Terminal 3 Agent Auth SDK · live testnet

Control Plane for Delegated AI Agents

Issue scoped, revocable did:t3n delegations on Terminal 3, then watch every verdict come back from the tee:delegation contract — allowed, out-of-scope, revoked, or expired.

Verdicts Run

this session

Denied

blocked at the gate

Mode

—

run a scenario

Delegation Verdict Console

Each scenario issues a real grant and submits a delegated invocation to Terminal 3.

Scenario

In-scope call

Agent invokes a function inside its grant.

EXPECT: ALLOW

Scenario

Out-of-scope call

Agent invokes a function it was never granted.

EXPECT: DENY

Scenario

Revoked grant

Org revokes on-chain, then the agent calls.

EXPECT: DENY

Scenario

Expired grant

Grant lapses before the call is made.

EXPECT: DENY

How a delegation is enforced

Wardix manages the lifecycle; Terminal 3 enforces it natively inside an Intel TDX enclave.

1. Grant

Org signs a scoped, time-boxed delegation credential (TEE custodial sign).

2. Sign

Agent signs each invocation with its own secp256k1 key.

3. Invoke

Agent submits the delegated call to tee:payroll.

4. Verify

Contract checks scope, signatures, revocation & expiry in the TEE.

Active delegation grant

Principal (org)

did:t3n:org (set on live call)

Contract

tee:payroll/contracts

Granted functions

compute-payrollscope: payroll/employees

Verdict feed

Newest first.

Run a scenario to see live verdicts.

Proof of verdict

Select a verdict to inspect its proof.