Quick start

This example connects the Python SDK to an authenticated engine, binds a small policy, and checks two proposed actions. It does not execute either tool. For a local engine, first follow building and local setup. Custom policy compilation requires the full engine; the restricted guard engine accepts its packaged policies.

From the source repository, install the SDK with make install, then activate its environment:

source .venv/bin/activate
export SASY_URL=localhost:50051
# Set SASY_API_KEY to the complete client key provisioned by your operator.
# For local setup, use the generated key mapped to client in config/auth/apikey.json.

Save this policy as read-only.dl:

IsAuthorized(idx) :- Actions(idx, action), IsTool(action, "Read").

// @deny_message: Writes are disabled in this session
// @suggestion: Read the existing file and describe the proposed change
Unauthorized(idx) :- Actions(idx, action), IsTool(action, "Write").

Validate it with make souffle-validate FILE=read-only.dl. Then run:

import json
import os
from pathlib import Path

import sasy
from sasy.auth.hooks import APIKeyAuthHook

sasy.configure(
    sasy_url=os.environ["SASY_URL"],
    ca_path="certs/server.crt",  # Use your operator's CA for a remote engine.
    auth_hook=APIKeyAuthHook(api_key=os.environ["SASY_API_KEY"]),
)

with sasy.session(policy=Path("read-only.dl")):
    read = sasy.check_tool_call("Read", json.dumps({"file_path": "notes.txt"}))
    write = sasy.check_tool_call("Write", json.dumps({"file_path": "notes.txt", "content": "hello"}))
    print("Read:", read.authorized)    # True
    print("Write:", write.authorized)  # False
    print(write.denial_reasons)

A configured client is not an authorization grant. The session binds this policy, and each call asks the reference monitor about the exact proposed tool name and arguments. This example permits every Read path; use a more specific policy before connecting it to a real file tool.

To protect an application, place the check at its actual action-dispatch site and dispatch only after approval. Record the messages the application produces, processes, and passes, including their dependencies; provide the current input IDs with each check. See instrumentation for short tool-handler and LLM-call examples, policy language for context-sensitive rules, and configuration for engine, SDK, and guard settings.