Haldir

Create a new agent session with scoped permissions and an optional spend budget. Every AI agent must have an active session before it can access secrets, make payments, or perform auditable actions. You specify which scopes (e.g. read, write, admin) the agent is allowed, a TTL...

Retrieve the current state of an agent session including its scopes, spend budget, remaining balance, and validity status. Use this to check whether a session is still active before performing privileged operations, or to inspect how much budget remains.

Immediately revoke an agent session, permanently disabling all permissions and blocking further actions under that session. Use this when an agent misbehaves, exceeds its mandate, or when a task is complete and the session should be cleaned up for security hygiene.

Check whether a specific session has a given permission scope. Returns a boolean indicating if the action is allowed. Use this before performing any sensitive operation to enforce least-privilege access control without risking a 403 error on the actual call.

Store an encrypted secret in the Haldir Vault with an optional scope requirement. Secrets are encrypted at rest using AES and can only be retrieved by sessions that hold the required scope. Use this to safely store API keys, tokens, credentials, or any sensitive data that agen...

Retrieve a decrypted secret from the Vault. If a session_id is provided, the session's scopes are checked against the secret's required scope before returning the value. This is the primary way agents access credentials — through policy-controlled, auditable retrieval.

Authorize a payment against an agent session's spend budget. The amount is deducted from the session's remaining budget if sufficient funds exist. If the payment would exceed the budget, it is denied. Every authorization is logged to the audit trail for full financial accounta...

Log an agent action to the tamper-evident audit trail with automatic anomaly detection. Every tool call, API request, or decision an agent makes should be logged here. The Watch module automatically flags suspicious patterns like rapid-fire actions, high-cost operations, or un...

Query the audit trail to review all actions taken by agents. Filter by session ID, agent ID, tool name, or flagged-only entries. Returns a chronological list of logged actions with their costs, timestamps, and anomaly flags. Essential for compliance reviews and debugging agent...

Get a summary of total spend across agent sessions, broken down by session or agent. Returns total USD spent, number of transactions, and budget utilization. Use this to monitor cost control and detect runaway spending before budgets are exhausted.