Skip to main content

Session assertion

A Session assertion lets a personal agent ask a company for a signed-out Session without impersonating the human. It identifies the agent, uses a pairwise subject for this company, names the exact authorization-server audience, and expires quickly.

What the example proves​

  • The subject is pairwise: two companies cannot correlate a user by comparing PAP identifiers.
  • aud binds the assertion to one authorization server.
  • iat and exp bound its useful lifetime, while a unique jti supports replay rejection.
  • Signing happens through a Reactor capability; private keys and compact assertions never become tool arguments or model output.

The small example stops at safe assertion policy. The Session lifecycle example sends the assertion through a token exchange.

Run the Pydantic AI example or the Agent Runtimes example.