Enforce: .NET Cedar Policy + Consent

Goal

Turn your .NET app from watching AI agents into acting on them. By the end of this cookbook, you'll have:

• Every request checked against your deployed Cedar policy
• Cooperative agents sent to a branded consent screen when they need permission
• The standards-based delegation challenge available for sensitive routes

Prerequisites

• A .NET app already running Checkpoint middleware in detection mode — this cookbook adds enforcement on top
• A ProjectId and ApiKey for the project — see Credentials
• ASP.NET Core (net8) or .NET Framework (net462)

Time Estimate

10-15 minutes

Steps

Four steps. The policy you deploy in the dashboard does the work — your app just reads it.

On the .NET Framework tabs below, package entries go in packages.config and settings go in the <appSettings> section of Web.config. On ASP.NET Core, settings go in appsettings.json (or inline in AddCheckpoint).

<PackageReference Include="KyaOs.Checkpoint" Version="1.8.1" />

<package id="KyaOs.Checkpoint" version="1.8.1" targetFramework="net462" />

builder.Services.AddCheckpoint(options =>
{
    options.ProjectId = builder.Configuration["Checkpoint:ProjectId"]!;
    options.ApiKey    = builder.Configuration["Checkpoint:ApiKey"]!;
});

<add key="Checkpoint:ProjectId" value="your_project_id" />
<add key="Checkpoint:ApiKey" value="your_api_key" />

options.AuthorizationHostUrl = "https://kya.vouched.id";

<add key="Checkpoint:AuthorizationHostUrl" value="https://kya.vouched.id" />

Verify It's Working

Open a protected route as an agent and watch the dashboard show the verdict (Permit, Block, or Challenge — see Verdicts).

Advanced settings

You don't need these to get started. By default, a policy challenge verdict already sends agents to consent via the standards-based delegation challenge. The options below scope it to specific routes and actions, and make it friendly to AI agents that can't read a blocked page.

The standards-based challenge

As of KyaOs.Checkpoint 1.8.0, EnableDelegationChallengeWire defaults to true: a CHALLENGE verdict already emits the spec delegation challenge (the dual WWW-Authenticate: Delegation ..., Bearer resource_metadata="..." grammar from draft-kya-http-02 §8.1, see The Delegation challenge wire), not the legacy Bearer-only step-up. What you still set explicitly is which scopes require it and which org identity signs the registered proof:

options.DelegationChallengeScopes = ["payment:process", "data:export"]; // which actions require it
options.ResourceOrgDid = "did:web:acme.com"; // your org's identity — binds the signed proof

<add key="Checkpoint:DelegationChallengeScopes" value="payment:process,data:export" />
<add key="Checkpoint:ResourceOrgDid" value="did:web:acme.com" />

Choose how strict to be

Some AI agents can't read a page once it's blocked, so they never see the consent link. Negotiated makes sure cooperative agents still get the link, while everything else stays blocked.

options.DelegationChallengeMode = DelegationChallengeMode.Negotiated;

<add key="Checkpoint:DelegationChallengeMode" value="Negotiated" />

All settings in one place

{
  "Checkpoint": {
    "ProjectId": "your_project_id",
    "ApiKey": "your_api_key",
    "EnableComposedPolicy": true,
    "EnableDelegationChallengeWire": true,
    "DelegationChallengeScopes": "payment:process,data:export",
    "DelegationChallengeMode": "Negotiated",
    "AuthorizationHostUrl": "https://kya.vouched.id",
    "ResourceOrgDid": "did:web:acme.com"
  }
}

<appSettings>
  <add key="Checkpoint:ProjectId" value="your_project_id" />
  <add key="Checkpoint:ApiKey" value="your_api_key" />
  <add key="Checkpoint:EnableComposedPolicy" value="true" />
  <add key="Checkpoint:EnableDelegationChallengeWire" value="true" />
  <add key="Checkpoint:DelegationChallengeScopes" value="payment:process,data:export" />
  <add key="Checkpoint:DelegationChallengeMode" value="Negotiated" />
  <add key="Checkpoint:AuthorizationHostUrl" value="https://kya.vouched.id" />
  <add key="Checkpoint:ResourceOrgDid" value="did:web:acme.com" />
</appSettings>

What You Learned

• How to install KyaOs.Checkpoint and connect it to your project with ProjectId + ApiKey
• That your app enforces the Cedar policy you deploy in the dashboard — no rules live in code
• How to point cooperative agents at a branded consent screen with AuthorizationHostUrl
• That the built-in challenge verdict is the standards-based delegation challenge by default (1.8.0+): scope it with DelegationChallengeScopes, bind it to your org with ResourceOrgDid, and know EnableDelegationChallengeWire = false is a time-boxed opt-out, not a feature you turn on
• How DelegationChallengeMode (Negotiated / Spec401 / Always200) controls whether cooperative fetchers get a body-readable 200 or the spec 401

Next Steps

Related Documentation

• .NET Integration — Base middleware, install, and detection
• Policies — Authoring Cedar and the verdict reference
• Govern: Consent — Consent flows and screen configuration