Let agents act.
On your terms.

This example runs against the package API and composes authorize, execute, record, bind, and verify explicitly.

import hashlib
import secrets
from pathlib import Path
from tempfile import TemporaryDirectory

from hummbl_governance import DelegationTokenManager, ReceiptEngine

secret = secrets.token_bytes(32)  # Load a stable key in production.
contract = {"id": "summary-v1", "operations": ["summarize"]}
task_id = "task-42"

# AUTHORIZE — issue and validate scoped delegated authority.
tokens = DelegationTokenManager(secret)
dct = tokens.issue(
    issuer="orchestrator",
    subject="summarizer-agent",
    operations=contract["operations"],
    resources=["docs/report.md"],
    task_id=task_id,
    contract_id=contract["id"],
)
allowed, reason = tokens.validate_token(
    dct,
    expected_task_id=task_id,
    expected_contract_id=contract["id"],
    expected_subject="summarizer-agent",
)
if not allowed:
    raise PermissionError(f"Delegated authority denied: {reason}")

# EXECUTE — your runtime performs the authorized action.
source = "Bounded authority makes agent actions reviewable."
result = " ".join(source.split()[:5])

# RECORD + BIND + VERIFY — authenticate the tuple and verify its chain.
with TemporaryDirectory() as state:
    receipts = ReceiptEngine(Path(state), signing_secret=secret)
    receipt = receipts.create_and_store(
        agent_id=dct.subject,
        action_type="summarize",
        payload={
            "contract": contract,
            "dct": dct.to_dict() | {"signature": dct.signature},
            "evidence": {
                "outcome": "completed",
                "output_sha256": hashlib.sha256(result.encode()).hexdigest(),
            },
        },
    )
    if not receipts.validate(receipt):
        raise RuntimeError("Receipt authentication failed")
    chain_valid, chain_reason = receipts.verify_chain(dct.subject)
    if not chain_valid:
        raise RuntimeError(f"Receipt chain failed: {chain_reason}")
    if len(receipts.list_for_agent(dct.subject)) != 1:
        raise RuntimeError("Receipt persistence check failed")