CI pipeline / AI agent / human
        │
        ▼
  [POST /v1-evaluate]
        │
        ▼
  AtlaSent policy engine
  (active bundle, versioned)
        │
   ─────┼──────────────────────
   allow│           deny / hold
        ▼                ▼
  permit issued    blocked — action does not run
        │
        ▼
  [POST /v1-verify-permit]
        │
   valid│         invalid / error
        │                └──► blocked — no deploy
        ▼
  deploy executes
        │
        ▼
  audit record (hash-linked, Ed25519-signed)

permissions:
  contents: read
  id-token: write   # production.deploy uses a verified GitHub OIDC workload identity

steps:
  - name: Authorization gate
    id: gate
    uses: Atlasent/atlasent-action@v1
    env:
      ATLASENT_API_KEY: ${{ secrets.ATLASENT_API_KEY }}
      ATLASENT_BASE_URL: ${{ secrets.ATLASENT_BASE_URL }}
    with:
      action: production.deploy
      environment: production
      target-id: ${{ github.repository }}
      context: |
        { "commit": "${{ github.sha }}" }

  - name: Deploy
    if: steps.gate.outputs.verified == 'true'
    run: ./deploy.sh

import { withPermit } from '@atlasent/sdk';

await withPermit(
  {
    actor:  { id: 'ci:github-actions',  type: 'agent' },
    action: { id: `deploy-${sha}`,      type: 'production.deploy' },
    target: { id: 'svc-checkout',       type: 'service', environment: 'production' },
    context: { commit: sha, branch: 'main' },
  },
  async () => {
    await deployToProduction(); // only reachable on allow + verified permit
  }
);

from atlasent import protect

protect(
    agent="ci-deploy-bot",
    action="production.deploy",
    context={"commit": commit_sha, "environment": "production"},
)
run_deploy()  # only reachable on allow + verified permit

// Inside an AI agent
const decision = await authorize({
  action_type: 'production.deploy',
  actor_id:    'agent:copilot-workspace',
  environment: 'production',
});

if (decision.decision !== 'allow') {
  return `Blocked: ${decision.reason}`;
}
await triggerDeploy();