SDK requirements

The PEP is deliberately minimal, a single HTTP call per gated step and a fail-closed default. Here’s everything it needs.

Supported runtimes

Runtime	Package	Minimum	Notes
Node.js / TypeScript	`@akhara/pep`	Node 18+	Uses the global `fetch`; ESM and CJS builds.
Kotlin / Android	`AkharaPolicy.kt` (in-repo)	Android API 24+, Kotlin 1.9+	OkHttp + kotlinx-serialization + coroutines.
Any language	-	-	Implement the authorize contract directly; it’s one POST.

Android dependencies

The reference Kotlin client depends on:

dependencies {
  implementation("com.squareup.okhttp3:okhttp:4.12.0")
  implementation("org.jetbrains.kotlinx:kotlinx-serialization-json:1.6.3")
  implementation("org.jetbrains.kotlinx:kotlinx-coroutines-android:1.8.0")
}

On Android, calls are made off the main thread (the client uses Dispatchers.IO). Production builds must point at the managed PDP over HTTPS (https://api.akhara.dev); never ship a cleartext endpoint.

Configuration

Option	Env var	Default	Description
`baseUrl`	`AKHARA_URL`	`https://api.akhara.dev`	The PDP endpoint.
`agentId`	`AKHARA_AGENT_ID`	-	Must match a registered agent, else `404`.
`apiKey`	`AKHARA_API_KEY`	-	Workspace credential.
`session`	-	`"unknown"`	Correlates decisions in the evidence feed.
call timeout	-	8s (Kotlin)	Exceeding it → fail-closed `BLOCK`.

Network posture

Egress

Outbound HTTPS from the agent runtime to the PDP only. The PDP does not call back into your runtime or tools.

Latency budget

Each gated step blocks on one round-trip. Budget for it; a slow PDP degrades to blocked, never to unguarded.

Host allowlist

Sandbox boundaries restrict egress to the workspace domain (e.g. *.internal.akhara.dev) plus the PDP.

Secrets

Agent baseUrl/API keys are held server-side by the PDP and never returned in reads (only a masked key).

What the PEP guarantees

Synchronous: resolves to a verdict before your side effect runs.
Fail-closed: any error, timeout, or unrecognized verdict → BLOCK (reliability-4 · Fail-Closed Defaults). See Fail-closed.
Stateless: no local policy cache to go stale; the PDP is the single source of truth.
Evidence-emitting: every call is logged by the PDP without extra work in your code.

Pick your language

TypeScript

@akhara/pep for Node runtimes.

Kotlin / Android

The shipped AkharaPolicyClient + PolicyEnforcementPoint.

Get started

How it works

Enterprise onboarding

SDK

SDK requirements

Supported runtimes

Android dependencies

Configuration

Network posture

Egress

Latency budget

Host allowlist

Secrets

What the PEP guarantees

Pick your language

TypeScript

Kotlin / Android

​Supported runtimes

​Android dependencies

​Configuration

​Network posture

Egress

Latency budget

Host allowlist

Secrets

​What the PEP guarantees

​Pick your language

TypeScript

Kotlin / Android

Supported runtimes

Android dependencies

Configuration

Network posture

What the PEP guarantees

Pick your language