Evaluate MAIP Policy

curl --request POST \
  --url https://api.truthlocks.com/v1/maip/policies/evaluate \
  --header 'Content-Type: application/json' \
  --header 'X-API-Key: <api-key>' \
  --data '
{
  "agent_id": "<string>",
  "scope": "<string>",
  "action": "<string>",
  "resource": "<string>"
}
'

import requests

url = "https://api.truthlocks.com/v1/maip/policies/evaluate"

payload = {
    "agent_id": "<string>",
    "scope": "<string>",
    "action": "<string>",
    "resource": "<string>"
}
headers = {
    "X-API-Key": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {'X-API-Key': '<api-key>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    agent_id: '<string>',
    scope: '<string>',
    action: '<string>',
    resource: '<string>'
  })
};

fetch('https://api.truthlocks.com/v1/maip/policies/evaluate', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.truthlocks.com/v1/maip/policies/evaluate",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'agent_id' => '<string>',
    'scope' => '<string>',
    'action' => '<string>',
    'resource' => '<string>'
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json",
    "X-API-Key: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.truthlocks.com/v1/maip/policies/evaluate"

	payload := strings.NewReader("{\n  \"agent_id\": \"<string>\",\n  \"scope\": \"<string>\",\n  \"action\": \"<string>\",\n  \"resource\": \"<string>\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("X-API-Key", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.truthlocks.com/v1/maip/policies/evaluate")
  .header("X-API-Key", "<api-key>")
  .header("Content-Type", "application/json")
  .body("{\n  \"agent_id\": \"<string>\",\n  \"scope\": \"<string>\",\n  \"action\": \"<string>\",\n  \"resource\": \"<string>\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.truthlocks.com/v1/maip/policies/evaluate")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["X-API-Key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"agent_id\": \"<string>\",\n  \"scope\": \"<string>\",\n  \"action\": \"<string>\",\n  \"resource\": \"<string>\"\n}"

response = http.request(request)
puts response.read_body

{
  "allowed": true,
  "denied_by": [
    "<string>"
  ],
  "reason": "<string>",
  "requires_approval": true
}

{
  "code": "AUTH_REQUIRED",
  "message": "Authentication required",
  "http_status": 401
}

{
  "code": "AUTH_REQUIRED",
  "message": "Authentication required",
  "http_status": 401
}

{
  "code": "AUTH_REQUIRED",
  "message": "Authentication required",
  "http_status": 401
}

POST

maip

policies

evaluate

Evaluate MAIP Policy

curl --request POST \
  --url https://api.truthlocks.com/v1/maip/policies/evaluate \
  --header 'Content-Type: application/json' \
  --header 'X-API-Key: <api-key>' \
  --data '
{
  "agent_id": "<string>",
  "scope": "<string>",
  "action": "<string>",
  "resource": "<string>"
}
'

import requests

url = "https://api.truthlocks.com/v1/maip/policies/evaluate"

payload = {
    "agent_id": "<string>",
    "scope": "<string>",
    "action": "<string>",
    "resource": "<string>"
}
headers = {
    "X-API-Key": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {'X-API-Key': '<api-key>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    agent_id: '<string>',
    scope: '<string>',
    action: '<string>',
    resource: '<string>'
  })
};

fetch('https://api.truthlocks.com/v1/maip/policies/evaluate', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.truthlocks.com/v1/maip/policies/evaluate",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'agent_id' => '<string>',
    'scope' => '<string>',
    'action' => '<string>',
    'resource' => '<string>'
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json",
    "X-API-Key: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.truthlocks.com/v1/maip/policies/evaluate"

	payload := strings.NewReader("{\n  \"agent_id\": \"<string>\",\n  \"scope\": \"<string>\",\n  \"action\": \"<string>\",\n  \"resource\": \"<string>\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("X-API-Key", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.truthlocks.com/v1/maip/policies/evaluate")
  .header("X-API-Key", "<api-key>")
  .header("Content-Type", "application/json")
  .body("{\n  \"agent_id\": \"<string>\",\n  \"scope\": \"<string>\",\n  \"action\": \"<string>\",\n  \"resource\": \"<string>\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.truthlocks.com/v1/maip/policies/evaluate")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["X-API-Key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"agent_id\": \"<string>\",\n  \"scope\": \"<string>\",\n  \"action\": \"<string>\",\n  \"resource\": \"<string>\"\n}"

response = http.request(request)
puts response.read_body

{
  "allowed": true,
  "denied_by": [
    "<string>"
  ],
  "reason": "<string>",
  "requires_approval": true
}

{
  "code": "AUTH_REQUIRED",
  "message": "Authentication required",
  "http_status": 401
}

{
  "code": "AUTH_REQUIRED",
  "message": "Authentication required",
  "http_status": 401
}

{
  "code": "AUTH_REQUIRED",
  "message": "Authentication required",
  "http_status": 401
}

Evaluate MAIP Policy

POST /v1/maip/policies/evaluate Evaluates all active MAIP policies for the authenticated tenant against a specific agent and requested scope. Returns whether the action is allowed, denied, or requires human approval. This is the runtime enforcement checkpoint that agents call before performing sensitive operations.

Policy evaluation uses a deny-overrides model: if any active policy with a matching deny rule triggers, the action is blocked regardless of any allow rules. The requires_approval flag is additive — it can be set even when the action is allowed.

Authentication

Requires X-API-Key header or Bearer JWT token. Tenant-scoped via cookie or JWT claim.

Request Body

string

required

MAIP-compliant agent identifier (e.g., "maip:t1234567:01HYX3KPZQ7RJGBN0WFMV8SDEH"). The agent must exist and belong to the authenticated tenant.

string

required

The permission scope being requested (e.g., "data:write", "tool:execute", "model:train"). Uses the resource:action format defined in Scopes.

string

The specific action being performed. Provides additional context for policy rules beyond what the scope communicates.

string

The specific resource being accessed. Provides additional context for audit logging and fine-grained policy conditions.

Evaluation Logic

The evaluation performs three sequential checks:

Agent Status Check — The agent must have status: "active". Suspended or revoked agents are always denied.
Scope Access Check — The requested scope must be present in the agent’s granted scopes. Explicitly denied scopes (prefixed with !) always block access.
Policy Rules Check — All active tenant policies are evaluated in priority order. Each rule’s conditions are AND-ed. If any deny rule matches, the action is blocked.

Response

boolean

true if the action is permitted, false if denied by any check.

string[]

Names of the policies that denied the action. Empty array if allowed.

string

Human-readable reason for denial. One of: - "agent is not active" — Agent is suspended or revoked - "scope not granted to agent" — Scope not in agent’s granted scopes - "denied by policy" — One or more policies blocked the action

boolean

true if any matching policy rule has requires_approval: true, even if the action is otherwise allowed. The caller should present a human approval workflow before proceeding.

Example

curl -X POST https://api.truthlocks.com/v1/maip/policies/evaluate \
  -H "X-API-Key: tl_live_..." \
  -H "Content-Type: application/json" \
  -d '{
    "agent_id": "maip:t1234567:01HYX3KPZQ7RJGBN0WFMV8SDEH",
    "scope": "data:write",
    "action": "update_customer_record",
    "resource": "customers/cust_12345"
  }'

const response = await fetch(
  "https://api.truthlocks.com/v1/maip/policies/evaluate",
  {
    method: "POST",
    headers: {
      "X-API-Key": "tl_live_...",
      "Content-Type": "application/json",
    },
    body: JSON.stringify({
      agent_id: "maip:t1234567:01HYX3KPZQ7RJGBN0WFMV8SDEH",
      scope: "data:write",
      action: "update_customer_record",
      resource: "customers/cust_12345",
    }),
  },
);
const result = await response.json();

if (!result.allowed) {
  console.error(`Denied by: ${result.denied_by.join(", ")}`);
} else if (result.requires_approval) {
  // Route to human approval workflow
}

import requests

response = requests.post(
    "https://api.truthlocks.com/v1/maip/policies/evaluate",
    headers={
        "X-API-Key": "tl_live_...",
        "Content-Type": "application/json",
    },
    json={
        "agent_id": "maip:t1234567:01HYX3KPZQ7RJGBN0WFMV8SDEH",
        "scope": "data:write",
        "action": "update_customer_record",
        "resource": "customers/cust_12345",
    },
)
result = response.json()

Authorizations

X-API-Key

string

header

required

API key for machine-to-machine authentication

Body

application/json

agent_id

string

required

MAIP-compliant agent identifier

scope

string

required

Permission scope being requested

action

string

Specific action being performed

resource

string

Specific resource being accessed

Response

Evaluation result

allowed

boolean

Whether the action is permitted

denied_by

string[]

Names of policies that denied the action

reason

string

Human-readable denial reason

requires_approval

boolean

Whether human approval is required

​Evaluate MAIP Policy

​Authentication

​Request Body

​Evaluation Logic

​Response

​Example

Authorizations

Body

Response

Evaluate MAIP Policy

Authentication

Request Body

Evaluation Logic

Response

Example