v0.9.0

v0.8.0 made the wallet a thing you could paste, hand over, and verify.
v0.9.0 is the enforcement release: on governed paths, the engine no longer
depends on the agent's cooperation.

Interception

The MCP broker fronts any upstream MCP server. Register the upstream on your
wallet, point your host at /mcp/broker/<upstream>, and every tools/call
is authorized before a byte reaches the upstream — inheritance,
conditional rules, observe mode, evidence, escalation, all of it. The
upstream's credential stays vaulted server-side and is injected on the
forward, so the agent never holds it — and the broker never copies inbound
headers upstream, so your Sanction key can't leak either.

A refused call returns a proper MCP result with a machine code and
remediation. An escalation names its request_id; approval mints a one-use
grant the agent redeems by retrying with _meta["sanction/grant_id"].

The x402 spend gate

Stablecoin settlement is irreversible — the moment between receiving a
payment challenge and signing it is the only control point there is.
Sanction now takes that moment.

• POST /v1/authorize/quote prices an x402 402 challenge and runs it
  through the same ladder as any purchase: budgets, escalation bands,
  cascade caps, evidence, the decision meter.
• Through the broker this is interception, not cooperation: when a fronted
  upstream answers 402, anything but an approval means the challenge is
  withheld — an agent that never receives payment requirements cannot
  sign them.
• Two rules keep it honest: no oracle, no FX (USD-pegged stablecoins
  with known decimals only; anything else denies as QUOTE_NOT_PRICEABLE
  rather than guessing) and worst case wins (a challenge offering
  several ways to pay is authorized at its most expensive option).

Still non-custodial and veto-only: Sanction holds no keys and signs
nothing. It decides whether the demand is allowed to reach your wallet.

Rules that inherit, and rules that read the clock

• Tool and capability rules now cascade down the wallet tree. A child
  may tighten, never loosen: block it at the org root and no team below
  can allow it back. Every decision records which layer decided.
• Rules can carry conditions. outside_hours_utc escalates deploys
  after hours; after_model_calls_today is the runaway breaker — past N
  model calls today, matching tools block until a human looks. Signals are
  snapshotted into evidence, so replay reads the record, never the live
  clock.

Approvals where your team already is

Sanction for Slack is live. Add to Slack binds a workspace and channel
to your wallet over OAuth, the bot token lands in the wallet's encrypted
vault, and interactive Approve / Deny cards resolve through the same
grant-minting path as the dashboard — actor recorded, audit intact.

Metering, honestly

Every wallet now counts decisions per month — approve, escalate, and deny
each count once; idempotent replays and simulations never do. No fee
attaches to it. The unit is measured honestly long before anything is
priced in it.

Also in this release

• npm install sanction-sdk — the TypeScript SDK, zero runtime
  dependencies, with the full escalate → poll → grant retry loop and
  Vercel AI SDK adapter.
• All 16 open dependency advisories cleared (npm audit: 0), including
  Next.js SSRF and cache-confusion fixes; automated weekly dependency PRs
  now stand guard.
• The official MCP registry listing is current again.
• A new guide on composing Sanction with Vercel Connect: authorize the
  capability, then mint the token.

Honest boundaries

Interception holds for traffic through the broker and the LLM gateway.
The plain hosted wallet URL and stdio MCP remain cooperative — the host
must ask. Traffic that goes straight to an upstream is not governed, and
the Wallet Card says so.

Install: npx sanction-mcp · npm install sanction-sdk ·
getsanction.com · /slack