[ 09 ] Reference

Examples

Two runnable programs in examples/ exercise the full protocol end to end — one traces the spec's own three-agent reference flow (§32), the other shows the same authority chain enforced inside a LangChain tool-calling loop.

Three-agent reference flow

examples/three_agent_demo.py runs Principal → Requester → Research Agent → Evaluator → Settlement Adapter, entirely with signed VACT-P objects — no network calls, no mocked cryptography.

make demo

#	Phase	What happens
`1`	Authority	Principal signs a Mandate authorizing the Requester to purchase one research report, capped at USD 250.
`2`	Authority	Requester issues a Delegation to the Researcher — read access to three documents, a USD 220 ceiling, no training use, 24h retention.
`3`	Authority	Chain is verified; effective authority is the intersection — USD 220 budget, delegation depth 1.
`4`	Market	Researcher publishes a signed Offer for research.report, priced fixed at USD 200, verified by an evaluator.
`5`	Market	Researcher issues a Quote binding the Offer to the three delegated documents and a USD 200 ceiling.
`6`	Market	Requester and Researcher co-sign the identical Task Contract — it only activates once both signatures are present.
`7`	Execution	Researcher evaluates the authorization decision, records a Policy Decision Receipt.
`8`	Execution	Task advances through five signed transitions: PROPOSED → OFFERED → ACCEPTED → AUTHORIZED → QUEUED → RUNNING.
`9`	Execution	Researcher completes the report and emits an Execution Receipt, hash-linked to the Policy Decision Receipt.
`10`	Verification	An independent Evaluator agent scores the output 0.94, issues an Evaluation Receipt hash-linked to the Execution Receipt.
`11`	Settlement	Requester authorizes capture; USD 200.00 settles through a mock escrow adapter with a hash-linked Settlement Receipt.

Audit reconstruction

At the end, the Principal reconstructs the full chain without ever seeing the raw source documents or private model reasoning:

Mandate
  → Delegation
    → Offer and Quote
      → Task Contract
        → Policy Decision
          → Execution Receipt
            → Evaluation Receipt
              → Settlement Receipt

The demo then asserts the receipt hash-chain is intact — execution_receipt.prev_receipt_digest == digest(policy_receipt), and so on through settlement. Tamper with a single byte of any object and verification fails closed.

LangChain "Deep Agent" integration

examples/langchain_deep_agent.py wraps two LangChain tools — read_secure_vaultand publish_summary_report — with VACT-P authority checks. Each tool call carries the signed envelope and is validated before it runs:

@tool
def read_secure_vault(document_id: str, envelope_json: str) -> str:
    """Reads a document from the secure vault. Requires a valid VACT-P authority chain."""
    envelope = json.loads(envelope_json)
    chain = envelope.get("authority_chain", [])

    effective = verify_chain(chain, RESOLVER)
    decision = authorize(effective, action="document.read", resource=document_id)
    decision.enforce()  # raises + fails closed if not allowed

    return vault_data.get(document_id, "ERROR: Document not found.")

The demo then drives an agent through three calls:

Reads urn:doc:financial-secrets — allowed, in scope of the Delegation.
Publishes a summary report — allowed, in scope of the Delegation.
Attempts to read urn:doc:hr-secrets — denied, outside the delegated resource set, fails closed with PERMISSION DENIED.

Run it (falls back to a self-contained simulation mode if langchain-core isn't installed):

make demo-langchain

Takeaway

The agent's LLM never decides what it's allowed to do — the tool itself reconstructs effective authority from the signed chain and enforces it before touching data. A jailbroken prompt cannot talk its way past a Delegation it wasn't issued.

Previous← SDK reference NextRoadmap & conformance →