Trust SDK design

Overview

The Python and TypeScript Trust clients are local prototypes pending the Trust API contract and publication. They should reject missing authorization, inactive state, malformed responses, and transport errors.

• Keep bearer credentials server-side.
• Use HTTPS for remote verification.
• Match agent, action, resource, and audience in verification requests.
• Treat local readiness as self-assessment only.

Production checklist

• Keep credentials in a server-side secret store.
• Set explicit cost, latency, privacy, provider, and regional constraints.
• Capture route and evaluation evidence for incident review.
• Test timeouts, cancellation, fallback, and denied-policy paths before rollout.