Documentation
Palisec is pre-release. Each guide marks what you can run today, what is specified but not deployed, and what is planned. Snippets that cannot run yet are labelled as pseudocode.
Quickstart →
Install, configure the network, create a constrained test account, submit an operation and inspect the decision.
Policy schema →
Canonical JSON schema, every rule, precedence, units, limits and validation errors.
Errors and operations →
Reason codes, retry semantics, operation states, reservations and recovery.
Account abstraction →
ERC-4337 validation, authorization binding, replay protection and human approvals.
Architecture →
Control, enforcement, chain and observability planes, and how they fail.
Security model →
Threats, trust boundaries, key lifecycle, limitations and release gates.
What exists today
| Component | Status |
|---|---|
| Canonical policy schema 1.0 JSON Schema and TypeScript types; validated in the browser workbench. | Available · local simulation |
| Deterministic local simulator Runs the evaluation order on example data. Never signs or broadcasts. | Available · local simulation |
| Rust policy engine Production evaluator implementing the same schema and reason codes. Until it ships, the API runs the TypeScript reference evaluator on the server. | Specified · not deployed |
| Atomic budget reservations Postgres ledger serialized per policy: one SQL function re-checks budget, pending slots, replay and loop state before recording. Testnet only. | Built · control plane |
| TEE-backed signing (AWS Nitro) Policy-bound signing with no arbitrary-signing interface. | Specified · not deployed |
| ERC-4337 validation module On-chain rejection of operations without a valid Palisec authorization. Until it ships, an agent key that skips Palisec can still transact. | Specified · not deployed |
| Wallet sign-in and sessions SIWE challenge and verify, HttpOnly sessions, organizations, members and roles enforced server-side. | Built · control plane |
| Authorization API Agents, API keys, policy versions, evaluate, operations with idempotency, approvals and audit. Testnet (46630) only. Decisions are recorded; nothing is signed or broadcast. | Built · control plane |
| Human approvals Approvers sign EIP-712 data bound to the exact operation and policy version with their own wallet. | Built · control plane |
| TypeScript SDK (viem) @palisec/sdk. Not published; call the REST API directly for now. | Specified · not deployed |
| Python SDK Published only once its semantics match the canonical API. | Planned |
| Developer console Wallet sign-in, then agents, policies with a rule builder and test cases, approvals, audit and emergency controls on testnet. Real data only. | Built · control plane |