Run an installed lens over the data you send, read its findings and keep the stored result with its digest.
lenses.runPut admission in front of your MCP servers, repositories, SaaS tools and cloud accounts. Every agent gets a lease or a reason – and you keep the lever to stop any of them.
© 2026 Intramedial. All rights reserved. Intramedial is a product by Trustvice. Secured and supercharged by Avonao Labs.
Report abuseYou have leases, a mandate or some text and want a fixed rule applied to them. A lens is deterministic, uses no model and sees only the data you send.
The code reads the key from INTRAMEDIAL_KEY. Keep it in your shell or your secret store, never in a file you commit. Calls that need a signed-in person cannot use a key: the console makes them.
Send the installId and the input; for lease_overlap that is a list of leases.
A Trustvice Product
lenses.runlenses-run
curl -sS -X POST https://api.intramedial.com/api/v1/acp/lenses/run \
-H "Authorization: Bearer $INTRAMEDIAL_KEY" \
-H "Content-Type: application/json" \
-d '{
"installId": "install_7c2e",
"input": {
"leases": [
{
"id": "l1",
"resource": "repo:payments/main",
"holder": "did:web:acme.example:agent:billing",
"start": "2026-11-01T09:00:00Z",
"end": "2026-11-01T10:00:00Z"
},
{
"id": "l2",
"resource": "repo:payments/main",
"holder": "did:web:acme.example:agent:refunds",
"start": "2026-11-01T09:30:00Z",
"end": "2026-11-01T10:30:00Z"
}
]
}
}'const res = await fetch("https://api.intramedial.com/api/v1/acp/lenses/run", {
method: "POST",
headers: {
Authorization: `Bearer ${process.env.INTRAMEDIAL_KEY}`,
"Content-Type": "application/json",
},
body: JSON.stringify({
installId: "install_7c2e",
input: {
leases: [
{
id: "l1",
resource: "repo:payments/main",
holder: "did:web:acme.example:agent:billing",
start: "2026-11-01T09:00:00Z",
end: "2026-11-01T10:00:00Z",
},
{
id: "l2",
resource: "repo:payments/main",
holder: "did:web:acme.example:agent:refunds",
start: "2026-11-01T09:30:00Z",
end: "2026-11-01T10:30:00Z",
},
],
},
}),
});
console.log(res.status, await res.json());import os, requests
res = requests.post(
"https://api.intramedial.com/api/v1/acp/lenses/run",
headers={"Authorization": "Bearer " + os.environ["INTRAMEDIAL_KEY"]},
json={
"installId": "install_7c2e",
"input": {
"leases": [
{
"id": "l1",
"resource": "repo:payments/main",
"holder": "did:web:acme.example:agent:billing",
"start": "2026-11-01T09:00:00Z",
"end": "2026-11-01T10:00:00Z",
},
{
"id": "l2",
"resource": "repo:payments/main",
"holder": "did:web:acme.example:agent:refunds",
"start": "2026-11-01T09:30:00Z",
"end": "2026-11-01T10:30:00Z",
},
],
},
},
timeout=30,
)
print(res.status_code, res.json())status is pass with no findings and fail otherwise. Each finding has a code, a message and a path, and the evidence names both leases. The same rule over the same input gives the same digest.
{
"result": {
"id": "result_3f9a",
"installId": "install_7c2e",
"definitionId": "lens_builtin_lease_overlap",
"version": 1,
"definitionDigest": "sha256:5b1d0c9e7a42",
"inputDigest": "sha256:e07a93b1c6d8",
"status": "fail",
"findings": [{ "code": "lease.overlap", "message": "overlapping leases for repo:payments/main", "path": "$.leases" }],
"evidence": [{ "kind": "lease_overlap", "path": "$.leases", "detail": { "resource": "repo:payments/main", "left": "l1", "right": "l2" } }],
"digest": "sha256:a2c4e8f016b3",
"executedAt": "2026-11-01T09:12:00.000Z"
}
}The result is stored. results returns it by resultId, or lists every result for an install.
Copied from: /docs/lenses-run
The ledger is append-only and sealed under Merkle roots. The time on an entry is Intramedial's own clock, and a signed bundle can be checked offline with the published key.
Compile a mandate with apply: false, read the grants it would make and its previewDigest, then apply exactly what you previewed.
mandates.compileList the detectors, run lease-overlap, and read the conflicts it cites with their evidence, then read the cases it filed for review.
detection.runTake an exclusive lease on a resource with coordination.lease, see who holds it, and let it go when you are done.
coordination.leaseOne short email when we add recipes to the cookbook. No other mail, and you can unsubscribe from any message.
No key or account: Try it on the coordination.admit module page runs the real kernel in your browser. Use a workspace key for your own workspace.