Crate dyolo_kya 

dyolo-kya — Know Your Agent v2.0.0

Cryptographic chain-of-custody for recursive AI agent delegation.

What it solves

When one AI agent delegates a task to another, the authorization chain breaks down — a liability called the “Recursive Delegation Gap.” This library closes that gap with a native Know Your Agent (KYA) protocol: every action executed by any agent in a delegation tree carries an irrefutable, cryptographically verified chain proving exactly which human authorized it, with enforced scope boundaries that hold offline.

v2.0.0 additions over v1

• Namespace isolation — DyoloChain::with_namespace("tenant-id") cryptographically binds a chain to a single tenant. A cert issued for tenant-a cannot authorize under tenant-b. Hard multi-tenant separation with zero configuration overhead.

• Storage health checks — NonceStore::health_check() and RevocationStore::health_check() propagate to gateway /healthz so load balancers pull degraded instances automatically.

• Rate limiting trait — RateLimitStore + MemoryRateLimitStore cap intent executions per principal per time window. Plug in a Redis or Postgres backend for distributed enforcement.

• KyaContext builder — wire all dependencies in three lines:

  let ctx = KyaContext::builder().namespace("my-tenant").build();
  let action = ctx.authorize(&chain, &agent_pk, &intent, &proof)?;

Feature flags

Flag	Description
serde	Serialization for all core types. Required for most integrations.
async	AsyncNonceStore, AsyncRevocationStore, AsyncKyaContext.
wire	SignedChain, VerifiedToken, CertExtensions (requires serde).
tracing	Structured tracing spans during authorization.
ffi	C ABI for Python, Go, Java, and Node.js (requires wire).
policy-yaml	Parse delegation policies from YAML files.
schema	JSON Schema export for SignedChain.
full	All of the above except ffi.

Re-exports

pub use audit::AuditEvent;

pub use audit::AuditOutcome;

pub use audit::AuditSink;

pub use audit::CompositeAuditSink;

pub use audit::LogAuditSink;

pub use audit::NoopAuditSink;

pub use cert::CertBuilder;

pub use cert::CertBundle;

pub use cert::DelegationCert;

pub use cert::CERT_VERSION;

pub use chain::AuthorizedAction;

pub use chain::BatchAuthorizeResult;

pub use chain::Clock;

pub use chain::DyoloChain;

pub use chain::SystemClock;

pub use chain::VerificationReceipt;

pub use context::KyaContext;

pub use error::KyaError;

pub use error::KyaStorageError;

pub use error::StorageErrorKind;

pub use identity::DyoloIdentity;

pub use identity::SharedIdentity;

pub use identity::Signer;

pub use intent::intent_hash;Deprecated

pub use intent::Intent;

pub use intent::IntentHash;

pub use intent::IntentTree;

pub use intent::MerkleProof;

pub use intent::SiblingNode;

pub use intent::SubScopeProof;

pub use policy::CapabilitySet;

pub use policy::DelegationPolicy;

pub use policy::PolicySet;

pub use registry::fresh_nonce;

pub use registry::MemoryNonceStore;

pub use registry::MemoryRateLimitStore;

pub use registry::MemoryRevocationStore;

pub use registry::NonceStore;

pub use registry::RateLimitStore;

pub use registry::RevocationStore;

pub use cert_extensions::CertExtensions;wire

pub use cert_extensions::ExtValue;wire

pub use context::AsyncKyaContext;async

pub use registry::async::AsyncNonceStore;async

pub use registry::async::AsyncRateLimitStore;async

pub use registry::async::AsyncRevocationStore;async

pub use registry::async::SyncNonceAdapter;async

pub use registry::async::SyncRevocationAdapter;async

pub use audit::async::AsyncAuditSink;async

pub use audit::async::SyncAuditAdapter;async

pub use identity::AsyncSigner;async

Modules

audit

cert

cert_extensionswire

chain

context

error

ffiffi

C ABI exports for dyolo-kya.

identity

intent

policy

registry

wirewire

Portable wire formats for cross-service authorization transport.