Enforce: .NET Cedar Policy + Consent

Goal

Turn your .NET app from watching AI agents into acting on them. By the end of this cookbook, you'll have:

• Every request checked against your deployed Cedar policy
• Cooperative agents sent to a branded consent screen when they need permission
• The standards-based delegation challenge available for sensitive routes

Prerequisites

• A .NET app already running Checkpoint middleware in detection mode — this cookbook adds enforcement on top
• A ProjectId and ApiKey for the project — see Credentials
• ASP.NET Core (net8) or .NET Framework (net462)

Time Estimate

10-15 minutes

Steps

Four steps. The policy you deploy in the dashboard does the work — your app just reads it.

On the .NET Framework tabs below, package entries go in packages.config and settings go in the <appSettings> section of Web.config. On ASP.NET Core, settings go in appsettings.json (or inline in AddCheckpoint).

<PackageReference Include="KyaOs.Checkpoint" Version="1.7.7" />

<package id="KyaOs.Checkpoint" version="1.7.7" targetFramework="net462" />

builder.Services.AddCheckpoint(options =>
{
    options.ProjectId = builder.Configuration["Checkpoint:ProjectId"]!;
    options.ApiKey    = builder.Configuration["Checkpoint:ApiKey"]!;
});

<add key="Checkpoint:ProjectId" value="your_project_id" />
<add key="Checkpoint:ApiKey" value="your_api_key" />

options.AuthorizationHostUrl = "https://kya.vouched.id";

<add key="Checkpoint:AuthorizationHostUrl" value="https://kya.vouched.id" />

Verify It's Working

Open a protected route as an agent and watch the dashboard show the verdict (Permit, Block, or Challenge — see Verdicts).

Advanced settings

You don't need these to get started. By default, a policy challenge verdict already sends agents to consent. The options below upgrade that to the standards-based delegation challenge, limit it to specific routes, and make it friendly to AI agents that can't read a blocked page.

Turn on the standards-based challenge

Emits the spec delegation challenge (instead of the legacy step-up) and lets you gate it to specific scopes.

options.EnableDelegationChallengeWire = true;
options.DelegationChallengeScopes = ["payment:process", "data:export"]; // which actions require it
options.ResourceOrgDid = "did:web:acme.com"; // your org's identity — binds the signed proof

<add key="Checkpoint:EnableDelegationChallengeWire" value="true" />
<add key="Checkpoint:DelegationChallengeScopes" value="payment:process,data:export" />
<add key="Checkpoint:ResourceOrgDid" value="did:web:acme.com" />

Choose how strict to be

Some AI agents can't read a page once it's blocked, so they never see the consent link. Negotiated makes sure cooperative agents still get the link, while everything else stays blocked.

options.DelegationChallengeMode = DelegationChallengeMode.Negotiated;

<add key="Checkpoint:DelegationChallengeMode" value="Negotiated" />

All settings in one place

{
  "Checkpoint": {
    "ProjectId": "your_project_id",
    "ApiKey": "your_api_key",
    "EnableComposedPolicy": true,
    "EnableDelegationChallengeWire": true,
    "DelegationChallengeScopes": "payment:process,data:export",
    "DelegationChallengeMode": "Negotiated",
    "AuthorizationHostUrl": "https://kya.vouched.id",
    "ResourceOrgDid": "did:web:acme.com"
  }
}

<appSettings>
  <add key="Checkpoint:ProjectId" value="your_project_id" />
  <add key="Checkpoint:ApiKey" value="your_api_key" />
  <add key="Checkpoint:EnableComposedPolicy" value="true" />
  <add key="Checkpoint:EnableDelegationChallengeWire" value="true" />
  <add key="Checkpoint:DelegationChallengeScopes" value="payment:process,data:export" />
  <add key="Checkpoint:DelegationChallengeMode" value="Negotiated" />
  <add key="Checkpoint:AuthorizationHostUrl" value="https://kya.vouched.id" />
  <add key="Checkpoint:ResourceOrgDid" value="did:web:acme.com" />
</appSettings>

What You Learned

• How to install KyaOs.Checkpoint and connect it to your project with ProjectId + ApiKey
• That your app enforces the Cedar policy you deploy in the dashboard — no rules live in code
• How to point cooperative agents at a branded consent screen with AuthorizationHostUrl
• How to upgrade the built-in challenge verdict to the standards-based delegation challenge with EnableDelegationChallengeWire, scope it with DelegationChallengeScopes, and bind it to your org with ResourceOrgDid
• How DelegationChallengeMode (Negotiated / Spec401 / Always200) controls whether cooperative fetchers get a body-readable 200 or the spec 401

Next Steps

Related Documentation

• .NET Integration — Base middleware, install, and detection
• Policies — Authoring Cedar and the verdict reference
• Govern: Consent — Consent flows and screen configuration