Custom orchestration loop

from certior import Guard

guard = Guard(
    policy="default",
    permissions=["network:http:read", "filesystem:read"],
    budget_cents=5000,
)

result = guard.verify(
    tool="web_fetch",
    params={"url": "https://example.com"},
    content="...optional text to scan...",
    required_capabilities=["network:http:read"],
    cost_cents=10,
)

if result.allowed:
    run_tool(result.redacted_params)   # use redacted_params when policy redacts
    archive(result.certificate)         # signed VerifiedCertificate
else:
    print("Blocked:", result.reason)
    for v in result.violations:
        print(f"  - {v.category}: {v.detail}")

@guard.wrap(required_capabilities=["network:http:read"], cost_cents=10)
def web_fetch(url: str) -> str: ...

html = web_fetch("https://example.com")          # raises CertiorBlocked on block

@guard.wrap(
    required_capabilities=["email:send"],
    cost_cents=5,
    content_extractor=lambda recipient, body, subject="": f"{subject}\n\n{body}",
)
def send_email(recipient: str, body: str, subject: str = "") -> None: ...