            "channel":        "api",
            "conversationId": f"conv_agent_{agent_request['agentId']}",
            "request": (
                f"Verify agent {agent_request['agentId']} claiming capabilities: "
                f"{claims_str}. Check delegation chain from operator root. "
                "Return grant / deny / escalate decision."
            ),
            "metadata": {
                "agentId":           agent_request["agentId"],
                "claimedCapabilities": agent_request["claims"],
                "delegationDepth":   agent_request.get("delegationDepth"),
            },
        },
    )
    run = resp.json()

    decision = run.get("proofCard", {}).get("recommendedRestraint")
    if decision == "proceedSafely":
        issue_access_token(agent_request["agentId"])
    return {"decision": decision, "proofCard": run.get("proofCard")}

Output shape

A consistent proof card — every run.

Whether you run a dispute audit or an agent governance check, the output shape is identical. External systems — dashboards, decision ledgers, compliance tools — consume the same format regardless of which workflow produced it.

evidenceStatus — sourceBound | verified | partial

confidence — 0–1 score from the evidence map

recommendedRestraint — proceedSafely | proceedWithCaution | escalateBeforeActing

cite — portable proof ref for cross-system ledgers

Proof card format

Sample output

{
  "status": "ready",
  "route": ["resolve", "proxy"],
  "proofCard": {
    "title":                "Agent due diligence: payment-executor-v2",
    "evidenceStatus":       "sourceBound",
    "confidence":           0.79,
    "openQuestions":        ["delegationChainComplete", "capabilitySourceVerified"],
    "recommendedRestraint": "escalateBeforeActing",
    "cite":                 "patchr:proofCard:card_agent_...#v1"
  }
}

Ready to run it?

Verify recruiter Jane Smith claiming to represent Microsoft (jane@ms-careers.example.com). Check email domain, LinkedIn profile, and whether a fee was requested. Flag if this looks like a scam.

Open in sandbox