agenticdome-python-sdk 1.2.15__tar.gz → 1.2.17__tar.gz

{agenticdome_python_sdk-1.2.15 → agenticdome_python_sdk-1.2.17}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agenticdome-python-sdk
-Version: 1.2.15
+Version: 1.2.17
 Summary: Official Python SDK for AgenticDome security guardrails, DLP, tool authorization, and multi-agent delegation enforcement.
 Author: AgenticDome
 License-Expression: Apache-2.0
@@ -32,20 +32,20 @@ License-File: NOTICE
 Requires-Dist: requests>=2.31.0
 Requires-Dist: urllib3>=2.0.0
 Provides-Extra: crewai
-Requires-Dist: crewai<=1.15.14,>=1.15.5; extra == "crewai"
+Requires-Dist: crewai<=1.15.15,>=1.15.5; extra == "crewai"
 Provides-Extra: redis
 Requires-Dist: redis>=4.5.0; extra == "redis"
 Provides-Extra: pop
 Requires-Dist: cryptography>=42.0.0; extra == "pop"
 Provides-Extra: pydanticai
-Requires-Dist: pydantic-ai<=2.27.1,>=2.16.0; extra == "pydanticai"
+Requires-Dist: pydantic-ai<=2.29.0,>=2.16.0; extra == "pydanticai"
 Requires-Dist: anyio>=4.0.0; extra == "pydanticai"
 Provides-Extra: pydantic
-Requires-Dist: pydantic-ai<=2.27.1,>=2.16.0; extra == "pydantic"
+Requires-Dist: pydantic-ai<=2.29.0,>=2.16.0; extra == "pydantic"
 Requires-Dist: anyio>=4.0.0; extra == "pydantic"
 Provides-Extra: langgraph
-Requires-Dist: langgraph<=1.2.10,>=1.2.9; extra == "langgraph"
-Requires-Dist: langchain-core<=1.5.3,>=1.5.0; extra == "langgraph"
+Requires-Dist: langgraph<=1.2.11,>=1.2.9; extra == "langgraph"
+Requires-Dist: langchain-core<=1.5.4,>=1.5.0; extra == "langgraph"
 Requires-Dist: langchain-openai==1.3.5; extra == "langgraph"
 Requires-Dist: anyio>=4.0.0; extra == "langgraph"
 Provides-Extra: microsoft
@@ -63,9 +63,9 @@ Requires-Dist: openai-agents<=0.20.0,>=0.18.3; extra == "openai-agents"
 Provides-Extra: mcp
 Requires-Dist: mcp<=1.28.1,>=1.26.0; extra == "mcp"
 Provides-Extra: bedrock
-Requires-Dist: boto3<=1.43.68,>=1.43.54; extra == "bedrock"
+Requires-Dist: boto3<=1.43.70,>=1.43.54; extra == "bedrock"
 Provides-Extra: aws-bedrock
-Requires-Dist: boto3<=1.43.68,>=1.43.54; extra == "aws-bedrock"
+Requires-Dist: boto3<=1.43.70,>=1.43.54; extra == "aws-bedrock"
 Provides-Extra: llamaindex
 Requires-Dist: llama-index==0.14.23; extra == "llamaindex"
 Provides-Extra: llama-index
@@ -75,19 +75,19 @@ Requires-Dist: google-adk<=2.6.3,>=2.5.0; extra == "google-adk"
 Provides-Extra: adk
 Requires-Dist: google-adk<=2.6.3,>=2.5.0; extra == "adk"
 Provides-Extra: claude
-Requires-Dist: claude-agent-sdk<=0.2.135,>=0.2.126; extra == "claude"
+Requires-Dist: claude-agent-sdk<=0.2.137,>=0.2.126; extra == "claude"
 Provides-Extra: claude-agent-sdk
-Requires-Dist: claude-agent-sdk<=0.2.135,>=0.2.126; extra == "claude-agent-sdk"
+Requires-Dist: claude-agent-sdk<=0.2.137,>=0.2.126; extra == "claude-agent-sdk"
 Provides-Extra: smolagents
 Requires-Dist: smolagents==1.26.0; extra == "smolagents"
 Provides-Extra: all
-Requires-Dist: crewai<=1.15.14,>=1.15.5; extra == "all"
+Requires-Dist: crewai<=1.15.15,>=1.15.5; extra == "all"
 Requires-Dist: redis>=4.5.0; extra == "all"
 Requires-Dist: cryptography>=42.0.0; extra == "all"
-Requires-Dist: pydantic-ai<=2.27.1,>=2.16.0; extra == "all"
+Requires-Dist: pydantic-ai<=2.29.0,>=2.16.0; extra == "all"
 Requires-Dist: anyio>=4.0.0; extra == "all"
-Requires-Dist: langgraph<=1.2.10,>=1.2.9; extra == "all"
-Requires-Dist: langchain-core<=1.5.3,>=1.5.0; extra == "all"
+Requires-Dist: langgraph<=1.2.11,>=1.2.9; extra == "all"
+Requires-Dist: langchain-core<=1.5.4,>=1.5.0; extra == "all"
 Requires-Dist: langchain-openai==1.3.5; extra == "all"
 Requires-Dist: autogen-agentchat==0.7.5; extra == "all"
 Requires-Dist: agno<=2.8.7,>=2.8.0; extra == "all"
@@ -95,10 +95,10 @@ Requires-Dist: azure-ai-projects<=2.4.0,>=2.3.0; extra == "all"
 Requires-Dist: azure-identity==1.25.3; extra == "all"
 Requires-Dist: openai-agents<=0.20.0,>=0.18.3; extra == "all"
 Requires-Dist: mcp<=1.28.1,>=1.26.0; extra == "all"
-Requires-Dist: boto3<=1.43.68,>=1.43.54; extra == "all"
+Requires-Dist: boto3<=1.43.70,>=1.43.54; extra == "all"
 Requires-Dist: llama-index==0.14.23; extra == "all"
 Requires-Dist: google-adk<=2.6.3,>=2.5.0; extra == "all"
-Requires-Dist: claude-agent-sdk<=0.2.135,>=0.2.126; extra == "all"
+Requires-Dist: claude-agent-sdk<=0.2.137,>=0.2.126; extra == "all"
 Requires-Dist: smolagents==1.26.0; extra == "all"
 Provides-Extra: dev
 Requires-Dist: pytest>=8.0.0; extra == "dev"
@@ -147,7 +147,14 @@ No account, API key, tenant, network connection, or third-party framework packag
 agenticdome-demo --framework langgraph --scenario both
 ```
 
-Look for `ALLOWED — TOOL WOULD EXECUTE` followed by `BLOCKED — TOOL WOULD NOT EXECUTE`. These are simulations: the example does not execute either tool.
+Look for `ALLOWED — TOOL WOULD EXECUTE` followed by `BLOCKED — TOOL WOULD NOT EXECUTE`.
+
+> **Offline demonstration—not runtime evidence.** This command evaluates two
+> fixed onboarding scenarios with a deterministic, bundled public baseline. It
+> does not contact AgenticDome, load tenant policy, execute either tool, or
+> instantiate a LangGraph graph. `--framework langgraph` labels the example
+> payload and points you to the matching integration; it is not a LangGraph
+> integration test.
 
 ### 4. Select your framework
 
@@ -170,7 +177,13 @@ export AGENTICDOME_TENANT_ID="your_tenant_id"
 agenticdome-demo --framework langgraph --scenario both --live
 ```
 
-Offline simulation demonstrates the SDK decision flow using a bundled public baseline. Only live mode applies the customer's policy, topology, telemetry, signed decisions and runtime enforcement.
+With `--live`, the same fixed scenarios are sent to the actual assigned
+AgenticDome runtime sidecar, so their verdicts come from the customer's tenant
+policy and engine. The live demo still does not instantiate LangGraph or prove
+that an application has attached the framework adapter at every execution
+boundary. Use the framework guide to attach the adapter, test the real
+application path, and use AgenticDome Runtime Assurance for production
+evidence.
 
 ```python
 # The 30-second version: block a prompt-injected refund before it executes.
@@ -205,6 +218,21 @@ result = crew.kickoff()          # hostile prompts, unsafe tools, and rogue
 
 An agent can be hijacked while holding valid tokens, approved tools, and fully authorized paths. Legacy security sees a compliant request; the business sees a breach. AgenticDome adds an intent-aware enforcement layer at the exact boundaries where agents act:
 
+### Identity is necessary, but it is not the action decision
+
+Give every agent and workload a distinct principal and keep your identity
+provider authoritative for authentication, scopes, conditional access,
+credential lifecycle, and downstream entitlements. Then pass the identity the
+application has actually authenticated into AgenticDome alongside the agent,
+purpose, tool, final arguments, session, and delegation context. A valid token
+proves access authority; it does not prove that a prompt-influenced action is
+appropriate. AgenticDome complements IAM by evaluating that action at the
+application-controlled execution boundary. It does not issue enterprise
+identities or make a stolen credential safe.
+
+For the architectural rationale, see
+[An agent principal proves who—not why](https://www.agenticdome.io/research/agent-principal-identity).
+
 | Control | What it stops | Where it runs |
 | :--- | :--- | :--- |
 | **Prompt ingress guardrails** | Prompt injection, jailbreaks, system-prompt extraction, instruction override, policy bypass | Before agent/LLM execution |
@@ -266,6 +294,20 @@ Customer application                                             |
 
 The SDK must be attached in application code; setting environment variables alone does not intercept a framework. The assigned sidecar authenticates the tenant and evaluates live requests. Tools still execute in the customer's environment or selected provider unless a separate execution service has been deliberately configured.
 
+### Where the assigned runtime runs
+
+- **Managed service:** AgenticDome assigns the tenant a managed sidecar in the
+  selected supported geographic region, subject to availability and the
+  customer's plan or contract.
+- **Sovereign deployment:** the runtime is deployed within the contracted
+  customer-controlled boundary, such as a dedicated VPC, customer cloud, or
+  on-premises environment.
+
+The SDK does not choose or change runtime placement; it connects to the
+tenant-specific API base supplied during onboarding. See
+[Runtime location and Redis responsibilities](https://github.com/agenticdome/agenticdome-python-sdk/blob/main/docs/runtime-deployment.md) for
+the deployment boundary and customer responsibilities.
+
 ### Who does what
 
 | Persona / component | Responsibilities | Commercial model |
@@ -286,15 +328,23 @@ Start with a network-free simulation, then connect the same SDK to your assigned
 
 ```bash
 pip install agenticdome-python-sdk
-# Show one ALLOWED and one BLOCKED action for LangGraph.
+# Label the fixed demonstration as LangGraph and show one ALLOWED and one BLOCKED path.
 agenticdome-demo --framework langgraph --scenario both
 
-# Or prove the same offline contract across all 15 integrations.
+# Or repeat the fixed demonstration under every supported framework label.
 agenticdome-demo --framework all --scenario both
 agenticdome-demo --list-frameworks
 ```
 
-This is visibly labelled **LOCAL SIMULATION — NOT CLOUD ENFORCEMENT**. It evaluates a small bundled demonstration policy through the real public client contract, but it does not load tenant policy, issue signed decision tokens or execution receipts, write cloud evidence, or provide runtime assurance. To exercise any wrapper inside your own process without credentials, set `AGENTICDOME_MODE=local_sim`. The SDK refuses that mode when `AGENTICDOME_PRODUCTION_MODE=true`.
+This is visibly labelled **LOCAL SIMULATION — NOT CLOUD ENFORCEMENT**. It
+evaluates two fixed inputs with a small deterministic bundled baseline through
+the public core-client response shape. The `--framework` option changes the
+payload label and integration guidance; it does not import, instantiate, or run
+the selected framework. The simulation does not load tenant policy, issue
+signed decision tokens or execution receipts, write cloud evidence, or provide
+runtime assurance. To exercise a real adapter inside your own process without
+credentials, set `AGENTICDOME_MODE=local_sim` in that application or framework
+example. The SDK refuses that mode when `AGENTICDOME_PRODUCTION_MODE=true`.
 
 Browse the public [`examples/`](examples/README.md) gallery for a runnable allowed/blocked example for CrewAI, PydanticAI, LangGraph, Microsoft Agent Framework, AutoGen, AI Foundry, OpenAI Agents, Claude, smolagents, Agno, Google ADK, LlamaIndex, Bedrock, MCP, and custom Python. Local blocked/redacted results emit safe terminal logs containing verdict metadata only—not raw prompts, arguments, keys, or secrets.
 
@@ -372,7 +422,7 @@ pip install agenticdome-python-sdk
 | LlamaIndex | `pip install "agenticdome-python-sdk[llamaindex]"` |
 | AWS Bedrock / Bedrock Agents | `pip install "agenticdome-python-sdk[bedrock]"` |
 | MCP host / gateway | `pip install "agenticdome-python-sdk[mcp]"` |
-| Redis token storage | `pip install "agenticdome-python-sdk[redis]"` |
+| Optional cross-process delegation store | `pip install "agenticdome-python-sdk[redis]"` |
 | Proof-of-possession helpers | `pip install "agenticdome-python-sdk[pop]"` |
 | All optional integrations | `pip install "agenticdome-python-sdk[all]"` |
 
@@ -426,7 +476,10 @@ export AGENTICDOME_REQUIRE_TOKEN="true"
 export AGENTICDOME_REPORT_INCIDENTS="true"
 ```
 
-For distributed multi-worker deployments, add Redis so delegation tokens move across workers:
+Redis is **not required for normal SDK policy calls** or when using an assigned
+managed sidecar. Add customer-managed Redis only when manager-to-specialist
+delegation is authorised in one application process, worker, or pod and its
+one-time handoff state must be consumed in another:
 
 ```bash
 export AGENTICDOME_REDIS_URL="redis://redis.internal:6379/0"
@@ -474,8 +527,8 @@ export AGENTICDOME_PRODUCTION_MODE="false"            # production hardening (st
 | `AGENTICDOME_REQUIRE_SESSION_ID` | boolean | framework-specific | Requires explicit session ID for strict audit mapping. |
 | `AGENTICDOME_DEFAULT_TOOL_PLATFORM` | string | `unknown` / `python` | Fallback platform for tools. |
 | `AGENTICDOME_HANDOFF_TOKEN_TTL_S` | integer | `900` | Delegation token TTL in seconds. |
-| `AGENTICDOME_REDIS_URL` | string | empty | Optional Redis connection URL for distributed token storage. |
-| `AGENTICDOME_REDIS_KEY_PREFIX` | string | framework-specific | Redis key prefix. |
+| `AGENTICDOME_REDIS_URL` | string | empty | Optional customer-application Redis URL, needed only when one-time delegation state must cross processes, workers, or pods. It is unrelated to the managed sidecar's internal backing services. |
+| `AGENTICDOME_REDIS_KEY_PREFIX` | string | framework-specific | Optional key prefix for the customer application's cross-process delegation store. |
 | `AGENTICDOME_TOKEN_HMAC_SECRET` | string | empty | Optional secret-manager value used by the SDK to protect shared delegation state. Applications should not inspect or construct that state. |
 | `AGENTICDOME_PRODUCTION_MODE` | boolean | `false` | Enables production hardening such as stable session ID enforcement. |
 | `AGENTICDOME_REQUIRE_STABLE_SESSION_ID_IN_PROD` | boolean | `true` | Requires a stable session/run/trace ID when production mode is enabled. |
@@ -1228,10 +1281,10 @@ export AGENTICDOME_PRODUCTION_MODE="true"
 export AGENTICDOME_REQUIRE_STABLE_SESSION_ID_IN_PROD="true"
 export AGENTICDOME_FOUNDRY_REQUIRE_OUTPUT_SANITIZATION_IN_PROD="true"
 
-# For distributed delegated execution:
-export AGENTICDOME_REDIS_URL="redis://redis.internal:6379/0"
-export AGENTICDOME_REDIS_KEY_PREFIX="AgenticDome:foundry:handoff"
-export AGENTICDOME_TOKEN_HMAC_SECRET="replace-with-secret-from-kms"
+# Optional only when delegated execution crosses processes/workers/pods:
+# export AGENTICDOME_REDIS_URL="redis://redis.internal:6379/0"
+# export AGENTICDOME_REDIS_KEY_PREFIX="AgenticDome:foundry:handoff"
+# export AGENTICDOME_TOKEN_HMAC_SECRET="replace-with-secret-from-kms"
 ```
 
 **Attach middleware, then secure the run boundary:**
@@ -1302,7 +1355,10 @@ def create_refund(ctx, args):
     return {"refund_id": "rfnd_123", "status": "created"}
 ```
 
-**Delegated Foundry tool execution** — the authorization can store a decision token locally or in Redis; the specialist side consumes and verifies it before executing:
+**Delegated Foundry tool execution** — authorization stores decision state in
+memory by default. Configure the optional Redis store only when the specialist
+executes in another process, worker, or pod; the specialist consumes and
+verifies the decision before executing:
 
 ```python
 await firewall.authorize_manager_handoff(
@@ -1681,7 +1737,8 @@ firewall.pre_hook(
 )
 ```
 
-The specialist side verifies a token passed in args or recovers it from Redis/in-memory storage; stored tokens are consumed once:
+The specialist side verifies a token passed in args or recovers it from the
+configured in-process or optional Redis store; stored tokens are consumed once:
 
 ```python
 firewall.pre_hook(
@@ -1733,7 +1790,7 @@ export AGENTICDOME_AGNO_OTEL_ENABLED="true"
 # export AGENTICDOME_TOKEN_HMAC_SECRET="replace-with-secret-from-your-secret-manager"
 ```
 
-Notes: environment configuration alone does not attach AgenticDome — call `attach_firewall(agent_or_team)`, register `create_hook_bundle()`, use the middleware/plugin helper, or assign `cybersec_pre_hook`, `cybersec_post_hook`, and `cybersec_tool_hook` directly. Hosted/remote tools can only be protected at the local request/response boundary. For production teams and AgentOS deployments, configure Redis so delegation tokens are available across workers and pods, and use stable `session_id`/`run_id`/`trace_id` values.
+Notes: environment configuration alone does not attach AgenticDome — call `attach_firewall(agent_or_team)`, register `create_hook_bundle()`, use the middleware/plugin helper, or assign `cybersec_pre_hook`, `cybersec_post_hook`, and `cybersec_tool_hook` directly. Hosted/remote tools can only be protected at the local request/response boundary. Use stable `session_id`/`run_id`/`trace_id` values. Configure the optional Redis store only when delegation authorization and execution cross workers or pods.
 
 Official references: [Agno SDK overview](https://docs.agno.com/features/sdk) · [Agent reference](https://docs.agno.com/reference/agents/agent)
 
@@ -2120,7 +2177,9 @@ result = await secure_refund(
 )
 ```
 
-**Multi-agent delegation** — Redis is recommended when authorization and execution can happen in different workers or pods:
+**Multi-agent delegation** — the in-process store is sufficient when
+authorization and execution stay in one process. Configure Redis only when the
+one-time delegation state must cross workers or pods:
 
 ```python
 record = await firewall.authorize_manager_handoff(
@@ -2528,9 +2587,16 @@ The middleware supports configurable fail behavior:
 - **Fail closed** (`AGENTICDOME_FAIL_CLOSED="true"`): block execution if security checks fail or the AgenticDome API is unavailable. **Use this in production.**
 - **Fail open** (`AGENTICDOME_FAIL_CLOSED="false"`): allow execution for development or non-critical environments. Do not use in production unless you have compensating controls.
 
-### Redis token store for production clusters
+### Optional Redis for cross-process delegation
+
+Most customers do not need to install or configure Redis. Prompt screening,
+tool authorization, MCP checks, output review, and calls to an assigned runtime
+sidecar do not require customer-managed Redis. The Python adapters use an
+in-process token store by default.
 
-In-memory token storage suits local development and single-process workers. For horizontally scaled deployments, use Redis so manager handoff tokens are shared across workers:
+Use Redis only when manager-to-specialist delegation is authorised in one
+application process, worker, or pod and the one-time handoff state must be
+consumed in another:
 
 ```bash
 pip install "agenticdome-python-sdk[redis]"
@@ -2539,7 +2605,12 @@ export AGENTICDOME_REDIS_URL="redis://redis.example.internal:6379/0"
 export AGENTICDOME_REDIS_KEY_PREFIX="AgenticDome:runtime:handoff"
 ```
 
-The SDK provides integrity-protected, one-time delegation state for supported shared-store deployments. Configure `AGENTICDOME_TOKEN_HMAC_SECRET` from a secret manager and let the SDK create and consume these records; applications should not construct or modify their internal representation.
+This is the customer application's shared token store; it is not the Redis
+service operated behind an AgenticDome-managed sidecar. The SDK provides
+integrity-protected, one-time delegation state for supported shared-store
+deployments. Configure `AGENTICDOME_TOKEN_HMAC_SECRET` from a secret manager and
+let the SDK create and consume these records; applications should not construct
+or modify their internal representation.
 
 ### Production checklist
 

{agenticdome_python_sdk-1.2.15 → agenticdome_python_sdk-1.2.17}/README.md

@@ -35,7 +35,14 @@ No account, API key, tenant, network connection, or third-party framework packag
 agenticdome-demo --framework langgraph --scenario both
 ```
 
-Look for `ALLOWED — TOOL WOULD EXECUTE` followed by `BLOCKED — TOOL WOULD NOT EXECUTE`. These are simulations: the example does not execute either tool.
+Look for `ALLOWED — TOOL WOULD EXECUTE` followed by `BLOCKED — TOOL WOULD NOT EXECUTE`.
+
+> **Offline demonstration—not runtime evidence.** This command evaluates two
+> fixed onboarding scenarios with a deterministic, bundled public baseline. It
+> does not contact AgenticDome, load tenant policy, execute either tool, or
+> instantiate a LangGraph graph. `--framework langgraph` labels the example
+> payload and points you to the matching integration; it is not a LangGraph
+> integration test.
 
 ### 4. Select your framework
 
@@ -58,7 +65,13 @@ export AGENTICDOME_TENANT_ID="your_tenant_id"
 agenticdome-demo --framework langgraph --scenario both --live
 ```
 
-Offline simulation demonstrates the SDK decision flow using a bundled public baseline. Only live mode applies the customer's policy, topology, telemetry, signed decisions and runtime enforcement.
+With `--live`, the same fixed scenarios are sent to the actual assigned
+AgenticDome runtime sidecar, so their verdicts come from the customer's tenant
+policy and engine. The live demo still does not instantiate LangGraph or prove
+that an application has attached the framework adapter at every execution
+boundary. Use the framework guide to attach the adapter, test the real
+application path, and use AgenticDome Runtime Assurance for production
+evidence.
 
 ```python
 # The 30-second version: block a prompt-injected refund before it executes.
@@ -93,6 +106,21 @@ result = crew.kickoff()          # hostile prompts, unsafe tools, and rogue
 
 An agent can be hijacked while holding valid tokens, approved tools, and fully authorized paths. Legacy security sees a compliant request; the business sees a breach. AgenticDome adds an intent-aware enforcement layer at the exact boundaries where agents act:
 
+### Identity is necessary, but it is not the action decision
+
+Give every agent and workload a distinct principal and keep your identity
+provider authoritative for authentication, scopes, conditional access,
+credential lifecycle, and downstream entitlements. Then pass the identity the
+application has actually authenticated into AgenticDome alongside the agent,
+purpose, tool, final arguments, session, and delegation context. A valid token
+proves access authority; it does not prove that a prompt-influenced action is
+appropriate. AgenticDome complements IAM by evaluating that action at the
+application-controlled execution boundary. It does not issue enterprise
+identities or make a stolen credential safe.
+
+For the architectural rationale, see
+[An agent principal proves who—not why](https://www.agenticdome.io/research/agent-principal-identity).
+
 | Control | What it stops | Where it runs |
 | :--- | :--- | :--- |
 | **Prompt ingress guardrails** | Prompt injection, jailbreaks, system-prompt extraction, instruction override, policy bypass | Before agent/LLM execution |
@@ -154,6 +182,20 @@ Customer application                                             |
 
 The SDK must be attached in application code; setting environment variables alone does not intercept a framework. The assigned sidecar authenticates the tenant and evaluates live requests. Tools still execute in the customer's environment or selected provider unless a separate execution service has been deliberately configured.
 
+### Where the assigned runtime runs
+
+- **Managed service:** AgenticDome assigns the tenant a managed sidecar in the
+  selected supported geographic region, subject to availability and the
+  customer's plan or contract.
+- **Sovereign deployment:** the runtime is deployed within the contracted
+  customer-controlled boundary, such as a dedicated VPC, customer cloud, or
+  on-premises environment.
+
+The SDK does not choose or change runtime placement; it connects to the
+tenant-specific API base supplied during onboarding. See
+[Runtime location and Redis responsibilities](https://github.com/agenticdome/agenticdome-python-sdk/blob/main/docs/runtime-deployment.md) for
+the deployment boundary and customer responsibilities.
+
 ### Who does what
 
 | Persona / component | Responsibilities | Commercial model |
@@ -174,15 +216,23 @@ Start with a network-free simulation, then connect the same SDK to your assigned
 
 ```bash
 pip install agenticdome-python-sdk
-# Show one ALLOWED and one BLOCKED action for LangGraph.
+# Label the fixed demonstration as LangGraph and show one ALLOWED and one BLOCKED path.
 agenticdome-demo --framework langgraph --scenario both
 
-# Or prove the same offline contract across all 15 integrations.
+# Or repeat the fixed demonstration under every supported framework label.
 agenticdome-demo --framework all --scenario both
 agenticdome-demo --list-frameworks
 ```
 
-This is visibly labelled **LOCAL SIMULATION — NOT CLOUD ENFORCEMENT**. It evaluates a small bundled demonstration policy through the real public client contract, but it does not load tenant policy, issue signed decision tokens or execution receipts, write cloud evidence, or provide runtime assurance. To exercise any wrapper inside your own process without credentials, set `AGENTICDOME_MODE=local_sim`. The SDK refuses that mode when `AGENTICDOME_PRODUCTION_MODE=true`.
+This is visibly labelled **LOCAL SIMULATION — NOT CLOUD ENFORCEMENT**. It
+evaluates two fixed inputs with a small deterministic bundled baseline through
+the public core-client response shape. The `--framework` option changes the
+payload label and integration guidance; it does not import, instantiate, or run
+the selected framework. The simulation does not load tenant policy, issue
+signed decision tokens or execution receipts, write cloud evidence, or provide
+runtime assurance. To exercise a real adapter inside your own process without
+credentials, set `AGENTICDOME_MODE=local_sim` in that application or framework
+example. The SDK refuses that mode when `AGENTICDOME_PRODUCTION_MODE=true`.
 
 Browse the public [`examples/`](examples/README.md) gallery for a runnable allowed/blocked example for CrewAI, PydanticAI, LangGraph, Microsoft Agent Framework, AutoGen, AI Foundry, OpenAI Agents, Claude, smolagents, Agno, Google ADK, LlamaIndex, Bedrock, MCP, and custom Python. Local blocked/redacted results emit safe terminal logs containing verdict metadata only—not raw prompts, arguments, keys, or secrets.
 
@@ -260,7 +310,7 @@ pip install agenticdome-python-sdk
 | LlamaIndex | `pip install "agenticdome-python-sdk[llamaindex]"` |
 | AWS Bedrock / Bedrock Agents | `pip install "agenticdome-python-sdk[bedrock]"` |
 | MCP host / gateway | `pip install "agenticdome-python-sdk[mcp]"` |
-| Redis token storage | `pip install "agenticdome-python-sdk[redis]"` |
+| Optional cross-process delegation store | `pip install "agenticdome-python-sdk[redis]"` |
 | Proof-of-possession helpers | `pip install "agenticdome-python-sdk[pop]"` |
 | All optional integrations | `pip install "agenticdome-python-sdk[all]"` |
 
@@ -314,7 +364,10 @@ export AGENTICDOME_REQUIRE_TOKEN="true"
 export AGENTICDOME_REPORT_INCIDENTS="true"
 ```
 
-For distributed multi-worker deployments, add Redis so delegation tokens move across workers:
+Redis is **not required for normal SDK policy calls** or when using an assigned
+managed sidecar. Add customer-managed Redis only when manager-to-specialist
+delegation is authorised in one application process, worker, or pod and its
+one-time handoff state must be consumed in another:
 
 ```bash
 export AGENTICDOME_REDIS_URL="redis://redis.internal:6379/0"
@@ -362,8 +415,8 @@ export AGENTICDOME_PRODUCTION_MODE="false"            # production hardening (st
 | `AGENTICDOME_REQUIRE_SESSION_ID` | boolean | framework-specific | Requires explicit session ID for strict audit mapping. |
 | `AGENTICDOME_DEFAULT_TOOL_PLATFORM` | string | `unknown` / `python` | Fallback platform for tools. |
 | `AGENTICDOME_HANDOFF_TOKEN_TTL_S` | integer | `900` | Delegation token TTL in seconds. |
-| `AGENTICDOME_REDIS_URL` | string | empty | Optional Redis connection URL for distributed token storage. |
-| `AGENTICDOME_REDIS_KEY_PREFIX` | string | framework-specific | Redis key prefix. |
+| `AGENTICDOME_REDIS_URL` | string | empty | Optional customer-application Redis URL, needed only when one-time delegation state must cross processes, workers, or pods. It is unrelated to the managed sidecar's internal backing services. |
+| `AGENTICDOME_REDIS_KEY_PREFIX` | string | framework-specific | Optional key prefix for the customer application's cross-process delegation store. |
 | `AGENTICDOME_TOKEN_HMAC_SECRET` | string | empty | Optional secret-manager value used by the SDK to protect shared delegation state. Applications should not inspect or construct that state. |
 | `AGENTICDOME_PRODUCTION_MODE` | boolean | `false` | Enables production hardening such as stable session ID enforcement. |
 | `AGENTICDOME_REQUIRE_STABLE_SESSION_ID_IN_PROD` | boolean | `true` | Requires a stable session/run/trace ID when production mode is enabled. |
@@ -1116,10 +1169,10 @@ export AGENTICDOME_PRODUCTION_MODE="true"
 export AGENTICDOME_REQUIRE_STABLE_SESSION_ID_IN_PROD="true"
 export AGENTICDOME_FOUNDRY_REQUIRE_OUTPUT_SANITIZATION_IN_PROD="true"
 
-# For distributed delegated execution:
-export AGENTICDOME_REDIS_URL="redis://redis.internal:6379/0"
-export AGENTICDOME_REDIS_KEY_PREFIX="AgenticDome:foundry:handoff"
-export AGENTICDOME_TOKEN_HMAC_SECRET="replace-with-secret-from-kms"
+# Optional only when delegated execution crosses processes/workers/pods:
+# export AGENTICDOME_REDIS_URL="redis://redis.internal:6379/0"
+# export AGENTICDOME_REDIS_KEY_PREFIX="AgenticDome:foundry:handoff"
+# export AGENTICDOME_TOKEN_HMAC_SECRET="replace-with-secret-from-kms"
 ```
 
 **Attach middleware, then secure the run boundary:**
@@ -1190,7 +1243,10 @@ def create_refund(ctx, args):
     return {"refund_id": "rfnd_123", "status": "created"}
 ```
 
-**Delegated Foundry tool execution** — the authorization can store a decision token locally or in Redis; the specialist side consumes and verifies it before executing:
+**Delegated Foundry tool execution** — authorization stores decision state in
+memory by default. Configure the optional Redis store only when the specialist
+executes in another process, worker, or pod; the specialist consumes and
+verifies the decision before executing:
 
 ```python
 await firewall.authorize_manager_handoff(
@@ -1569,7 +1625,8 @@ firewall.pre_hook(
 )
 ```
 
-The specialist side verifies a token passed in args or recovers it from Redis/in-memory storage; stored tokens are consumed once:
+The specialist side verifies a token passed in args or recovers it from the
+configured in-process or optional Redis store; stored tokens are consumed once:
 
 ```python
 firewall.pre_hook(
@@ -1621,7 +1678,7 @@ export AGENTICDOME_AGNO_OTEL_ENABLED="true"
 # export AGENTICDOME_TOKEN_HMAC_SECRET="replace-with-secret-from-your-secret-manager"
 ```
 
-Notes: environment configuration alone does not attach AgenticDome — call `attach_firewall(agent_or_team)`, register `create_hook_bundle()`, use the middleware/plugin helper, or assign `cybersec_pre_hook`, `cybersec_post_hook`, and `cybersec_tool_hook` directly. Hosted/remote tools can only be protected at the local request/response boundary. For production teams and AgentOS deployments, configure Redis so delegation tokens are available across workers and pods, and use stable `session_id`/`run_id`/`trace_id` values.
+Notes: environment configuration alone does not attach AgenticDome — call `attach_firewall(agent_or_team)`, register `create_hook_bundle()`, use the middleware/plugin helper, or assign `cybersec_pre_hook`, `cybersec_post_hook`, and `cybersec_tool_hook` directly. Hosted/remote tools can only be protected at the local request/response boundary. Use stable `session_id`/`run_id`/`trace_id` values. Configure the optional Redis store only when delegation authorization and execution cross workers or pods.
 
 Official references: [Agno SDK overview](https://docs.agno.com/features/sdk) · [Agent reference](https://docs.agno.com/reference/agents/agent)
 
@@ -2008,7 +2065,9 @@ result = await secure_refund(
 )
 ```
 
-**Multi-agent delegation** — Redis is recommended when authorization and execution can happen in different workers or pods:
+**Multi-agent delegation** — the in-process store is sufficient when
+authorization and execution stay in one process. Configure Redis only when the
+one-time delegation state must cross workers or pods:
 
 ```python
 record = await firewall.authorize_manager_handoff(
@@ -2416,9 +2475,16 @@ The middleware supports configurable fail behavior:
 - **Fail closed** (`AGENTICDOME_FAIL_CLOSED="true"`): block execution if security checks fail or the AgenticDome API is unavailable. **Use this in production.**
 - **Fail open** (`AGENTICDOME_FAIL_CLOSED="false"`): allow execution for development or non-critical environments. Do not use in production unless you have compensating controls.
 
-### Redis token store for production clusters
+### Optional Redis for cross-process delegation
+
+Most customers do not need to install or configure Redis. Prompt screening,
+tool authorization, MCP checks, output review, and calls to an assigned runtime
+sidecar do not require customer-managed Redis. The Python adapters use an
+in-process token store by default.
 
-In-memory token storage suits local development and single-process workers. For horizontally scaled deployments, use Redis so manager handoff tokens are shared across workers:
+Use Redis only when manager-to-specialist delegation is authorised in one
+application process, worker, or pod and the one-time handoff state must be
+consumed in another:
 
 ```bash
 pip install "agenticdome-python-sdk[redis]"
@@ -2427,7 +2493,12 @@ export AGENTICDOME_REDIS_URL="redis://redis.example.internal:6379/0"
 export AGENTICDOME_REDIS_KEY_PREFIX="AgenticDome:runtime:handoff"
 ```
 
-The SDK provides integrity-protected, one-time delegation state for supported shared-store deployments. Configure `AGENTICDOME_TOKEN_HMAC_SECRET` from a secret manager and let the SDK create and consume these records; applications should not construct or modify their internal representation.
+This is the customer application's shared token store; it is not the Redis
+service operated behind an AgenticDome-managed sidecar. The SDK provides
+integrity-protected, one-time delegation state for supported shared-store
+deployments. Configure `AGENTICDOME_TOKEN_HMAC_SECRET` from a secret manager and
+let the SDK create and consume these records; applications should not construct
+or modify their internal representation.
 
 ### Production checklist