{
  "markdown": "# Carryall Policy Enforcement — Claude Code Plugin\n\nDeterministic IAM for AI agents. Carryall is a **control plane** — it handles policy compilation, cryptographic envelope signing, and audit trails. You bring your own **data plane** (vault backend, database, file system, or any storage layer your agents access).\n\nThis separation is by design: your data stays where you control it. Carryall never stores or proxies your data — it only governs who can access what, for how long, and why.\n\n## Architecture\n\n```\n┌─────────────────────────────────────────────────┐\n│  Claude Code / AI Agent                         │\n│                                                 │\n│  \"Read Q1 budget for cost analysis\"             │\n│         │                                       │\n│         ▼                                       │\n│  ┌─────────────────────────────────────┐        │\n│  │  Carryall (control plane)           │        │\n│  │  ── compile_policy ──────────────── │        │\n│  │  Intent → PDP → Minimal scopes     │        │\n│  │  Ed25519-signed envelope (300s TTL) │        │\n│  │  Tamper-evident audit trail         │        │\n│  └──────────────┬──────────────────────┘        │\n│                 │ signed envelope                │\n│                 ▼                                │\n│  ┌─────────────────────────────────────┐        │\n│  │  Your data plane (BYO)              │        │\n│  │  ── vaults, databases, APIs ─────── │        │\n│  │  Verifies envelope → serves data    │        │\n│  └─────────────────────────────────────┘        │\n└─────────────────────────────────────────────────┘\n```\n\n## Install\n\n```\nclaude plugin marketplace add tronmongoose/agent.carryall_plugin\nclaude plugin install carryall-policy-enforcement@carryall\n```\n\n## Prerequisites\n\n- `authority-runtime` Python package (the Carryall control plane SDK)\n- Agent keys initialized: `carryall init` + `carryall keys generate <agent-id>`\n- `CARRYALL_SLOS_CONFIG` pointing to your data plane integration config\n- `CARRYALL_KEYS_DIR` pointing to your agent key directory\n- `OPENAI_API_KEY` set (used by the policy compiler — gpt-4o-mini)\n\n## Tools\n\n| Tool | Description |\n|------|-------------|\n| `carryall_compile_policy` | Translate intent → minimal-scope signed envelope |\n| `carryall_check_access` | Pre-flight permission check |\n| `carryall_list_vaults` | List available vaults (requires envelope) |\n| `carryall_get_metadata` | Get document metadata and access policies (requires envelope) |\n| `carryall_read_document` | Read a document from a vault (requires envelope) |\n| `carryall_write_document` | Write a document to a vault (requires envelope) |\n| `carryall_query_documents` | Search vault documents (requires envelope) |\n| `carryall_audit_log` | Query the tamper-evident audit trail (requires envelope) |\n\n## Workflow\n\n1. Call `carryall_compile_policy` with your agent identity, intent, and available scopes\n2. Use the returned signed envelope with any data access tool\n3. All actions are logged — viewable via the Authority Dashboard\n\n## Bring your own data plane\n\nCarryall ships with a built-in `MemoryBackend` for testing and a `SlosBackend` for production vault access. The integration config points Carryall at your data plane:\n\n```json\n{\n  \"mcp_command\": \"./your-data-plane-binary\",\n  \"mcp_args\": [\"mcp\"],\n  \"mcp_cwd\": \"/path/to/your/data\"\n}\n```\n\nAny backend that accepts signed envelopes and verifies Ed25519 signatures can serve as a data plane. The `--mock` mode lets you develop and test without any backend at all.\n\n## Deployment modes\n\n```bash\n# Stdio (default — for Claude Code)\npython3 -m authority_runtime.cli mcp serve\n\n# HTTP (for Bedrock AgentCore, remote clients)\npython3 -m authority_runtime.cli mcp serve --transport http --port 8765\n\n# Mock (no data plane required — for testing and development)\npython3 -m authority_runtime.cli mcp serve --mock\n```\n\n## Source\n\n[github.com/tronmongoose/agent.carryall_plugin](https://github.com/tronmongoose/agent.carryall_plugin)\n",
  "bytes": 3981,
  "sha": "a2e45b5bea783669968a415d0e632c1fc79c17f4b1ba9be6c7319f1fd8db7167",
  "repo_slug": "tronmongoose/agent.carryall_plugin",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/plg_tronmongoose_agent_carryall_plugin_carry_a6b3acc1/readme"
}