AI governance reference
Where signed records fit.
AI governance includes accountability, evaluation, access controls, monitoring and human oversight. AGA addresses one narrower task: giving a reviewer a portable, checkable record of the decisions a gateway recorded.
Start with the review request
What evidence is missing?
- Policy and accountability
- Who approves the workflow, which tools it may use and who handles an exception? A signed record does not answer those organizational questions for you.
- Enforcement and observation
- Which controls actually mediate the tool path, and what did the upstream service observe? AGA receipts record decisions, not proof of downstream execution or universal coverage.
- Portable review evidence
- Can the customer retain the record and verify its signed values against an agreed issuer key without access to the vendor’s dashboard? This is the task the AGA format and offline verifier serve.
Existing signed logs, write-once retention and other gateways may already meet the requirement. Evaluate the actual fields, key custody, export path and reviewer needs before adding another component. Compare the alternatives.
Published implementation
A policy hash and a signed decision.
In aga-proxy, the policy is an unsigned JSON file. Aga-proxy signs its canonical policy hash into each recorded permit-or-deny decision and exports receipts for offline verification. The default permissive profile denies nothing on policy grounds. Receipt coverage has known gaps; routing all calls through the gateway is a deployment responsibility.
Scheduled measurement and validation against a signed Policy Artifact belong to the private reference runtime, not the public proxy. The public aga-mcp-server measures on request, and its client can re-attest its own baseline. See known issues and the architecture.
Possible deployment patterns
Examples, not installed integrations.
Model deployment
Record a decision on a tool call that promotes a model. Integration, operational controls and testing remain deployment work.
Cloud governance
Record control-plane changes routed through the gateway. Integration, operational controls and testing remain deployment work.
Security operations
Hand an investigator a retained receipt chain to check offline. Integration, operational controls and testing remain deployment work.
Broader design blueprints are also retained for reference. They are not shipped products: Disconnected audit; Industrial drift records; Autonomous safe-state decisions.
Check the narrow claim first.
Use a static sample to learn what verification establishes. The control mappings describe limited contributions to selected frameworks, not compliance or certification.