Issue a grant

Registration is idempotent by name within a workspace, so it is safe to call on every boot.

from rotascale import Rotascale

rs = Rotascale()

agent = rs.register(
    "claims-orchestrator",
    owner="sarah.bennett@acme.example",
    org_unit="claims",
    tier="L2",
)

owner is a person, not a mailbox alias and not a team. Everything the agent later does walks back to this.

Draw the bounds

Write the sentence first, in words, and only then in JSON. If nobody can say it in one line, the grant is not ready and no software fixes that.

This agent may authorise settlement payments, on behalf of the claims function, up to 25,000 EUR in total, across at most 40 calls, for the next 7 days.

Issue it

curl -X POST "$ROTASCALE_URL/v1/grants" \
  -H "authorization: Bearer $ROTASCALE_API_KEY" \
  -H "content-type: application/json" \
  -d '{
    "agent_id": "agt_01KZXYBQZX",
    "principal_type": "human",
    "principal_id": "sarah.bennett@acme.example",
    "scope": { "tool": ["payments.settle"] },
    "budget_amount_minor": 2500000,
    "budget_currency": "EUR",
    "budget_count": 40,
    "ttl_hours": 168,
    "delegation_policy": "attenuating",
    "enforcement": "observe"
  }'

budget_amount_minor is an integer in minor units. 25,000.00 EUR is 2500000. There is no float anywhere in the money path.

Leave it in observe

A grant issued in observe records what the check would have done and refuses nothing. Run it against real traffic for a fortnight before touching the mode. See Move up the ladder.

Preview before you issue

POST /v1/grants/preview returns what a grant of that shape would decide against a sample action, without creating anything. Useful for checking a policy expression does what you think before it exists as an authority.

If the grant needs approval

Grants can require a second person. Those sit in GET /v1/grants/pending until somebody calls POST /v1/grants/{grant_id}/approve, and the approving identity is the one recorded as accountable.

What to check afterwards

The grant appears under the agent in the console.
ttl_hours is a number somebody chose rather than the 24-hour default carried by accident.
delegation_policy is none unless this agent genuinely hands work onward.

⌘I

Getting started

Core concepts

Guides

Integrations

Preview before you issue

If the grant needs approval

What to check afterwards

​Preview before you issue

​If the grant needs approval

​What to check afterwards

Preview before you issue

If the grant needs approval

What to check afterwards