Recipes

Task-focused, runnable patterns built on the shipped examples/ and the devops-incident scenario — the scenario from the temporary-elevation walkthrough. Every snippet here runs against PaloNexus.offline() (no cluster, no network, no API key) using the seeded fixtures of the sample organization — no invented users:

devops-incident — a seeded owner, a sponsor who is also the approver, an operator, an auditor, and a seeded negative persona (must be hard-denied). The walkthrough maps each role to its seeded subject and email.

Each recipe was executed against the shipped palonexus package while writing these docs.

The cookbook

Recipe	Pattern
A2A delegation	An agent delegates to a sub-agent; the agent-to-agent (A2A) hop is itself gated and carries the original on-behalf-of subject.
Revocation race	A grant is revoked mid-run; the next /authz check denies immediately.
Budget exhaustion	An agent hits its calls/tokens ceiling; how the deny surfaces and how to set the budget.
Multi-scenario agent	One process governing several scenarios at once, each with its own personas and negative case.
Offline tests	Prove the deny-by-default contract in CI with the shipped pytest fixtures.

Prerequisites

pip install palonexus                       # base install runs every recipe here

All recipes share this preamble (register + provision the authority-bound agent):

from palonexus import PaloNexus

AGENT = "northstar-devops-incident-agent"
OWNER, APPROVER = "ethan.park@northstar.example", "maya.chen@northstar.example"

pn = PaloNexus.offline()                     # in-memory FakeControlPlane, deny-by-default
agent = pn.agents.register(name=AGENT, owner=OWNER, sponsor=APPROVER, scenario="devops-incident")
agent.provision()                            # mints did:key + Membership VC (idempotent)

Related

• Quickstart — the typed API these recipes use.
• LangChain · LangGraph · Deep Agents adapters.
• Troubleshooting — decode any deny reason a recipe hits.
• Security model — the invariants the recipes demonstrate.