> ## Documentation Index
> Fetch the complete documentation index at: https://docs.akhara.ai/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Company name is Akhara AI (never Rubric AI). Keep lowercase rubric/rubrics only when meaning grading criteria.
> Expert Review (docs path talent/) is enterprise BYO experts for audit and review: invite customer specialists; do not pitch Akhara recruiting or a public expert career portal. RLHF and domain writing are secondary work types.
> Prefer concrete API examples against public hosts: Environments eval API https://agi.akhara.ai, Control plane PDP https://api.akhara.dev, Evaluation https://app.akhara.ai / https://api.akhara.ai, Expert Review portal https://talent.akhara.ai.
> Do not invent a public hostname for private orchestrators or env API internals.
> Do not confuse control-plane latches with Environments confirmation latches.
> Environments SDK/API examples: curl against https://agi.akhara.ai. Evaluation SDK: from akhara import Akhara and AKHARA_API_KEY.
> Start with /llms.txt for the docs index and OpenAPI links; fetch individual pages as .md exports.

# SDK requirements

> Runtimes, versions, network posture, and configuration the Akhara PEP needs.

The PEP is deliberately minimal, a single HTTP call per gated step and a
fail-closed default. Here's everything it needs.

## Supported runtimes

| Runtime              | Package                     | Minimum                      | Notes                                                                                                        |
| -------------------- | --------------------------- | ---------------------------- | ------------------------------------------------------------------------------------------------------------ |
| Node.js / TypeScript | `@akhara/pep`               | Node 18+                     | Uses the global `fetch`; ESM and CJS builds.                                                                 |
| Kotlin / Android     | `AkharaPolicy.kt` (in-repo) | Android API 24+, Kotlin 1.9+ | OkHttp + kotlinx-serialization + coroutines.                                                                 |
| Any language         | -                           | -                            | Implement the [authorize contract](/control-plane/api-reference/endpoint/authorize) directly; it's one POST. |

### Android dependencies

The reference Kotlin client depends on:

```kotlin theme={null}
dependencies {
  implementation("com.squareup.okhttp3:okhttp:4.12.0")
  implementation("org.jetbrains.kotlinx:kotlinx-serialization-json:1.6.3")
  implementation("org.jetbrains.kotlinx:kotlinx-coroutines-android:1.8.0")
}
```

<Warning>
  On Android, calls are made off the main thread (the client uses
  `Dispatchers.IO`). Production builds must point at the managed PDP over HTTPS
  (`https://api.akhara.dev`); never ship a cleartext endpoint.
</Warning>

## Configuration

| Option       | Env var           | Default                  | Description                                |
| ------------ | ----------------- | ------------------------ | ------------------------------------------ |
| `baseUrl`    | `AKHARA_URL`      | `https://api.akhara.dev` | The PDP endpoint.                          |
| `agentId`    | `AKHARA_AGENT_ID` | -                        | Must match a registered agent, else `404`. |
| `apiKey`     | `AKHARA_API_KEY`  | -                        | Workspace credential.                      |
| `session`    | -                 | `"unknown"`              | Correlates decisions in the evidence feed. |
| call timeout | -                 | 8s (Kotlin)              | Exceeding it → fail-closed `BLOCK`.        |

## Network posture

<CardGroup cols={2}>
  <Card title="Egress" icon="arrow-up-from-bracket">
    Outbound HTTPS from the agent runtime to the PDP only. The PDP does **not**
    call back into your runtime or tools.
  </Card>

  <Card title="Latency budget" icon="clock">
    Each gated step blocks on one round-trip. Budget for it; a slow PDP degrades
    to blocked, never to unguarded.
  </Card>

  <Card title="Host allowlist" icon="list-check">
    Sandbox boundaries restrict egress to the workspace domain
    (e.g. `*.internal.akhara.dev`) plus the PDP.
  </Card>

  <Card title="Secrets" icon="key">
    Agent `baseUrl`/API keys are held server-side by the PDP and never returned
    in reads (only a masked key).
  </Card>
</CardGroup>

## What the PEP guarantees

* **Synchronous**: resolves to a verdict before your side effect runs.
* **Fail-closed**: any error, timeout, or unrecognized verdict → `BLOCK`
  (`reliability-4` · `Fail-Closed Defaults`). See [Fail-closed](/control-plane/concepts/fail-closed).
* **Stateless**: no local policy cache to go stale; the PDP is the single source
  of truth.
* **Evidence-emitting**: every call is logged by the PDP without extra work in
  your code.

## Pick your language

<CardGroup cols={2}>
  <Card title="TypeScript" icon="js" href="/control-plane/sdk/typescript">
    `@akhara/pep` for Node runtimes.
  </Card>

  <Card title="Kotlin / Android" icon="android" href="/control-plane/sdk/kotlin">
    The shipped `AkharaPolicyClient` + `PolicyEnforcementPoint`.
  </Card>
</CardGroup>