Guides#

Each guide here is a runnable, end-to-end workflow against the live API and CLI. Every command and payload is checked against the code, not the spec.

Start here#

If you are new, follow these three in order. Together they take you from credential to verified, enforced action.

1. Quickstart — submit your first POST /intent, read the APPROVED / ESCALATED / DENIED outcome, and capture the Authority Token.
2. Verify a Token — confirm an Authority Token is genuine, unexpired, single-use, and bound to the right tenant before any downstream system acts on it.
3. Deploy a Policy — install a policy pack with the CLI so your tenant's decisions reflect your rules.

Govern a runtime (OpenShell / OpenClaw / NemoClaw)#

If you operate a shell-style agent runtime and want Intended to compile its network/filesystem sandbox policy:

• OpenShell Runtime Quickstart — compile a policy YAML from presets with openshell-compile.
• OpenShell Starter Kit — the lightweight in-repo pattern for a first pilot.
• OpenShell Operations Runbook — rollout, monitoring, and rollback for a customer-operated runtime.

Conventions used in every guide#

• API base URL is shown as https://api.intended.so. A global /v1 prefix is accepted and stripped, so /v1/intent and /intent are equivalent.
• Credentials are API keys prefixed intended_live_ (legacy mrt_ keys are still accepted); there is no separate sandbox or test key. Present the key as Authorization: Bearer <key> or X-API-Key: <key>. See API Authentication.
• The CLI is flat and hyphenated — intended intent-submit, intended verify, intended deploy-policy. There is no intended policy … command group.