@mwe-iai/enforce

MWE IAI Enforcement SDK — enforce identity policies for avatars and AI likenesses.

Protected by U.S. Patents 11,107,105 & 11,922,434.

Install

npm install @mwe-iai/enforce

Quick Start

const { IAIEnforceClient } = require('@mwe-iai/enforce');

const iai = new IAIEnforceClient({
  apiKey: 'iai_your_api_key_here',
});

// Enforce an action (writes audit log)
const result = await iai.enforce({
  avatarId: 1,
  actionType: 'use_likeness',
  requesterRole: 'fan',
});

if (result.decision === 'permitted') {
  // Proceed with the action
  console.log('Audit ID:', result.auditId);
} else {
  // Action blocked
  console.log('Blocked:', result.reason);
}

// Pre-check without writing audit log
const canUse = await iai.isPermitted({
  avatarId: 1,
  actionType: 'commercial_endorsement',
  requesterRole: 'brand_agent',
});

API

new IAIEnforceClient(options)

| Option | Type | Default | Description | |--------|------|---------|-------------| | apiKey | string | required | Platform API key (prefix: iai_) | | baseUrl | string | Production URL | API base URL | | timeout | number | 10000 | Request timeout in ms |

client.enforce(params) → Promise<EnforceResult>

Evaluate an action against the avatar owner's policies. Writes an immutable audit log entry with SHA-256 content hash. Returns the enforcement decision.

For permitted commercial actions, a micro-royalty revenue entry is automatically created.

client.check(params) → Promise<CheckResult>

Lightweight pre-check (no audit log written). Use for UI hints like dimming buttons for blocked actions.

client.isPermitted(params) → Promise<boolean>

Convenience wrapper around check() — returns true if the action would be permitted.

Action Types

| Action | Policy | Description | |--------|--------|-------------| | use_likeness | allowPersonalUse | Non-commercial use of the avatar | | social_share | allowSocialSharing | Sharing generated content | | commercial_endorsement | allowCommercialUse | Brand/commercial usage | | ai_generation | allowCommercialUse | AI-generated content | | agent_action | allowCommercialUse | Autonomous agent action (requires enterprise_agent role) |

Block Reasons

| Reason | Description | |--------|-------------| | kill_switch | Owner has deactivated the avatar | | role_denied | Requester role not in allowed roles | | policy_denied | Action not permitted by owner's policies | | nsfw_blocked | NSFW content blocked by policy |

Webhooks

Register webhooks to get notified of enforcement decisions. Each webhook request includes an HMAC-SHA256 signature for verification.

const crypto = require('crypto');

app.post('/iai-webhook', (req, res) => {
  // Verify signature
  const signature = req.headers['x-iai-signature'];
  const expected = crypto.createHmac('sha256', WEBHOOK_SECRET)
    .update(JSON.stringify(req.body))
    .digest('hex');

  if (signature !== expected) {
    return res.status(401).send('Invalid signature');
  }

  const { event, data } = req.body;
  // event: 'enforce.permitted' or 'enforce.blocked'
  console.log(`${event}: avatar ${data.avatarId}, action ${data.actionType}`);
  res.sendStatus(200);
});

Events: enforce.permitted, enforce.blocked

Webhooks are automatically disabled after 10 consecutive delivery failures.

License

Proprietary — MWE Holdings. Contact [email protected] for licensing.