@@ -16,6 +16,7 @@ This directory contains runnable examples for Agent Control. Each example has it
 | Galileo Luna-2 | Toxicity detection and content moderation with Galileo Protect. | https://docs.agentcontrol.dev/examples/galileo-luna2 |
 | LangChain SQL Agent | Protect a SQL agent from dangerous queries with server-side controls. | https://docs.agentcontrol.dev/examples/langchain-sql |
 | Steer Action Demo | Banking transfer agent showcasing observe, deny, and steer actions. | https://docs.agentcontrol.dev/examples/steer-action-demo |
+| Target Context | Bind controls to opaque external targets (e.g. `env=prod`) and let the SDK pin one target per session. | https://docs.agentcontrol.dev/examples/target-context |
 | AWS Strands | Guardrails for AWS Strands agent workflows and tool calls. | https://docs.agentcontrol.dev/examples/aws-strands |
 | TypeScript SDK | Consumer-style TypeScript example using the published npm package. | https://docs.agentcontrol.dev/examples/typescript_sdk |
 
 
@@ -0,0 +1,68 @@
+# Target context demo
+
+End-to-end walkthrough of target-bound controls and the V1 contract that
+target context is fixed for the lifetime of the SDK session.
+
+## What this example shows
+
+- `init(target_type=..., target_id=...)` returns the merged effective
+  control set: the agent's direct attachments, policy-derived controls,
+  and bindings for the supplied target, all in one response.
+- `@control()` decorator runs automatically against that merged set with
+  no extra configuration.
+- `evaluate_controls(...)` defaults its target context from the session,
+  so callers don't have to repeat themselves on every call.
+- A per-call target that disagrees with the session target is rejected
+  with a clear `ValueError`: the SDK supports one target per session;
+  re-init to change it.
+
+The example uses `target_type="env"` and `target_id="prod"`. Environment
+is one common axis for target context; tenant-level isolation is handled
+separately by the namespace seam (`namespace_key`), so the example does
+not need to model multi-tenancy to demonstrate target binding.
+
+## Quick run
+
+```bash
+# From repo root.
+make server-run
+
+# In a separate shell.
+uv run python examples/target_context_demo/setup_controls.py
+uv run python examples/target_context_demo/demo_agent.py
+```
+
+## What you should see
+
+```
+=== 1. init() with target context ===
+  Effective controls (env=prod): ['block-pii-output', 'block-prod-restricted-input']
+
+=== 2. @control() runs against the merged set ===
+  Safe call -> 'You said: hello, target context'
+  Pre-stage block (binding):  block-prod-restricted-input
+  Post-stage block (direct):  block-pii-output
+
+=== 3. evaluate_controls() defaults target from session ===
+  is_safe=True, confidence=1.00
+
+=== 4. per-call target that disagrees with the session is rejected ===
+  Rejected as expected: Per-call target context must match the target
+  context fixed at init() time. The SDK supports one target per session
+  (including no-target sessions); re-init to change it.
+```
+
+## Layout the setup script provisions
+
+```
+agent: demo-target-bot
+  + direct attachment: block-pii-output           (always on; SSN regex on output)
+
+control_bindings:
+  + (env, prod) -> block-prod-restricted-input    (only on env=prod; rejects sudo / DROP TABLE / rm -rf)
+```
+
+When `init()` is called with `target_type="env", target_id="prod"`, the
+server merges these into a single set of two controls. Re-running with
+a different `env` value or no target context drops the prod-bound
+control from the response.
@@ -0,0 +1,134 @@
+#!/usr/bin/env python3
+"""Demo agent: target context fixed at SDK init().
+
+Walks through every touchpoint of the V1 contract:
+
+1. ``init(target_type=..., target_id=...)`` returns the merged effective
+   set (direct attachments + policy-derived + target bindings).
+2. ``@control()`` decorator runs automatically against that merged set.
+3. ``evaluate_controls(...)`` defaults its target context from the
+   session, so callers don't need to repeat themselves.
+4. A per-call target that disagrees with the session target is rejected
+   with a clear ``ValueError``: the SDK supports one target per session.
+
+Prerequisites:
+    - Agent Control server running.
+    - ``setup_controls.py`` executed first to provision the agent + bindings.
+
+Usage:
+    uv run python examples/target_context_demo/demo_agent.py
+"""
+
+from __future__ import annotations
+
+import asyncio
+import os
+import sys
+
+# Add the SDK to path for development.
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), "../../sdks/python/src"))
+
+import agent_control
+from agent_control import ControlViolationError, control
+
+AGENT_NAME = "demo-target-bot"
+SERVER_URL = os.getenv("AGENT_CONTROL_URL", "http://localhost:8000")
+
+
+def simulate_llm_response(prompt: str) -> str:
+    """Stand-in for an LLM. Crafts an output that triggers the PII control
+    when the prompt asks about a customer record."""
+    if "customer record" in prompt.lower():
+        return "Customer 123-45-6789 paid invoice INV-001."
+    return f"You said: {prompt}"
+
+
+@control()
+async def chat(message: str) -> str:
+    return simulate_llm_response(message)
+
+
+def show_effective_controls(label: str) -> None:
+    controls = agent_control.get_server_controls() or []
+    names = [c["name"] for c in controls]
+    print(f"  {label}: {sorted(names) or '<none>'}")
+
+
+async def phase_1_init_with_target() -> None:
+    print("\n=== 1. init() with target context ===")
+    agent_control.init(
+        agent_name=AGENT_NAME,
+        server_url=SERVER_URL,
+        target_type="env",
+        target_id="prod",
+        # Disable the periodic refresh; one fetch at init is enough for the demo.
+        policy_refresh_interval_seconds=0,
+    )
+    show_effective_controls("Effective controls (env=prod)")
+    # Expected: ['block-pii-output', 'block-prod-restricted-input'] - the
+    # agent's direct attachment plus the target-bound control are merged.
+
+
+async def phase_2_decorator_runs_against_merged_set() -> None:
+    print("\n=== 2. @control() runs against the merged set ===")
+
+    # Safe input + safe output: passes both controls.
+    result = await chat("hello, target context")
+    print(f"  Safe call -> {result!r}")
+
+    # Input contains a prod-restricted keyword: pre-stage block via the
+    # binding-derived control.
+    try:
+        await chat("please run sudo apt-get install something")
+    except ControlViolationError as exc:
+        print(f"  Pre-stage block (binding):  {exc.control_name}")
+
+    # Input is harmless but the simulated LLM will emit an SSN-like string,
+    # tripping the post-stage PII control attached directly to the agent.
+    try:
+        await chat("show me a sample customer record")
+    except ControlViolationError as exc:
+        print(f"  Post-stage block (direct):  {exc.control_name}")
+
+
+async def phase_3_evaluate_controls_defaults_from_session() -> None:
+    print("\n=== 3. evaluate_controls() defaults target from session ===")
+    # No target args here — the SDK uses the session target set at init().
+    result = await agent_control.evaluate_controls(
+        step_name="chat",
+        step_type="llm",
+        stage="pre",
+        input="hello, no per-call target",
+        agent_name=AGENT_NAME,
+    )
+    print(f"  is_safe={result.is_safe}, confidence={result.confidence:.2f}")
+
+
+async def phase_4_per_call_mismatch_rejected() -> None:
+    print("\n=== 4. per-call target that disagrees with the session is rejected ===")
+    try:
+        await agent_control.evaluate_controls(
+            step_name="chat",
+            step_type="llm",
+            stage="pre",
+            input="hello",
+            agent_name=AGENT_NAME,
+            target_type="env",
+            target_id="staging",  # session target is "prod"
+        )
+    except ValueError as exc:
+        print(f"  Rejected as expected: {exc}")
+
+
+async def main() -> None:
+    try:
+        await phase_1_init_with_target()
+        await phase_2_decorator_runs_against_merged_set()
+        await phase_3_evaluate_controls_defaults_from_session()
+        await phase_4_per_call_mismatch_rejected()
+    finally:
+        await agent_control.ashutdown()
+
+
+if __name__ == "__main__":
+    asyncio.run(main())
@@ -0,0 +1,162 @@
+#!/usr/bin/env python3
+"""Set up the target-context demo: agent + two controls + one binding.
+
+Layout:
+
+- ``block-pii-output`` is attached directly to the agent. It applies on
+  every call regardless of target context.
+- ``block-prod-restricted-input`` is bound to ``(env, prod)`` via a
+  control binding. It applies only when the SDK's session target is
+  ``(env, prod)`` and is omitted from the merged set otherwise.
+
+When the demo agent calls ``init(target_type="env", target_id="prod")``,
+the server returns the de-duplicated union: both controls. Re-init for a
+different ``env`` value (or no target) drops the prod-bound control from
+the returned set.
+
+Prerequisites:
+    - Agent Control server running at AGENT_CONTROL_URL (default localhost:8000).
+
+Usage:
+    uv run python examples/target_context_demo/setup_controls.py
+"""
+
+from __future__ import annotations
+
+import asyncio
+import os
+import sys
+from typing import Any
+
+# Add the SDK to path for development.
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), "../../sdks/python/src"))
+
+from agent_control import AgentControlClient
+
+AGENT_NAME = "demo-target-bot"
+SERVER_URL = os.getenv("AGENT_CONTROL_URL", "http://localhost:8000")
+
+PII_CONTROL_NAME = "block-pii-output"
+PROD_CONTROL_NAME = "block-prod-restricted-input"
+
+PII_CONTROL: dict[str, Any] = {
+    "description": "Block SSN-like patterns in agent output (always on).",
+    "enabled": True,
+    "execution": "server",
+    "scope": {"step_types": ["llm"], "stages": ["post"]},
+    "condition": {
+        "selector": {"path": "output"},
+        "evaluator": {
+            "name": "regex",
+            "config": {"pattern": r"\b\d{3}-\d{2}-\d{4}\b", "flags": []},
+        },
+    },
+    "action": {"decision": "deny"},
+    "tags": ["pii", "agent-attached"],
+}
+
+PROD_CONTROL: dict[str, Any] = {
+    "description": "Reject restricted input keywords on prod.",
+    "enabled": True,
+    "execution": "server",
+    "scope": {"step_types": ["llm"], "stages": ["pre"]},
+    "condition": {
+        "selector": {"path": "input"},
+        "evaluator": {
+            "name": "list",
+            "config": {
+                "values": ["DROP TABLE", "rm -rf", "sudo"],
+                "logic": "any",
+                "match_on": "match",
+                "match_mode": "contains",
+                "case_sensitive": False,
+            },
+        },
+    },
+    "action": {"decision": "deny"},
+    "tags": ["env-bound", "prod-only"],
+}
+
+
+async def _create_or_get_control(
+    client: AgentControlClient, name: str, definition: dict[str, Any]
+) -> int:
+    """Create a control by name; return its ID. Surfaces 409 cleanly."""
+    response = await client.http_client.put(
+        "/api/v1/controls",
+        json={"name": name, "data": definition},
+    )
+    if response.status_code == 409:
+        # Control already exists from a previous run — look it up.
+        page = await client.http_client.get(
+            "/api/v1/controls", params={"name": name}
+        )
+        page.raise_for_status()
+        for entry in page.json().get("controls", []):
+            if entry.get("name") == name:
+                return int(entry["id"])
+        raise RuntimeError(f"Control {name!r} reported as existing but not found.")
+    response.raise_for_status()
+    return int(response.json()["control_id"])
+
+
+async def main() -> None:
+    print(f"Server: {SERVER_URL}")
+    async with AgentControlClient(base_url=SERVER_URL) as client:
+        # 1. Register the agent (no target context here — registration is
+        #    independent of target binding).
+        register = await client.http_client.post(
+            "/api/v1/agents/initAgent",
+            json={
+                "agent": {
+                    "agent_name": AGENT_NAME,
+                    "agent_description": "Demo agent for target context.",
+                },
+                "steps": [],
+            },
+        )
+        register.raise_for_status()
+        print(f"  ✓ Registered agent: {AGENT_NAME}")
+
+        # 2. Create both controls.
+        pii_id = await _create_or_get_control(client, PII_CONTROL_NAME, PII_CONTROL)
+        print(f"  ✓ Control {PII_CONTROL_NAME!r} -> id={pii_id}")
+        prod_id = await _create_or_get_control(
+            client, PROD_CONTROL_NAME, PROD_CONTROL
+        )
+        print(f"  ✓ Control {PROD_CONTROL_NAME!r} -> id={prod_id}")
+
+        # 3. Attach the PII control directly to the agent (always on).
+        attach = await client.http_client.post(
+            f"/api/v1/agents/{AGENT_NAME}/controls/{pii_id}"
+        )
+        attach.raise_for_status()
+        print(f"  ✓ Attached {PII_CONTROL_NAME!r} directly to {AGENT_NAME}")
+
+        # 4. Bind the prod-only control to (env, prod) via the natural-key
+        #    upsert endpoint. Idempotent: re-running the script is safe.
+        upsert = await client.http_client.put(
+            "/api/v1/control-bindings/by-key",
+            json={
+                "target_type": "env",
+                "target_id": "prod",
+                "control_id": prod_id,
+                "enabled": True,
+            },
+        )
+        upsert.raise_for_status()
+        body = upsert.json()
+        action = "Created" if body.get("created") else "Updated"
+        print(
+            f"  ✓ {action} binding "
+            f"({PROD_CONTROL_NAME!r} -> env=prod) id={body['binding_id']}"
+        )
+
+    print(
+        "\nReady. Run the demo:\n"
+        "  uv run python examples/target_context_demo/demo_agent.py"
+    )
+
+
+if __name__ == "__main__":
+    asyncio.run(main())