> ## Documentation Index
> Fetch the complete documentation index at: https://docs.akhara.ai/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Company name is Akhara AI (never Rubric AI). Keep lowercase rubric/rubrics only when meaning grading criteria.
> Expert Review (docs path talent/) is enterprise BYO experts for audit and review: invite customer specialists; do not pitch Akhara recruiting or a public expert career portal. RLHF and domain writing are secondary work types.
> Prefer concrete API examples against public hosts: Environments eval API https://agi.akhara.ai, Control plane PDP https://api.akhara.dev, Evaluation https://app.akhara.ai / https://api.akhara.ai, Expert Review portal https://talent.akhara.ai.
> Do not invent a public hostname for private orchestrators or env API internals.
> Do not confuse control-plane latches with Environments confirmation latches.
> Environments SDK/API examples: curl against https://agi.akhara.ai. Evaluation SDK: from akhara import Akhara and AKHARA_API_KEY.
> Start with /llms.txt for the docs index and OpenAPI links; fetch individual pages as .md exports.

# Authorize a step

> The core enforcement call. Evaluates the agent's attached policy latches for the given stage and returns a binding verdict. Fails closed on the client side if unreachable.

The core enforcement call. Every [PEP](/control-plane/concepts/overview#policy-enforcement-point-pep)
method resolves to one `authorize` request. The PDP evaluates the agent's
[attached latches](/control-plane/concepts/latching) for the given `stage` and returns a
binding [verdict](/control-plane/concepts/verdicts).

<Note>
  Clients must **fail closed**: on any error, timeout, or unrecognized verdict,
  treat the step as `BLOCK`. See [Fail-closed](/control-plane/concepts/fail-closed).
</Note>


## OpenAPI

````yaml control-plane/api-reference/openapi.json POST /api/policy/authorize
openapi: 3.1.0
info:
  title: Akhara Control Plane API
  version: 1.0.0
  description: >-
    The Policy Decision Point (PDP) API. Enforcement clients call
    `/api/policy/authorize`; the management endpoints onboard agents, attach
    policies, and read the evidence trail.
servers:
  - url: https://api.akhara.dev
    description: Production PDP API
  - url: https://console.akhara.dev
    description: Managed console
security:
  - apiKey: []
paths:
  /api/policy/authorize:
    post:
      tags:
        - Enforcement
      summary: Authorize a step
      description: >-
        The core enforcement call. Evaluates the agent's attached policy latches
        for the given stage and returns a binding verdict. Fails closed on the
        client side if unreachable.
      operationId: authorize
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AuthorizeRequest'
            examples:
              output:
                summary: Gate a model draft
                value:
                  agentId: support-ai
                  session: sess_demo
                  stage: output
                  content: Your card on file is 4242 4242 4242 4242, expiring 04/27.
              action:
                summary: Authorize a consequential action
                value:
                  agentId: support-ai
                  session: sess_demo
                  stage: action
                  tool: refund_payment
                  args:
                    orderId: ord_1842
                    amount: 129
                  simulated: true
      responses:
        '200':
          description: A policy decision.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyDecision'
              examples:
                block:
                  summary: Cardholder data disclosure blocked
                  value:
                    verdict: BLOCK
                    stage: output
                    policyId: pci-0
                    rule: PCI DSS Requirement 3.3
                    reason: Unmasked PAN in output
                    transformedContent: null
                    tool: null
                    permitId: null
                    attachedPolicyIds:
                      - latch-0
                      - latch-4
                      - pci-0
                      - reliability-3
                allow-action:
                  summary: Refund authorized with a permit
                  value:
                    verdict: ALLOW
                    stage: action
                    policyId: latch-4
                    rule: Refund & Billing Exception Authorization
                    reason: Amount within auto-approval limit, identity verified
                    transformedContent: null
                    tool: refund_payment
                    permitId: permit_9f3ac21b
                    attachedPolicyIds:
                      - latch-0
                      - latch-4
                      - pci-0
                      - reliability-3
        '404':
          description: The agentId does not resolve to a workspace agent.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
              example:
                error: agent not found
components:
  schemas:
    AuthorizeRequest:
      type: object
      required:
        - agentId
        - stage
      properties:
        agentId:
          type: string
          description: Must resolve to a workspace agent, else 404.
          example: support-ai
        session:
          type: string
          description: Telemetry session id; defaults to "unknown".
          example: sess_demo
        stage:
          type: string
          enum:
            - input
            - context_egress
            - output
            - delivery
            - action
        content:
          type: string
          description: Text for input / context_egress / output / delivery.
        tool:
          type: string
          description: Tool name for the action stage; normalized before matching.
          example: refund_payment
        args:
          type: object
          additionalProperties: true
          description: >-
            Action arguments; the matched latch reads the fields it governs (for
            example args.amount or verification state).
          example:
            orderId: ord_1842
            amount: 129
        simulated:
          type: boolean
          default: false
          description: Marks the decision as simulated in the evidence feed.
    PolicyDecision:
      type: object
      required:
        - verdict
        - stage
        - policyId
        - rule
        - reason
      properties:
        verdict:
          type: string
          enum:
            - ALLOW
            - WARN
            - BLOCK
            - ESCALATE
        stage:
          type: string
        policyId:
          type: string
          example: latch-4
        rule:
          type: string
          example: Refund & Billing Exception Authorization
        reason:
          type: string
        transformedContent:
          type:
            - string
            - 'null'
          description: Rewritten content on WARN (e.g. sensitive fields redacted).
        tool:
          type:
            - string
            - 'null'
        permitId:
          type:
            - string
            - 'null'
          description: Set only on ALLOW + action.
        attachedPolicyIds:
          type: array
          items:
            type: string
          description: Enterprise baseline ∪ agent.policyIds.
    Error:
      type: object
      properties:
        error:
          type: string
  securitySchemes:
    apiKey:
      type: http
      scheme: bearer
      description: Workspace API key (ak_live_…).

````