Developer Toolkit

1. Validate the user's active Identity session

Example assumes your server has already accepted a bearer token from its caller.

const identity = await fetch(new URL('/api/auth/me', process.env.IDENTITY_URL), {
  headers: { Authorization: `Bearer ${userAccessToken}` },
  signal: AbortSignal.timeout(3000),
});
if (identity.status === 401 || identity.status === 403) return respond(401);
if (!identity.ok) return respond(503);
const { user } = await identity.json();

2. Ask Policy from the server, then enforce its decision

Only after Identity verification, send the verified subject and server-selected target. Fail closed on any unavailable, malformed, or denied response.

const decision = await fetch(new URL('/api/v1/governance/evaluate', process.env.POLICY_URL), {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.AARCHON_POLICY_TOKEN}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    requestId: crypto.randomUUID(),
    subjectId: user.id,
    subjectRole: user.role,
    targetDomainId: 'report-team-a',
    action: 'READ',
    payloadHash: createHash('sha256').update('/api/reports/team-a').digest('hex'),
  }),
  signal: AbortSignal.timeout(3000),
});
if (!decision.ok) return respond(503);
const verdict = await decision.json();
if (typeof verdict.allowed !== 'boolean') return respond(503);
if (!verdict.allowed) return respond(403);
return respond(200, protectedResource);

What the templates include

• Example clearance domains and a role-to-domain map.
• Placeholder database URLs, service URLs, JWT secret, signing keys, and Policy token.
• Page guidance for generating and protecting replacement values.

The sample Policy token hash is deliberately a non-secret placeholder; replace it with the SHA-256 digest of a separately generated service token before starting Policy.