2. Your first protected action

import os
from atlasent import protect, AtlaSentDeniedError, AtlaSentError

# Picks up ATLASENT_API_KEY from the environment.
try:
    permit = protect(
        agent="agent-001",
        action="ehr.write",
        context={"environment": "production", "patient_id": "patient-42"},
    )
except AtlaSentDeniedError as exc:
    # Policy denied, hold/escalate, or permit failed verification.
    halt(exc.reason)
except AtlaSentError:
    # Transport, timeout, auth, rate-limit, or server error.
    halt("fail-closed")

# Authorized end-to-end. Execute the action and record permit.permit_id
# alongside your own record so the audit chain stays two-way navigable.
record = db.patients.update("patient-42", payload)
print(f"executed under permit={permit.permit_id} audit={permit.audit_hash}")

import atlasent, { AtlaSentDeniedError, AtlaSentError } from "@atlasent/sdk";

// Picks up ATLASENT_API_KEY from the environment.
try {
  const permit = await atlasent.protect({
    agent: "agent-001",
    action: "ehr.write",
    context: { environment: "production", patient_id: "patient-42" },
  });

  // Authorized end-to-end. Execute the action and record permit.permitId
  // alongside your own record so the audit chain stays two-way navigable.
  const record = await db.patients.update("patient-42", payload);
  console.log(`executed under permit=${permit.permitId} audit=${permit.auditHash}`);
} catch (err) {
  if (err instanceof AtlaSentDeniedError) halt(err.reason);  // policy denied / verify-fail
  else if (err instanceof AtlaSentError)  halt("fail-closed"); // transport / auth / 5xx
  else throw err;
}

# The raw wire form. The SDK above issues both calls for you.
# Step 1 — evaluate. On allow, the response carries a signed permit_token
# and the execution_hash_expected value to re-present at verify time.
RESP=$(curl -sX POST "$ATLASENT_API_URL/v1-evaluate" \
  -H "Authorization: Bearer $ATLASENT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "action_type": "ehr.write",
    "actor_id": "agent-001",
    "context": {
      "environment": "production",
      "target": { "id": "patient-42", "type": "ehr_record" }
    },
    "state_snapshot": { "source": "quickstart", "complete": true }
  }')
PERMIT_TOKEN=$(echo "$RESP" | jq -r '.permit_token')
PAYLOAD_HASH=$(echo "$RESP" | jq -r '.execution_hash_expected')

# Step 2 — verify before executing. Both calls land in the audit chain.
curl -sX POST "$ATLASENT_API_URL/v1-verify-permit" \
  -H "Authorization: Bearer $ATLASENT_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{
    \"permit_token\": \"$PERMIT_TOKEN\",
    \"action_type\": \"ehr.write\",
    \"actor_id\": \"agent-001\",
    \"payload_hash\": \"$PAYLOAD_HASH\"
  }" | jq .valid

from atlasent import with_permit

result = with_permit(
    agent="agent-001",
    action="ehr.write",
    context={"environment": "production", "patient_id": "patient-42"},
    fn=lambda permit: db.patients.update(
        "patient-42", payload, permit_id=permit.permit_id,
    ),
)

import atlasent from "@atlasent/sdk";

const result = await atlasent.withPermit(
  {
    agent: "agent-001",
    action: "ehr.write",
    context: { environment: "production", patient_id: "patient-42" },
  },
  async (permit) => {
    return db.patients.update("patient-42", payload, { permitId: permit.permitId });
  },
);