CLI & vocabulary

The verified command surface, the state labels you'll see, and the system's controlled vocabulary. Reference material here is deliberately no larger than what is confirmed.

CLI commands#

verified commands

$ npm install -g @keydris/cli  # install (npm, public)$ keydris login  # operator identity + device enrollment$ keydris init <claude-code|codex> <agent-id>  # connect this install to your agent$ keydris codex  # run OpenAI Codex inside a keydris session

full CLI reference pending

Note

The commands above are verified against the current release. Further subcommands and flags exist in the shipped CLI and are documented here only once verified the same way — the badge is about that remaining surface, not about which agent harnesses are supported. Claude Code and OpenAI Codex are both implemented today. A reference that guesses is worse than a reference that is small.

State labels#

A governed action resolves to exactly one of three decisions: ALLOW, REJECT, or APPROVAL REQUIRED. The labels below are not decisions. They are the supporting states and reasons a decision surface can show alongside one, from the brand's state-label vocabulary:

AuthorizedIn scopePolicy validAuthority activeVerification requiredIssuer not recognizedScope mismatchPolicy expiredAuthority revoked

Filled square = proof present. Open square = proof absent, pending, or invalid. Invalid states are graphite, never red. Green marks a verified fact. One green event per view.

Vocabulary#

Agent: an operator-managed identity for an AI workload.
Device: an enrolled installation on which an agent runs.
KIT: the short-lived runtime identity for one agent session.
Broker: the enforcement point in your environment, on the agent's side.
Reader: optional enforcement on your MCP servers, on the receiving side.
Policy: operator-authored rules governing an agent's actions.
Integration: an organization connection to an external system.
Resource: a selected repository, channel, MCP tool or resource, or other governable target.
Decision: what Keydris concluded about one governed action: ALLOW, REJECT, or APPROVAL REQUIRED. Exactly these three.
Reason: why a decision came out that way (for example scope mismatch, or authority verified). A reason travels under a decision; it is never the decision.
Outcome: what happened when an allowed operation was attempted, recorded separately from the decision.
Control plane: the Keydris service that makes the authority decision against current policy and revocation state.
Authority context: the decision inputs the Reader sends: the KIT, the action, the tool, the scope, and the resource.
Governed: resources you enroll + the policy you assign, for supported actions.
Stateless MCP: independent governed MCP exchanges without retained session continuity.
Stateful MCP: governed MCP exchanges that retain continuity across a related multi-step session.

QuickstartThe verified commands in their working order.Identity vs authorityWhat the decision states mean.