Getting Started
Eight steps from an empty organization to a signed decision on a real agent action.
If you're an existing customer standing up your organization, the eight steps below are the real path. If you're evaluating PayReality and want a real Decision without any of that setup, skip ahead: a sandbox organization, on the same production backend and authority path, is one unauthenticated API call:
curl -X POST https://api.aisecurewatch.com/v1/sandbox/organizations \
-H "Content-Type: application/json" \
-d '{"email": "you@example.com"}'That response includes an API key already scoped to a real, isolated sandbox organization, with one starter Runtime Policy already published, so authorize() works immediately, no Operator Key or dashboard setup required. Sandbox organizations are rate-limited, capped, and not automatically promoted to production. See SDKs for the full sandbox flow.
Create an organization
Everything below (agents, policies, evidence) is scoped to one organization. This is done once, from Organization Settings, not the API.
Register an agent
Give the agent an identity and a Principal it acts on behalf of. It starts registered, not active.
Upload governance, or author it directly
Bring an existing Delegation of Authority document, approval matrix, or signing schedule for the AI Authority Builder to read, or build the graph structure directly where no single document captures it.
Generate the Authority Graph
Governance, uploaded or authored, is modeled as a graph: principals, delegates, limits, and role hierarchy, ready for the runtime to query.
Publish Runtime Policies
Draft, review, and compile the conditions under which an action is permitted. A policy has to be active before any Intent can be evaluated against it.
Connect the Runtime API
Point your agent at the Intent API, or install the SDK (see SDKs for the one-call version of steps 6 and 7 together).
Execute your first Intent
Submit a signed action. It's evaluated deterministically against your active Runtime Policies, before the action executes.
Receive your Authorization Receipt
The decision (Allow, Deny, or Human Review) comes back immediately, along with the signed evidence record for it.
Steps 2, 6, and 7, with the SDK
Registering an agent, connecting to the Runtime API, and submitting a signed Intent collapse into a handful of calls once the SDK is handling signing for you:
from payreality import Agent
# Step 2: register (a sandbox api_key, an organization's own scoped key,
# or the platform Operator Key all work here, see SDKs for which to use)
agent = Agent(bearer_token="pr_live_...")
identity = agent.register(name="AP Automation Agent", principal="Finance Manager")
# Steps 6 + 7: connect and execute an Intent
decision = agent.authorize(
principal="Finance Manager",
operation="submit_invoice",
resource="Vendor Payment",
resource_data={
"amount": 8500,
"currency": "USD",
"vendor": "Acme Supplies",
},
)
print(decision.outcome) # ALLOW, DENY, or HUMAN_REVIEW
print(decision.evidence_id) # step 8: the signed evidence record for this decisionSteps 1, 3, 4, and 5 (creating the organization, uploading governance, generating the Authority Graph, and publishing Runtime Policies) happen in the platform UI today, not through this SDK call. See Authority Graph and Runtime Policies for what each one actually produces.
Where to go next
For the full request and response shape of step 7, see Runtime API. For what step 8's receipt actually contains, see Authorization Receipts. For the whole path end to end, see Architecture.