Ingress Attribution • AI Agent SDK

IngressAttribution: Resolved answer to 'who/where is this request from', consulted before

IngressAttribution

Defined in the protocols module.

Resolved answer to “who/where is this request from”, consulted before any per-IP policy.

Attributes: trust: The :data:IngressTrust classification. client_ip: The subject to key per-IP policy on. The real client only when it was resolved across trusted hops; otherwise the raw socket peer (never a spoofable header value). via_proxy: Whether forwarded headers were present at all. fail_closed: True when the request was proxy-shaped but unattributable — the caller must rate-limit it as a single bucket keyed on the socket peer and must never trust a client IP from a header.

Properties

Source