Overview

Akhara has a deliberately small vocabulary. Learn these four terms and the rest of the platform follows.

​

Policy Decision Point (PDP)

The PDP is Akhara itself, the service that decides. It evaluates the policies attached to an agent and returns a verdict. It never executes your tools and never needs network access to them, so it can govern agents it cannot see inside. In the reference deployment the PDP is the console/API server on port 5599.

​

Policy Enforcement Point (PEP)

The PEP is the thin client you embed in your agent’s runtime, it enforces. For each risky step it makes a synchronous authorize call to the PDP and blocks until a verdict comes back. Because the call sits in front of the side effect, the PEP is where “you may not do that” actually takes effect. The PEP is intentionally tiny: one HTTP call, one decision object, and a fail-closed default.

​

Latch

A latch is a policy that activates only when an agent attempts the exact consequential action it governs. A prescription-renewal latch is invisible while the agent chats about lab results, and snaps shut the moment the agent tries to renew a controlled substance. See Latching.

​

Permit

A permit (permitId) is a one-time authorization id the PDP mints only for an ALLOW verdict on an action stage. Your side-effecting service should refuse to run without one, that’s what makes an authorized action distinguishable from an unauthorized one at the point of execution.

---

​

How they relate

The agent proposes; the PDP disposes. The component that wants to act (the agent) is never the component that authorizes it (the PDP): that separation of duties is the whole point.