---
name: aport-policy-verify
description: >
  Call APort hosted policy verification before sensitive actions and handle
  signed allow or deny decisions for custom apps, MCP tools, repositories, and
  workflow automations.
license: Apache-2.0
compatibility: Any HTTP client or server-side framework
metadata:
  author: APort
  version: 1.0.0
  tags: api, policy-verification, signed-decisions, mcp, audit, aport
---

# APort Policy Verify Skill

Use this skill when a user is building a custom integration instead of using a
prebuilt APort harness.

## Call The Hosted Verifier

```http
POST https://aport.io/api/verify/policy/{policy_id}
X-API-Key: apk_...
Content-Type: application/json

{
  "context": {
    "agent_id": "ap_...",
    "action": "tool.call",
    "tool": "system.command.execute",
    "command": "npm test"
  }
}
```

The response contains a binary policy decision:

- `allow: true` means the action may proceed.
- `allow: false` means the action should not proceed.

Harnesses may run in warn/report-only mode, but the signed policy decision
itself remains allow or deny.

## Important Security Rules

- Send only the minimum policy context required. Do not forward raw secrets,
  source files, customer data, or full tool outputs unless the policy requires
  them.
- Put APort API keys in server-side secrets, not frontend code.
- Use hosted verification for persisted org audit and paid team workflows.
- Use local mode only when offline development is required.

## Useful Policy Packs

- `code.repository.merge.v1`
- `system.command.execute.v1`
- `data.file.read.v1`
- `data.file.write.v1`
- `web.fetch.v1`
- `mcp.tool.execute.v1`
- `deliverable.task.complete.v1`

## Useful Links

- API docs: https://aport.io/api/documentation
- OpenAPI: https://aport.io/api/openapi-json
- Policy packs: https://aport.io/policy-packs
- Auth guide: https://aport.io/auth.md
- APort skill: https://aport.io/skill

<!-- BEGIN GENERATED AUTHORITY ROUTES -->
## Enterprise workflows

- [Authorize payments and refunds](https://aport.io/blog/ai-payment-agent-security-policy-pre-action-authorization/) (API integration): Check an agent's payment capability, amount, currency and configured limits before your service moves money. Keep payment execution and reconciliation in your existing system.
- [Govern access to customer data](https://aport.io/enterprise/ai-agent-governance/) (API integration): Evaluate protected reads and exports against configured data policies. Supply trusted customer and resource context, then enforce the decision at the service boundary.
- [Delegate software delivery](https://aport.io/task-delivery/) (Restricted preview): Prepare a repository task, approve implementation, review checks and inspect completion evidence through the task workspace or MCP. Merge authority remains separate.

Your integration must enforce the decision before execution. A signed authorization is not proof that the action executed. Keep customer identity, resource permissions and execution evidence in the application.

Managed task delivery is in restricted preview; its production qualification is pending. Task execution depends on account eligibility, repository authorization, configured providers and available allowance. Preparation can use paid inference. An allowance is not a provider billing cap.

## Evaluation and setup routes

- Compare authorization approaches: https://aport.io/compare/
- Framework setup and policy checks: https://aport.io/frameworks/
- AI Agent Governance for Enterprise Teams: https://aport.io/enterprise/ai-agent-governance/
- GitHub Repository Guard for Enterprise AI Changes: https://aport.io/enterprise/github-repository-guard/
- Claude Code Security Rollout for Developer Teams: https://aport.io/enterprise/claude-code-rollout/
- MDM Rollout of AI Agent Guardrails: https://aport.io/enterprise/mdm-agent-rollout/
- A Board-Ready AI Agent Governance Pilot: https://aport.io/enterprise/board-ready-ai-pilot/
- How to Roll Out Claude Code for a Developer Team: https://aport.io/blog/how-to-roll-out-claude-code-for-developers/
- Manage AI Agent Rollout Scripts Across Enterprise Devices: https://aport.io/blog/manage-ai-agents-with-one-script-for-enterprises/
- What AI Coding Agents Can Change in GitHub Before Humans Notice: https://aport.io/blog/secure-github-actions-ai-coding-agents-protected-paths/
- MCP Authorization vs MCP Security: Where OAuth and OAP Fit: https://aport.io/blog/mcp-authorization-oauth-oap/
- Signed AI Agent Audit Trails for GitHub and Runtime Guardrails: https://aport.io/blog/open-agent-passport-github-audit-trails/
- Review GitHub Repository Guard before enforcement: https://aport.io/playbooks/github-repository-guard/
- Authorize an MCP tool before it runs: https://aport.io/playbooks/mcp-authorization/
<!-- END GENERATED AUTHORITY ROUTES -->