Cryptographic governance for autonomous agents.
Two-process mandatory separation, signed receipts for every tool call, and offline-verifiable evidence for incident response.
The AI agent threat landscape.
Four categories. Each undetectable without sealed baselines and signed evidence.
Supply chain injection
Compromised dependencies, poisoned tool configurations, and malicious MCP server responses can subvert agent behavior before execution even begins. Without a sealed configuration baseline to measure against, the injection stays undetectable at runtime.
Silent drift
Gradual behavioral divergence from an approved baseline goes undetected by periodic audits. Drift compounds over time: each small deviation shifts the agent further from its authorized operating envelope without triggering threshold-based alerts.
Tool-call authorization gaps
Agents invoke tools without cryptographic proof of authorization. Permissions checked at deploy time do not survive runtime reconfiguration. No mechanism links a specific tool invocation back to a sealed authorization decision.
Forensic evidence gap
No tamper-evident record exists of what the agent actually did versus what it reported. Application logs are mutable, written after the fact, and share the agent's own trust boundary. Incident response lacks chain-of-custody evidence.
Two-process mandatory separation.
Two-process separation
Every signed receipt names which sealed authorization permitted the call.
The core primitive is a two-process mandatory separation boundary. The agent process handles inference, reasoning, and tool-call intent. A separate process, the gateway, holds all signing keys, evaluates the sealed policy, and generates cryptographic receipts. Because the agent holds no keys and the deployment wires the gateway as its sole path to external resources, every action the agent takes transits the gateway before reaching those resources, with no route around it.
This differs from application-level guardrails that share the same trust boundary as the agent. When guardrails run inside the agent process, a compromised agent can disable or circumvent them. The gateway operates as an independent decision point: it validates every tool call against the sealed configuration, renders a permit-or-deny decision, and writes signed proof of each decision; the handler that refuses a denied action is wired per deployment. The agent cannot suppress or modify this evidence.
This architecture implements Cryptographic Runtime Governance for the agentic AI domain. For a full architecture walkthrough, see the technology page.
MCP governance architecture.
Three phases. Seal the configs, capture at the protocol layer, prove every invocation.
Seal tool configs into Policy Artifact
Approved tool names, parameter schemas, and invocation constraints are cryptographically sealed into a Policy Artifact before the agent executes. The sealed artifact is the single source of truth for what the agent is permitted to call. Any modification invalidates the signature.
gateway intercepts and validates
The gateway process intercepts every MCP tool call at the protocol level, before it reaches an external resource. Each call is validated against the sealed configuration: tool name, parameters, and context must match the sealed authorization, and the permit-or-deny decision is sealed into a signed receipt. The handler that refuses a denied call is wired per deployment.
Signed receipt per invocation
Every validated tool call produces a signed receipt containing the tool name, parameter hash, timestamp, and authorization reference. Receipts are hash-linked into a tamper-evident continuity chain, giving a verifiable audit trail of each tool interaction that transited the gateway.
Evidence for incident response.
Every governance decision produces evidence structured for SOC and incident-response workflows. Evidence bundles contain the sealed Policy Artifact, the hash-linked receipt chain, and Merkle inclusion proofs linking individual receipts to the continuity chain root. Bundles are self-contained: a responder can verify the entire chain of custody without access to the producing system.
Forensic verification is fully offline. Artifact signatures, receipt signatures, and Merkle proofs validate using standard cryptographic primitives with no network dependency. This supports chain-of-custody review in environments where evidence must be examined in air-gapped forensic labs. See offline verification for tooling details.
Standards alignment.
OWASP Agentic AI Top 10
Addresses tool misuse, prompt injection, and unauthorized agent actions through sealed authorization and signed runtime decisions.
NIST NCCoE AI Agent Identity
Two-process separation provides distinct identity boundaries for the agent and the governance boundary, aligning with agent identity isolation requirements.
CoSAI
Signed receipt chains and evidence bundles align with the Coalition for Secure AI guidance on provable AI system behavior.
NIST AI RMF
Sealed artifacts map to Govern and Map functions; continuous measurement supports Measure; the sealed remediation decision addresses Manage.
EU AI Act Articles 9 & 12
Tamper-evident receipt chains and offline-verifiable evidence bundles align with risk management and automatic logging requirements for high-risk AI systems.
Not a certification or compliance framework. Describes architectural design alignment only.
Frequently asked.
Explore the architecture.
How two-process mandatory separation, sealed artifacts, and signed receipt chains secure autonomous AI agents against the threats above.