// Code — tabbed SDK showcase: a few lines to add auth + agent identity + audit
function Code() {
const tabs = [
{ id:"policy", label:"policy.yaml", icon:"scroll-text", body:
`# first match wins · fail-closedrules:
- name: place-orderdecision: needs_approvalmatch: { method: POST, path: /orders }
constraints:
amount: { field: amount, max: 5000, currency: USD }
allow_list: { field: destination, in: [internal] }
default: deny# anything not allowed is refused` },
{ id:"propose", label:"propose.py", icon:"send", body:
`from delego import ProposedAction, build_firewall
fw = build_firewall(paths)
# the agent proposes — it never holds the secret
decision = fw.propose(ProposedAction(
instruction="place a small order",
method="POST",
url="https://api.acme.com/orders",
params={"amount": 2400, "destination": "internal"},
))
decision.outcome # -> 'needs_approval'
decision.approval_id` },
{ id:"resolve", label:"resolve.py", icon:"user-check", body:
`# a human approves out-of-band (CLI / Slack / web)# $ delego approve apr_7f3c# the agent resolves the SAME action — fingerprint must match
result = fw.resolve(approval_id, order)
result.outcome # -> 'allow', executed exactly once# a substituted action is refused — confused-deputy guard
fw.resolve(approval_id, tampered).outcome # -> 'deny'` },
{ id:"verify", label:"verify.py", icon:"badge-check", body:
`# every decision left a signed, hash-chained receipt
ok, problems = fw.audit.verify()
ok # -> True (Ed25519 chain intact)# editing, reordering, or dropping a receipt breaks itfor r in fw.audit.tail(20):
print(r.seq, r.outcome, r.action_fingerprint)
# 41 allow 497e0260…# 42 allow c70d4ee5… <- exportable as evidence` },
];
const [active, setActive] = React.useState("policy");
React.useEffect(() => { window.lucide && lucide.createIcons(); }, [active]);
const tab = tabs.find(t => t.id === active);
return (
Code-forward
Add auth, agent identity, and an audit trail in a few lines.
One small, deterministic, Apache-2.0 library. No LLM in the decision path, no credential custody — it rides your existing broker instead of replacing it.