CLI reference

The writ CLI wraps the API. Download it once:

curl -fsSL https://j72ckh66ukck2kcbq3oiwxaalm0olxwb.lambda-url.us-east-1.on.aws/writ -o writ
chmod +x writ

Set WRIT_BASE to point at a different gate, WRIT_SPONSOR_TOKEN to avoid passing --sponsor-token every time.

Keys and teams

./writ key --email you@company.com
# Issue a key. New email = new tenant; prints the sponsor token (once).
./writ key --email tm@company.com --invite-code writ_inv_...
# Join a teammate's tenant. You get your own API key.
./writ invite --key writ_KEY
# Create a team invite code for your tenant.
./writ me --key writ_KEY
# Account, usage, and policy summary.

Policy

./writ policy --key writ_KEY
# View the tenant's verb policy.
./writ policy --key writ_KEY --set refund step_up
# Modes: allow | deny | require_grant | step_up. Takes effect immediately.

The decision loop

./writ check --key writ_KEY --sponsor S --agent A --verb refund --target t-1 --purpose "why"
# ALLOW mints a 90-second token; DENY refuses; STEP_UP needs a grant.
./writ sandbox --sponsor S --agent A --target demo-1 --purpose "try the gate"
# Free 90-second demo grant for demo_write on demo-* targets. No key needed.
./writ token-verify --key writ_KEY --token writ_at_... --verb refund --target t-1 --purpose "why"
# Prove the ALLOW token matches the write you actually performed.
./writ grant --sponsor S --agent A --verb refund --target t-1 --purpose "why" --sponsor-token TOKEN
# Sponsor approves a STEP_UP. One-time, 90 seconds, exact fields.

Kill switch

./writ revoke --sponsor S --agent A --reason "rogue" --sponsor-token TOKEN
# Every later check for this principal is DENY. Writes a receipt.
./writ revoked --sponsor-token TOKEN
# List revoked principals in this tenant.
./writ reinstate --sponsor S --agent A --sponsor-token TOKEN
# Undo a revocation.

Audit log

./writ receipts --key writ_KEY
# This tenant's receipts. Never another tenant's.
./writ stream --key writ_KEY
# Tail the live audit log (SSE). Reconnects automatically.
./writ verify-chain --key writ_KEY
# Verify the receipt hash chain, newest first. See Audit log for what it proves.