Give agents permission,
not credentials.

# pip install grantor-verify
from grantor_verify import DeedVerifier, registry

verifier = DeedVerifier(RPC, registry.canonical(), CHAIN_ID, TENANT, AUDIENCE, ORIGIN, 120, 30, False, now)

# the challenge is yours — your nonce, your session store, single-use
claims = await verifier.verify_at(deed, challenge, now)

# then mint your session JWT — yours, or one call:
# jwt = session_jwt(claims, YOUR_SIGNING_KEY, ...)
# your OIDC stack carries on unchanged either way.

// go get chaingrantor.com/grantor-verify-go
v, err := verify.NewDeedVerifier(rpc, verify.RegistryCanonical(), chainId, tenant, audience, origin, 120, 30, false, now)

// the challenge is yours — your nonce, your session store, single-use
claims, err := v.VerifyAt(deed, challenge, now)

// then mint your session JWT — yours, or one call:
// jwt, err := verify.SessionJwt(claims, YOUR_SIGNING_KEY, ...)
// your OIDC stack carries on unchanged either way.

// Cargo.toml: grantor-verify = { features = ["sovereign-chain"] }
use grantor_verify::sovereign_gate::verify_deed;

// the challenge is yours — your nonce, your session store, single-use
let claims = verify_deed(
    &deed, &policy, &challenge, now, &gate,
).await?;

// then mint your session JWT — yours, or one call:
// let jwt = session_jwt(&claims, YOUR_SIGNING_KEY, ...)?;
// your OIDC stack carries on unchanged either way.